These type of people actually have driving licences ...
Uber Paid Hackers to Delete Stolen Data on 57M People
601–606 of 606 posts
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#602Earlier quoted context omitted.
Hah, setting the example himself I remember him yelling / and cursing at an Uber driver in NYC, very ethical. Good luck and I hope you're doing it for the money, cause nobody should buy the "Uber is an ethical company" bs.
Dara Khosrowshahi is the CEO now, not Travis Kalanick... Maybe catch up on the facts before reaching for the pitchforks? :)
Ha, the trouble is that pitchforks are more fun than facts.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#603Earlier quoted context omitted.
There's a lot of things we as adults agree to where the consequences can be steep. This is one of the easier ones: we just show up on time. We plan accordingly and we, as responsible adults, manage to pull it off. That's not hard: so why not agree to such a thing? Another perspective on this is why should we expect someone else to bear the consequences of our failing to meet our responsibilities? If we're late pickin…
So you're in a car accident on the way and wake up in the hospital with a few thousand dollars in fines. Or better yet, pass out at home (in spite of being in good health; blood pressure can do weird things) with no witnesses and come to a few hours later.
Even if there are no extreme cases like this, the stress of $10*num_of_min fine is not worth it. It seems disproportionate by a huge margin, and may contribute to bad health issues (e.g. blood pressure).
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#604Earlier quoted context omitted.
It may be amateur, but it's one of the most common mistakes. Even at top companies.
Amateur may not have been the best word. Maybe easy or lazy or debt. Ive seen it a lot where it was something that was inherited and the current team knows its a problem, but they have a 1000 features to build and never get around to fixing that debt.
The cure for this is to get a pentest. It forces you to care.
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#605Earlier quoted context omitted.
> In an organization of about 200 engineers across various products, 1000+ github repos Wait, what? That's 5+ repos per engineer. What on earth would warrant that level of granularity? I've only worked once in my career in a place that used more than 2-3 repositories total, and that was a "MegaTechGiant" with thousands of engineers.
Depends on the company you work at, but most tech companies I've been at have gone the "micro" services approach. Example: - 1 repo for the frontend - 1 for each api - 1 for the infrastructure terraform scripts It's good for CI / CD and general code base organization. Also easier to track changes and handle security. You give devs access only to the repos they need to do their job. Our team has a product with multipl…
Plus one repo for every open source dependency you fork
Re: Uber Paid Hackers to Delete Stolen Data on 57M People
#606> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…
I'm surprised Uber doesn't have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . . [1] https://help.github.com/articles/requiring-two-factor-authen...
Two factor won't protect you from a spear-fishing attack.
The attacker can submit your info to GitHub the moment you submit to the malicious site. You receive the token via SMS as expected, enter it on the second page of the malicious site, granting them access.