Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOGE worker’s code supports NLRB whistleblower

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 586 posts

Re: DOGE worker’s code supports NLRB whistleblower

#91

Post by sanderjd »

wmf wrote: post #75
twalkz wrote: post #8

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occa…

[flagged]

Thing is: Everything they're doing is against the rules. Except they aren't "rules", they are laws.

Re: DOGE worker’s code supports NLRB whistleblower

#92

Post by sremani »

watwut wrote: post #82
jiggawatts wrote: post #58

This is much ado about nothing. The article tries to very hard to make something ordinary sound nefarious. This appears to be DOGE employees simply doing their job. You may not agree with what they’re doing in a political sense, but if you were tasked with the same problem you’d come up with a nearly identical solution. For example: “tenant admin” is probably the special role that can bypass access control (not audit…

In that case, you and departments you work for are either breaking the law regularly or working with public data anyway. Besides, no one needs unmonitored write access for audit. Even less DOGE who does no audit and don't have knowledge how to do audit. Audits are supposed to he traceable.

[flagged]

Re: DOGE worker’s code supports NLRB whistleblower

#94

Post by sanderjd »

pan69 wrote: post #40
twalkz wrote: post #8

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occa…

> all-powerful “tenant admin” accounts that were to be exempted from network logging activity Is this normal to build this sort of functionality into a software system? Especially software systems that heavily rely on auditability?

Of course not. It's the exact opposite and every single person here knows this.

Re: DOGE worker’s code supports NLRB whistleblower

#95

Post by [deleted] »

wmf wrote: post #75
twalkz wrote: post #8

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occa…

[flagged]

[deleted]

Re: DOGE worker’s code supports NLRB whistleblower

#96

Post by watwut »

wmf wrote: post #75
twalkz wrote: post #8

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occa…

[flagged]

If your logs show your actions are against the rules, pointing that out is not "sabotage". It is being good guy employee, reporting your against the rules actions.

This one is very very clear and unambiguous. There is no symmetry in your example. The Civil servant is actually in the right and doge bro in the wrong.

Re: DOGE worker’s code supports NLRB whistleblower

#97

Post by underyx »

timewizard wrote: post #47
munchler wrote: post #28

So what exactly is being alleged here? That these DOGE bros wrote and used “hacker” code from GitHub to bypass security limitations on NLRB data? Why would they even need to do that if they had superuser accounts in the system already?

The article is written very poorly. The disclosure itself is far more readable. https://whistlebloweraid.org/wp-content/uploads/2025/04/2025...

Also this PDF contains a detail I haven't seen reported elsewhere:

> Furthermore, on Monday, April 7, 2025, while my client and my team were preparing this disclosure, someone physically taped a threatening note to Mr. Berulis’ home door with photographs – taken via a drone – of him walking in his neighborhood. The threatening note made clear reference to this very disclosure he was preparing for you

Re: DOGE worker’s code supports NLRB whistleblower

#98

Post by nativeit »

dboreham wrote: post #64
mikeyouse wrote: post #53

Earlier quoted context omitted.

I fully believe there's a stack of pardons in Trump's drawer for everyone involved in this debacle. I can't imagine breaking so many laws all over the government if you thought you'd ever have to face consequences. The alternative to pardons in preventing the next congress & administration from cleaning this up is too dire to really contemplate.

Time to remove the pardon powder. Has it achieved anything productive in the last 100 years?

I think it's been used properly in a lot of instances, especially when you consider that federal law can quickly become out-of-step with modern sensibilities, so being able to relieve those harmed by laws flawed under contemporary standards is important. There's probably a better way of handling that, but it's one instance where the power of presidential and governors' pardons have been applied appropriately.

Re: DOGE worker’s code supports NLRB whistleblower

#99

Post by sanderjd »

XorNot wrote: post #55
pan69 wrote: post #40

Earlier quoted context omitted.

> all-powerful “tenant admin” accounts that were to be exempted from network logging activity Is this normal to build this sort of functionality into a software system? Especially software systems that heavily rely on auditability?

It's the same as domain admin in active directory. You always need it to setup the system initially. It's like root on Linux: it's an implementation detail that it must be possible.

The question is whether it needs to be possible to turn off the audit logs for that role. And of course: No.
Post reply on HN