• 3 Posts
  • 65 Comments
Joined 2 years ago
cake
Cake day: December 22nd, 2023

help-circle













  • I always feel like the features I’ve worked on become my coworkers or like pets. When a specific feature breaks often, I’ll think “damnit Frank! One of these days I’m going to patch that edge case once and for all!”

    Then I patch Frank and he quiets down so I can focus on the next thing leadership wants.

    You get to know these things and you put care into designing them (if you didn’t put care into them, you’d likely be a hack of an IT person). It’s always hard to see them go.

    Sorry for your loss.


  • Top comment from Mike Brock’s blog (where this diatribe came from):

    Right now it feels we have a growing chorus of people raising alarm, but very few people proposing any specific actions that are commensurate with the scale of the crisis? I appreciate your work and I don’t mean this flippantly, but do you have any proposals more specific than “resist” or “do something”?

    This comment is my thought exactly. Brock isn’t wrong, but he’s just blowing real hard and hoping the house falls down.

    All this blog did was piss me of, but it didn’t point me in a direction.

    (But thanks for posting, OP.)



  • Just one more of a million massive breaches within the last 10 years. No real consequences, I’m sure.

    At this point, I think it’s safe to say that no individual person’s personal data hasn’t been caught in one of these breaches (unless they were born very recently). That’s not even mentioning the hundreds of vendors who I no longer work with but still have my sensitive data on their systems.

    I heard an idea a few years ago that I found interesting: each person has their private data hosted on a secure data hub. If a vendor needs some of that data (ex: FirstName, LastName, Email) for their system, they have to make a request to your hub for it, which you then have to approve. Each time a vendor system needs that data, they make a callout to your hub. As long as they have an active approval, the callout would succeed for the fields they’ve been authorized. You can then revoke that request whenever you’d like.

    I like the idea of having a running list of vendors who have access to your data and being able to revoke that data. However, it would also create a single location (your data hub) that could be breached and be a higher value target than any of the particular vendors.

    Trade-offs.




  • This article is hilarious to me for some reason…

    All 10 defendants were named John Doe because Microsoft doesn’t know their identity.

    So Microsoft doesn’t know who the people are.

    Microsoft didn’t say how the legitimate customer accounts were compromised but said hackers have been known to create tools to search code repositories for API keys developers inadvertently included in the apps they create. Microsoft and others have long counseled developers to remove credentials and other sensitive data from code they publish, but the practice is regularly ignored.

    The accounts that were compromised were likely stolen because the account owners listed API creds directly in their code.

    Microsoft didn’t outline precisely how the defendants’ software was allegedly designed to bypass the guardrails the company had created.

    Microsoft won’t explain how their system is busted.

    The lawsuit alleges the defendants’ service violated the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, the Lanham Act, and the Racketeer Influenced and Corrupt Organizations Act and constitutes wire fraud, access device fraud, common law trespass, and tortious interference. The complaint seeks an injunction enjoining the defendants from engaging in “any activity herein.”

    Whatever the hackers generated sure did piss Microsoft off.