• 0 Posts
  • 17 Comments
Joined 1 year ago
cake
Cake day: December 22nd, 2023

help-circle


  • I always feel like the features I’ve worked on become my coworkers or like pets. When a specific feature breaks often, I’ll think “damnit Frank! One of these days I’m going to patch that edge case once and for all!”

    Then I patch Frank and he quiets down so I can focus on the next thing leadership wants.

    You get to know these things and you put care into designing them (if you didn’t put care into them, you’d likely be a hack of an IT person). It’s always hard to see them go.

    Sorry for your loss.




  • Just one more of a million massive breaches within the last 10 years. No real consequences, I’m sure.

    At this point, I think it’s safe to say that no individual person’s personal data hasn’t been caught in one of these breaches (unless they were born very recently). That’s not even mentioning the hundreds of vendors who I no longer work with but still have my sensitive data on their systems.

    I heard an idea a few years ago that I found interesting: each person has their private data hosted on a secure data hub. If a vendor needs some of that data (ex: FirstName, LastName, Email) for their system, they have to make a request to your hub for it, which you then have to approve. Each time a vendor system needs that data, they make a callout to your hub. As long as they have an active approval, the callout would succeed for the fields they’ve been authorized. You can then revoke that request whenever you’d like.

    I like the idea of having a running list of vendors who have access to your data and being able to revoke that data. However, it would also create a single location (your data hub) that could be breached and be a higher value target than any of the particular vendors.

    Trade-offs.



  • This article is hilarious to me for some reason…

    All 10 defendants were named John Doe because Microsoft doesn’t know their identity.

    So Microsoft doesn’t know who the people are.

    Microsoft didn’t say how the legitimate customer accounts were compromised but said hackers have been known to create tools to search code repositories for API keys developers inadvertently included in the apps they create. Microsoft and others have long counseled developers to remove credentials and other sensitive data from code they publish, but the practice is regularly ignored.

    The accounts that were compromised were likely stolen because the account owners listed API creds directly in their code.

    Microsoft didn’t outline precisely how the defendants’ software was allegedly designed to bypass the guardrails the company had created.

    Microsoft won’t explain how their system is busted.

    The lawsuit alleges the defendants’ service violated the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, the Lanham Act, and the Racketeer Influenced and Corrupt Organizations Act and constitutes wire fraud, access device fraud, common law trespass, and tortious interference. The complaint seeks an injunction enjoining the defendants from engaging in “any activity herein.”

    Whatever the hackers generated sure did piss Microsoft off.