5 ms·
There may have been. The article speaks of the employee using "false usernames". Code review may stop some foolish person pushing broken code, but it's not goin
by gnode 8y ago
There may have been. The article speaks of the employee using "false usernames". Code review may stop some foolish person pushing broken code, but it's not going to prevent a determined saboteur who's masquerading as other authorised users.
- pvaldes 8y agoHow the saboteur knew the passwords of all those users before? If it was a totally new user, shouldn't the system have a list of approved users and a strict protocol to validate a new user?
- falsedan 8y agoI'm baffled at your lack of imagination, but: keyloggers, unlocked terminals, API token sniffing from cookies, reactivated old accounts, changing the reviewing account id in the database, …
- XorNot 8y ago"Hey Ed my password expired, can you use yours to get this done just now..."
- pvaldes 8y agoOne or two times maybe, repeating the trick a lot of times with multiple people without ringing any bell, seem less probable statistically.
- hfdgiutdryg 8y agoI'm baffled at your lack of imagination What does being rude add to the discussion?
- falsedan 8y agoSorry. This was the polite phrasing I came up with…
- pvaldes 8y agoThanks for the reply :-)