3 ms·

Realistically, if you were a developer not in the chain of command and asked to do this: Would you? Could you? You would be knowingly putting your name to a vu

by daemin 8y ago

Realistically, if you were a developer not in the chain of command and asked to do this: Would you? Could you? You would be knowingly putting your name to a vulnerability, and if someone asks then you have to keep it a secret and feign incompetence. Then if they revert your change you'll have to re-implement it. If you do tell your superiors (which would be most likely what would happen, even before writing the code) then you would be in violation and could be put in jail. If you refuse you would be put in jail, or they would go to the next person in their list.

brokenmachine 8y ago
If you think about logistics they'd have to make contact with people in the company to even find out who the devs are who are capable of making a backdoor. That would probably tip off others in the company as to what was happening anyway. You'd think they'd essentially have to serve the whole dev team with the secret order. I think you could immediately resign. It's not a slavery bill... is it?
- daemin 8y ago
  There's LinkedIn, there's social media, there's actually keeping a record of who enters and leaves a company's premises. There's heading down to the bar after work on Friday. There's community events and meetups.
  - bigiain 8y ago
    And there's the previous backdoors they got into BitBucket/Github/Gitlab/Mercurial/Perforce/etc. And,no doubt, the "LEO Portals" that FAANG and FAANG wannabes already have which they'll just hand over to Australian authorities (probably including local councils and the taxi commission, based on evidence about how the metadata retention powers have been used...) After the first few times they use these new powers, the people who're gonna come asking are 99.9% likely to know exactly who the person who will write, commit, and code review the backdoor they're demanding... And their direct manager, and the management chain all the way to the C suite... I think I need to quit this entire industry, maybe take up boatbuilding or something...
  - brokenmachine 8y ago
    But just seeing who's going into the building doesn't tell you exactly who is handling encryption and security in the codebase.
bigiain 8y ago
I wonder what the legal implications of just quitting on the spot when asked might be?

by daemin 8y ago

brokenmachine 8y ago

If you think about logistics they'd have to make contact with people in the company to even find out who the devs are who are capable of making a backdoor. That would probably tip off others in the company as to what was happening anyway. You'd think they'd essentially have to serve the whole dev team with the secret order. I think you could immediately resign. It's not a slavery bill... is it?

daemin 8y ago
There's LinkedIn, there's social media, there's actually keeping a record of who enters and leaves a company's premises. There's heading down to the bar after work on Friday. There's community events and meetups.
- bigiain 8y ago
  And there's the previous backdoors they got into BitBucket/Github/Gitlab/Mercurial/Perforce/etc. And,no doubt, the "LEO Portals" that FAANG and FAANG wannabes already have which they'll just hand over to Australian authorities (probably including local councils and the taxi commission, based on evidence about how the metadata retention powers have been used...) After the first few times they use these new powers, the people who're gonna come asking are 99.9% likely to know exactly who the person who will write, commit, and code review the backdoor they're demanding... And their direct manager, and the management chain all the way to the C suite... I think I need to quit this entire industry, maybe take up boatbuilding or something...
- brokenmachine 8y ago
  But just seeing who's going into the building doesn't tell you exactly who is handling encryption and security in the codebase.

bigiain 8y ago

I wonder what the legal implications of just quitting on the spot when asked might be?