5 ms·

Apparently it was a password protected spreadsheet. Which seems like incredible incompetence of the company to accept code in that format in the first place an

Apparently it was a password protected spreadsheet. Which seems like incredible incompetence of the company to accept code in that format in the first place and to not have demanded the password when the first issue arose.

navaati 7y ago
On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! Still a good laugh from the sidelines...
- john-radio 7y ago
  > On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! It's a little different if only from a professional dignity perspective, lol. Also, every senior programmer I've ever worked with who makes use of third-party binaries will find a moment to say, "I'll just decompile it if it ever gives us any real trouble!"
  - philipov 7y ago
    Corporations have no professional dignity.
- logfromblammo 7y ago
  We deliver source to the customer, and include compiled binaries and installers as a (paid) courtesy. Without the source, the customer loses the ability to switch software contractors, which is against their procurement rules. Even if you don't have the clout of being huge, not controlling the source for business-critical software is basically putting the supplier's gun up to your own head. Companies that take binary-only delivery have obviously never hired anyone who could tell them they shouldn't do that. Always get the source, or write it in-house.
  - iso947 7y ago
    Vast majority of companies rely on Microsoft and other proprietary software
    - logfromblammo 7y ago
      I was not discussing computing infrastructure, such as the OS or office productivity suites, but rather custom business logic, that is specific to the company.
  - mark-r 7y ago
    I once worked for a company that had a spreadsheet for plant production planning. The spreadsheet was put together by a consultant, but it was not protected - the company adjusted it constantly to maximize productivity at the plant. The consultant made more than the plant manager because he was the only person who understood the spreadsheet enough to make meaningful changes as required, e.g. when a machine on the line was replaced with another having a different capacity.
    - sct202 7y ago
      That's the ethical way to do it. If you give a business everything they ask for in requirements, the end result is probably going to be absurdly complicated for anyone to edit even with documentation, training, and open code.
  - davengh 7y ago
    We offer escrow of our source as an option for our customers who have concerns or policies about mission-critical software. The escrow includes instructions about tooling needed & versions (Visual Studio and others), any third-party (Telerik) or open-source things we use, database creation scripts, etc. A couple have run DR drills where they pulled the escrow, went through the instructions, and produced executables.
choeger 7y ago
Yep. If it was me I would hold the supervisors responsible.
- AnIdiotOnTheNet 7y ago
  Of course you would, developers are always blameless!
zelon88 7y ago
If you dump the XML and remove the <sheetProtection password=/> line you don't even need to ask for the password.
- arthurcolle 7y ago
  Haha really? That is hilariously insecure.
  - zozbot234 7y ago
    I surmise that the password feature is not meant for true security. It's not protecting the whole document, just the spreadsheet formulas and VB code. Requesting a password for changes to the formulas obviously prevents accidental mistakes, and makes it unambiguously clear that only some people in the enterprise (those who know the password) are 'supposed' to make these edits. Quite clever, as far as it goes.
    - kevindqc 7y ago
      Makes sense. The software needs to access that code for the spreadsheet to work, so if it was encrypted for example, then the spreadsheet would be unusable unless you know the password
      - arthurcolle 7y ago
        I guess in any case, if you really care about security, you could just encrypt the file separately and only send someone the encrypted binary.
    - NullPrefix 7y ago
      The Torx screw of presentations.
  - gruez 7y ago
    But then again, how would you make it secure? Clearly, the program itself must have full access to the file (formulas and all), otherwise you wouldn't be able to do anything with the spreadsheet (effectively turning it to a pdf). Short of encrypting the entire spreadsheet and sealing the key in a TPM, it's impossible to implement edit protection.
de_watcher 7y ago
You must be crazy to use proprietary closed source software. Oh, wait...
- tantalor 7y ago
  Closed source software prepared and used by only one client is a lot different than distributed and used by many clients.
Rexxar 7y ago
I'm sure there is a lot of password protected spreadsheets in finance industry.

navaati 7y ago

On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! Still a good laugh from the sidelines...

john-radio 7y ago
> On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different ! It's a little different if only from a professional dignity perspective, lol. Also, every senior programmer I've ever worked with who makes use of third-party binaries will find a moment to say, "I'll just decompile it if it ever gives us any real trouble!"
- philipov 7y ago
  Corporations have no professional dignity.
logfromblammo 7y ago
We deliver source to the customer, and include compiled binaries and installers as a (paid) courtesy. Without the source, the customer loses the ability to switch software contractors, which is against their procurement rules. Even if you don't have the clout of being huge, not controlling the source for business-critical software is basically putting the supplier's gun up to your own head. Companies that take binary-only delivery have obviously never hired anyone who could tell them they shouldn't do that. Always get the source, or write it in-house.
- iso947 7y ago
  Vast majority of companies rely on Microsoft and other proprietary software
  - logfromblammo 7y ago
    I was not discussing computing infrastructure, such as the OS or office productivity suites, but rather custom business logic, that is specific to the company.
- mark-r 7y ago
  I once worked for a company that had a spreadsheet for plant production planning. The spreadsheet was put together by a consultant, but it was not protected - the company adjusted it constantly to maximize productivity at the plant. The consultant made more than the plant manager because he was the only person who understood the spreadsheet enough to make meaningful changes as required, e.g. when a machine on the line was replaced with another having a different capacity.
  - sct202 7y ago
    That's the ethical way to do it. If you give a business everything they ask for in requirements, the end result is probably going to be absurdly complicated for anyone to edit even with documentation, training, and open code.
- davengh 7y ago
  We offer escrow of our source as an option for our customers who have concerns or policies about mission-critical software. The escrow includes instructions about tooling needed & versions (Visual Studio and others), any third-party (Telerik) or open-source things we use, database creation scripts, etc. A couple have run DR drills where they pulled the escrow, went through the instructions, and produced executables.

choeger 7y ago

Yep. If it was me I would hold the supervisors responsible.

AnIdiotOnTheNet 7y ago
Of course you would, developers are always blameless!

zelon88 7y ago

If you dump the XML and remove the <sheetProtection password=/> line you don't even need to ask for the password.

arthurcolle 7y ago
Haha really? That is hilariously insecure.
- zozbot234 7y ago
  I surmise that the password feature is not meant for true security. It's not protecting the whole document, just the spreadsheet formulas and VB code. Requesting a password for changes to the formulas obviously prevents accidental mistakes, and makes it unambiguously clear that only some people in the enterprise (those who know the password) are 'supposed' to make these edits. Quite clever, as far as it goes.
  - kevindqc 7y ago
    Makes sense. The software needs to access that code for the spreadsheet to work, so if it was encrypted for example, then the spreadsheet would be unusable unless you know the password
    - arthurcolle 7y ago
      I guess in any case, if you really care about security, you could just encrypt the file separately and only send someone the encrypted binary.
  - NullPrefix 7y ago
    The Torx screw of presentations.
- gruez 7y ago
  But then again, how would you make it secure? Clearly, the program itself must have full access to the file (formulas and all), otherwise you wouldn't be able to do anything with the spreadsheet (effectively turning it to a pdf). Short of encrypting the entire spreadsheet and sealing the key in a TPM, it's impossible to implement edit protection.

de_watcher 7y ago

You must be crazy to use proprietary closed source software. Oh, wait...

tantalor 7y ago
Closed source software prepared and used by only one client is a lot different than distributed and used by many clients.

Rexxar 7y ago

I'm sure there is a lot of password protected spreadsheets in finance industry.