3 ms·
> Gitlab is still the team that didn't notice that three of their three independent backup mechanisms had not been working for weeks to months. So, this is a r
by eganist 7y ago
> Gitlab is still the team that didn't notice that three of their three independent backup mechanisms had not been working for weeks to months.
So, this is a really good point. Someone made the smart decision within Gitlab to outsource some of the harder problems to an outside party with serious experience on the topics rather than trying to script their way out of the challenge themselves.
> Protection against rogue employees is also something that happens in larger teams, if at all.
ref: amazon w/r/t capital one for a good example of this exact failure mode. (Can't tell if we're in agreement; your statement is a bit ambiguous, but given "if at all," I'm assuming we're on the same page)
- seanhunter 7y agoMy understanding is that the Capital One breach didn't involve any secret information known only to Amazon employees. CapOne had a misconfigured firewall and allowed public internet traffic to servers which were not hardened and got compromised. The person behind the breach happens to have previously worked at Amazon, but it wasn't a rogue Amazon employee breaching an AWS customer.
- eganist 7y agoSeems you're right - https://www.wired.com/story/capital-one-paige-thompson-case-hacking-spree/ https://www.wired.com/story/capital-one-paige-thompson-case-... > Thompson's prior role at the company didn't lend her any insider access in this case. Thanks for the fact check!