10 ms·
VW fired senior employee after they raised cyber security concerns
- zibzab 5y agoOh dear, is this behaviour UNECE 155 complaint?
- outside1234 5y agoThis is the company that faked emissions tests for years
- ghostbrainalpha 5y ago"They were not fake. They were just less real than they could have been under ideal conditions." ~ The P.R. Department
- nunez 5y agoWhile Tesla is ramping up their finance and insurance businesses, VW is selling theirs. Unless VW is selling it so that they can rebuild their own operation from scratch, this is yet another example of big auto missing the point
- rossdavidh 5y agoWell, it could be argued that selling 75% of such a business to a major financial firm, is better than running it yourself, if you don't have the financial and IT staff to do so in a risk-mitigating way. It's easy to get into a ton of trouble quickly in finance and insurance. VW might or might not have done this for the right reasons, but perhaps handing this over to a financial firm is, in fact, the right decision (for them).
- Daedren 5y agoDo we have a non-paywalled version of this article?
- tcmb 5y agohttps://archive.is/WMRDD https://archive.is/WMRDD
- soco 5y agoIs it just me??? "An error occurred during a connection to archive.is. archive.is uses security technology that is outdated and vulnerable to attack. An attacker could easily reveal information which you thought to be safe. The website administrator will need to fix the server first before you can visit the site."
- kwhitefoot 5y agoI had to complete a captcha before Cloudflare would let me go to archive.is.
- CircleSpokes 5y agoIt works fine for me
- syshum 5y agoAre you using CloudFlare DNS, CloudFlare and Archive have a Long and Public Disupute over DNS or rather eDNS
- whatthesmack 5y agoI get this when using iCloud Private Relay. Not sure if it applies to you, but turning off the relay feature fixed the issue for me.
- dudeinjapan 5y agoSecurity by job insecurity
- mlac 5y agoStrategically reducing the attack surface.
- xiphias2 5y agoThe employee probably was too public about the issue instead of just going up his manager hierarcy. That's the professional way to do it (and if it doesn't get addressed, there's nothing more he can do).
- johnnyo 5y agoThe article makes no mention of the employee making any public statements or disclosures
- onion2k 5y agoThat's the professional way to do it (and if it doesn't get addressed, there's nothing more he can do). I'd argue that if your boss is refusing to act on a serious security concern you have a moral duty to take it further up the hierarchy yourself, and to (responsibly) disclose to the government/public if the company won't listen. Shrugging and saying "Well, I tried!" isn't good enough.
- yial 5y agoI agree - looking at the organizational directives I've worked on creating during my career, many specify that if you supervisor/manager/director does not act on an issue that is critical, that you are empowered to continue ahead and/or request followup. There are more things and nuances specified, but the idea of "this is critical, but oh well my manager ignored me... nothing more I can do." doesn't seem to breed organizational success. (By no means I am advocating for insubordination per se.)
- xiphias2 5y agoI was also talking about going up the hierarchy, but I'm afraid that he went to other bosses that made his division look bad. I would never go public without going to a lawyer first, and getting enough proofs (emails) that I did everything I could to raise alert in a responsible way inside the company first. Edit: after rereading the article I thing we just don't have enough data to know how things happened exactly.
- gorjusborg 5y ago
- itsdrewmiller 5y agoWhile of course it could truly be for unrelated reasons, the direct response from VW is inconsistent with a company trying to change a culture of coverup and fraud: >VW said the information provided proved to be “irrelevant” and that “the employee was terminated due to fundamental differences in the way we work together”. Better PR would be something like "While the reported issue turned out to be a misunderstanding, we appreciate and encourage all employees to speak up if they have similar concerns. Our separation from the employee was in no way related to their reporting of that incident - if anything, it was a mitigating consideration."
- throwawaysleep 5y agoI am not sure that you can change a culture without firing thousands upon thousands of people. At a minimum, you are starting with a bunch of people who default to cheating and lying as a solution to problems. You can put in new barriers to it, but these people are skilled at beating barriers. I say this as a cheater and a liar. It also doesn't help that careers with companies are so short. I have no stake whatsoever in whether a company I work for succeeds long term or not. Just want a nice resume line really.
- phkahler 5y ago>> I say this as a cheater and a liar. I really appreciate the honesty that can be obtained via anonymity. It might be interesting to have honest discussions with "bad" people, but most of them appear either not self-aware, or refuse to be honest about things.
- throwawaysleep 5y agoPeople distinguish heavily between intentional and accidental harm to them, so lacking self awareness is a survival mechanism. I have worked for a company that had a data breach. - If I said in the post mortem that I didn't report the issue as it was more work and I could not be bothered, people would be enraged, but beyond the yelling, I would probably survive in that role. - If I said that I didn't report the issue as I wanted to seem like a hero when I fixed it (real thing my boss did from my days at another company), I would be fired. - If I didn't report the issue due to not knowing the right channel, they criticize my lack of initiative, but it is understandable. - If I did not report the issue due to not knowing about it, I am blameless. You cannot admit to being a bad person without taking a lot of flack.
- outside1234 5y agoI'm more surprised VW has anyone that understands software
- thriftwy 5y agoThey did understand it enough to produce their famous Gaswagen engine, weren't they.
- tonyedgecombe 5y agoThey are trying to hire 2000 more employees in software and electronics. I don't know why you would want to work there when they might fire you for raising security issues though.
- rad_gruchalski 5y agoIt's really easy. You take interns in so you can teach them the things you want them to know and the procedures you want them to follow. Those who don't fit, you cut because "there was no cultural fit". This way you have hordes of "software engineers" who don't raise such matters. Maybe that's the reason why those German companies find it so difficult to hore external experienced consultants?
- ncmncm 5y agoTwo words: "cost center". Two more words: "run away!"
- raxxorrax 5y ago
- throwawaysleep 5y agoCultures like this are why I no longer bother with doing anything close to worthwhile code review. I would rather the defect be reported by a customer, as you cannot make their life difficult. You can make mine difficult though. Yet another way companies encourage me to do the bare minimum.
- gdgdgdgbgfff 5y ago[dead]
- azinman2 5y agoI know off topic but from 12 foot’s homepage: > You ought to be able to search something on Google and get an answer to your question without signing up for some newsletter. Why ought you? That sounds not only incredibly entitled, but also extremely one sided. The world isn’t being created for your convenience and wallet. It would be better if the bias was explicit, like “I would prefer to be able to get all information free of charge,” in which case honesty and audacity are clear. This reminds me of the old hacker cry “information wants to be free,” which of course anthropomorphizes information and hides the bias, which is the hacker wants all information independent of everyone else’s concern.
- gwbas1c 5y agoBecause then the only way to use the web would be to subscribe to everything. It's economically unfeasible.
- emperorcezar 5y agoIf you want to put content behind a wall of some kind, that is fine. You can't expect to have it be indexed in search. Having it show in search results while having a wall in front of it once someone clicks is a bait and switch. You can't have you cake and eat it too.
- mynameisvlad 5y ago> You can't expect to have it be indexed in search Why not? This is just as entitled a thought as the original quote from GP. Search engines aren't a public service. Neither is The Financial Times. There's nothing that explicitly requires every single page that a search engine displays to be accessible by the user. There isn't even an internal policy within Google and other engines that would uphold that expectation. It might be a shitty user experience, but that's on the search engine and the resulting site to deal with. Clearly, the FT has enough subscribers to be able to "lose" customers behind the paywall. And clearly Google isn't interested in cleaning up results to not include paywalls. So it seems they've both weighed the pros and cons and chose to continue with it. Who are we to tell them otherwsie?
- noipv4 5y ago"whatever Tesla can do, Volkswagen can do better" said Herbert Diess, then Volkswagen CEO.
- antisthenes 5y ago"We can reduce our emissions to zero and beyond!"
- rnk 5y agoThat's not as silly as it sounds I think. You could improve the air quality to be better than if your car existed, if you weren't generating carbon pollution and were say removing pollutants from the air as you drive. In reality this would be really hard, but if you had solar powered car and removed nox or something. But then you get into the infinite tail of the energy and pollution used to make your car.
- nexuist 5y agoGoing after whistleblowers is one of those things, I guess.
- kwhitefoot 5y agoIt's unclear from the article in which jurisdiction this occurred. Was it in Luxembourg? Or the elsewhere in the EU? Or the US?
- missedthecue 5y agoThis wouldn't happen in Europe, where labor laws are strong.
- jms703 5y agoThis article is missing so many important details to be taken seriously. It serves no real purpose.
- giantg2 5y agoThis story doesn't surprise me. I was responsible for system security for one of our internal systems. I found a major vulnerability - SQL injection with full schema owner privileges on all our pages. So I went to the principle/dept head to see how they wanted to staff the remediation and which of the two proposals they wanted to go with. I was told they have a near real-time backup system and it's only and internal system (that handles obscene amounts of money), so they didn't want to address this. I asked if we have any documentation about the restore process or how long it would take. Nope. Have they ever tested this restore process. Nope. Goodbye! Posted to a different team very quickly.
- ncmncm 5y agoThat is the only sanity-preserving response. Nobody can prove anything to their employer. And, you don't owe them anything. So, sometimes the best that can be done is to leave them to fail without you. It sucks, though, when it is a bridge you know will collapse.
- torginus 5y agoSecurity at a lot of large SW companies is a farce - I remember working on a huge piece of software, that had millions of lines written by 1000s of people. Everyone knew it was swiss cheese that anyone with a clue could easily exploit. The firm hired some crack cybersecurity consultant - who was probably in on the joke. The guy mulled over the software, and found some Rube-Goldbergesque CVE-worthy exploit involving timing attacks, privilege escalation and what not. It was an impressive find, and they probably tried to insinuate, that the software was this hard to exploit. A week later, I was debugging some memory leak - it turned out the app was hanging on to some authentication state objects, which among other things contained the username and plain-text password of every login attempt. Now, the software also had a feature of writing memory dumps when it crashed - another thing that was not terribly difficult to achieve. So the attacker could just walk up to the public computer, click around a bit, make it crash, then copy off the resultant dump file, and see everyones credentials who ever tried to log in. I was a junior guy back then. When I told my boss, he realised that this was so embarassing, that we just fixed it - no bug ticket, no formal announcement, no nothing. This software handled very sensitive data.