5 ms·
I was at a hackathon once, and they had a startup fair, where various companies had their booths. One startup had created a student-management system for schoo
by abdullahkhalids 4y ago
I was at a hackathon once, and they had a startup fair, where various companies had their booths.
One startup had created a student-management system for schools. And the rep was demoing the system. Except with live data. Showing pages of real students with their pictures, home addresses, etc!
So, principles aside, the actions of companies are such that there can be no trust.
- kevviiinn 4y agoSomeone should have walked up with their phone camera and shouted "ooh hey, nice addresses!" And just started snapping away (or at least pretending to)
- progman32 4y agoYeah. I would seriously have considered asking "did these students consent to the public dissemination of their personal data?" This kind of behavior will only go away when it becomes a shameful act in the eyes of the public.
- Verdex 4y agoI would not be surprised if their resolution to someone taking pictures in order to show them the error in their ways would be for them to call to police and have you arrested.
- a4isms 4y agoI once had a classified ad software hustle, and I needed customer data to debug things. But one of my customers was Canada's largest gay newspaper, and ts classifieds were highly sensitive. So I wrote a routine that obfuscated the database, changing all phone numbers to 555-xxxx, changing all names to random names of fruit (So a customer might become Banana Grapes, 416-555-1234), and a few other changes to hide other possibly identifiable information. I had a menu item to do that to the database, it was under a "developer" menu that only appeared when I was personally signed in as the only superuser. I am embarrassed to say the menu item was called "mixed fruit." One day, I was signed in at the client's office, and the manager came by and wanted to do something or other. I gave him the mouse and keyboard without logging out and asking him to log back in. He did his job, then noticed the developer menu. "What's this," he murmured, and selected "mixed fruit." No confirmation dialog, no warning, it begin munging the live, production database as I watched in horror. I managed to get everything sorted and the production data restored, but I learned a few lessons that day about building super-features for myself that were extremely sharp and difficult to undo.
- rolenthedeep 4y agoI can't decide if replacing names from a gay newspaper with fruit is offensive or hilarious
- Mezzie 4y agoI'm gay (although lady gay) and I think it's hilarious.
- hgsgm 4y agoWhy on earth you create that in the first place, and put it in the menu? How often do you need to trash production (which should be never -- copying and scrabling is plenty bad enough) that you need a menu shortcut for it?!?
- a4isms 4y agoThese were the days before you could just ssh and/or vpn into a client's production system, so I would copy their db onto my Mac, run the mongler on it, and then I would take the database home with me, without worrying whether the theft of my Mac could lead to lives being ruined.
- avg_dev 4y agogood ethics, bad data handling practices. <?php if (! $isProd) { showMixedFruit(); } Also, the code should not be allowed to run on a prod instance, even if it is triggered there. But, I'm sure you've figured this all out by now.
- a4isms 4y agoIf you want to point out that I could have been even smarter thirty-plus years ago, the line forms to the left... Stretches down the block... Goes around the corner... &c. But while my memory is imperfect, I believe that I hardcoded that feature to only work when running on my personal Mac SE/30, and also changed the feature/name to have a tossed salad metaphor.
- jacquesm 4y agoI've seen something very similar with medical data.
- bumby 4y agoI've also seen the pendulum swing in the opposite direction. There was a demo for hospital software that was obviously using fake data. It was something like "Patient Name: Mickey Mouse SSN:123456789" An overzealous IT security manager literally covered the demo with his body until it was taken down. All under the pretense that "You never know, that could be someone's real information."
- jacquesm 4y agoWell, at least Mickey's medical secrets are safe. He doesn't look like the BALB/cJ type to me anyway, but you never know.
- FireBeyond 4y agoI had a background check company that a previous employer used email me to say: "I just wanted to verify that this is the correct email address for you, and that the following info is correct:" and proceeded to list my full name including middle initial, name, phone number, date of birth and full SSN." Mind blown on a couple of levels. Was tempted to reply back "I have no idea who this is - this isn't the correct email". They also found my girlfriend on social media, got her phone number and called her to "verify my identity". To be clear, this was a run of the mill SRE position, not any type of background check for a clearance. Instead, I told my new employer, and they were as livid as I was, profusely apologetic to me, and fired that background check company that day.
- jacquesm 4y agoIf they are Dutch that would be illegal under Dutch law. We have very strict laws around private investigation and anybody doing that without the proper license would be in a lot of trouble.