3 ms·

> It seems like if you were committing massive fraud, you'd want to avoid leaving permanent records of it on someone else's systems. Yes, I had to give my prof

> It seems like if you were committing massive fraud, you'd want to avoid leaving permanent records of it on someone else's systems. Yes, I had to give my professional opinion on why some healthcare software here was breached so I asked the company to deliver the source: this software is written from begin 2022. They don’t use any normal (git, cvs, sourcesafe etc) versioning system; just zip files with dates in them. So they sent the ‘latest version’ and we found it’s not the same version as the breached version on the server. So they are saying they don’t know who or what ‘changed the deployed version’.

chubot 3y ago
Actually yeah, this would allow the Dan Ariely defense. He said he got a spreadsheet from a company, and also insisted he didn't doctor the spreadsheet. But he also admits he was the only person who handled the spreadsheet (presumably to not through his collaborators under the bus). He simply says he doesn't know how to reconcile those facts -- that's "your problem" if you want to prove him guilty. But since there's no version control, there's no smoking gun. His defense is basically "I don't know what happened but I'm innocent" And plausibly some of the FTX defendants could have tried this, had they not left permanent records all over the place. They could have worked with zip files with no provenance :-P After all, the burden of proof is on the prosecution. (though of course I'm glad they did leave records, and wish Ariely would have)
- bryanrasmussen 3y ago
  So - what I'm hearing is there is a potentially small but perhaps lucrative market for an onsite git system (because that's what programmers know how to use) that outputs zip files that can then be used as the code archive if Johnny Law comes calling?
  - anonzzzies 3y ago
    It's scary how common it is even though you never hear about it on HN. We get so incredibly many 'versioned zips' via wetransfer, no password/encryption of vital company/gov/healthcare/etc systems...
raverbashing 3y ago
Typical And of course this is the "quality software" that is charged an arm and a leg for

chubot 3y ago

Actually yeah, this would allow the Dan Ariely defense. He said he got a spreadsheet from a company, and also insisted he didn't doctor the spreadsheet. But he also admits he was the only person who handled the spreadsheet (presumably to not through his collaborators under the bus). He simply says he doesn't know how to reconcile those facts -- that's "your problem" if you want to prove him guilty. But since there's no version control, there's no smoking gun. His defense is basically "I don't know what happened but I'm innocent" And plausibly some of the FTX defendants could have tried this, had they not left permanent records all over the place. They could have worked with zip files with no provenance :-P After all, the burden of proof is on the prosecution. (though of course I'm glad they did leave records, and wish Ariely would have)

bryanrasmussen 3y ago
So - what I'm hearing is there is a potentially small but perhaps lucrative market for an onsite git system (because that's what programmers know how to use) that outputs zip files that can then be used as the code archive if Johnny Law comes calling?
- anonzzzies 3y ago
  It's scary how common it is even though you never hear about it on HN. We get so incredibly many 'versioned zips' via wetransfer, no password/encryption of vital company/gov/healthcare/etc systems...

raverbashing 3y ago

Typical And of course this is the "quality software" that is charged an arm and a leg for