5 ms·

> The repositories include a large amount of intellectual property… connection strings, cloud access keys, blueprints, design documents, [single sign-on] passwo

> The repositories include a large amount of intellectual property… connection strings, cloud access keys, blueprints, design documents, [single sign-on] passwords, API Keys, and other critical internal information.” Any senior developer or a security researcher knows this kind of secrets should not be part of the source code repository. Has Mercedes-Benz a rotten software development culture?

Sheeny96 3y ago
Many car companies are transitioning from a predominantly mechanical engineering space to a predominantly software engineering space, along with all the legacy mindset that comes with. It's par for the course when they can't understand that they're now a tech company and need to invest as such.
OJFord 3y ago
Senior developer or a security researcher?! This is like.. maybe you have to tell an intern kind of thing.
AlwaysNewb23 3y ago
What I want to know is how are they not using a secret manager (like Doppler or AWS Secrets Manager) at a company of this size? They could have avoided all of this. These types of leaks can cost companies everything (from their data to customer trust).
- miohtama 3y ago
  The root cause: They are not using it because engineers who committed securities to a GitHub repository are not going to have any repercussions. Their salary does not depend on, like the salary of their bosses. So it does not cost anything on a personal level.
  - AlwaysNewb23 3y ago
    You are very correct but it’s also not on the dev product teams to decide the best practices for secrets at large companies. It’s the responsibility of the security and devops team to implement best practices.
    - AlexeyBelov 3y ago
      Sure, it ought to come from above. But what software dev in 2024 doesn't know that keeping everything in the source code is really really bad?
StudyAnimal 3y ago
They call themselves a software company. The guys in India that develop the software know what they are doing but the managers in Germany have no clue what they are doing. Sitting all day in meetings planning strategies for beating Tesla. The guys in India are mostly fixing bugs in software released years ago.

Sheeny96 3y ago

Many car companies are transitioning from a predominantly mechanical engineering space to a predominantly software engineering space, along with all the legacy mindset that comes with. It's par for the course when they can't understand that they're now a tech company and need to invest as such.

OJFord 3y ago

Senior developer or a security researcher?! This is like.. maybe you have to tell an intern kind of thing.

AlwaysNewb23 3y ago

What I want to know is how are they not using a secret manager (like Doppler or AWS Secrets Manager) at a company of this size? They could have avoided all of this. These types of leaks can cost companies everything (from their data to customer trust).

miohtama 3y ago
The root cause: They are not using it because engineers who committed securities to a GitHub repository are not going to have any repercussions. Their salary does not depend on, like the salary of their bosses. So it does not cost anything on a personal level.
- AlwaysNewb23 3y ago
  You are very correct but it’s also not on the dev product teams to decide the best practices for secrets at large companies. It’s the responsibility of the security and devops team to implement best practices.
  - AlexeyBelov 3y ago
    Sure, it ought to come from above. But what software dev in 2024 doesn't know that keeping everything in the source code is really really bad?

StudyAnimal 3y ago

They call themselves a software company. The guys in India that develop the software know what they are doing but the managers in Germany have no clue what they are doing. Sitting all day in meetings planning strategies for beating Tesla. The guys in India are mostly fixing bugs in software released years ago.