How to steal a developer's local database

Re:How to steal a developer's local database by thebeardedone on Thursday September 01, 2016 @01:41PM (#12407320)

Out of curiosity, what data do you have in your development databases that this becomes such a grave concern? I mean I'm all for security and love to see how creative people can get but we are talking about dev environments and not some part of the infrastructure (automated test machines, production, etc).

[ Parent | on HN ]

Re:How to steal a developer's local database by sbarre on Thursday September 01, 2016 @01:45PM (#12407349)

People work in development with copies of production databases all the time..

They absolutely should not, but I've seen it at companies I've worked at, at clients, and I'll admit I've done it at least a few times myself over the years.

[ Parent | on HN ]

Re:How to steal a developer's local database by granos on Thursday September 01, 2016 @01:45PM (#12407348)

I once requested sample data to work against while triaging/fixing a production issue and was given an unredacted copy of the production database. Lots of customer names/addresses/phone numbers/emails in there. I nuked it from orbit when I was done.

[ Parent | on HN ]

Re:How to steal a developer's local database by giosch on Thursday September 01, 2016 @01:46PM (#12407356)

If you had read the whole article, you would have the answer to your question. Es. It can get you to code execution if you poison python pickled data. Ecc..

[ Parent | on HN ]

Re:How to steal a developer's local database by collyw on Thursday September 01, 2016 @04:54PM (#12408808)

I actually thought the opposite. Surely the database is more valuable than the ability to execute code. Assuming its a copy of the production database.

[ Parent | on HN ]

Re:How to steal a developer's local database by thebeardedone on Thursday September 01, 2016 @02:17PM (#12407618)

I give you that; I stopped reading it just before he mentioned that point. Thanks for pointing it out, very creative vulnerability.

[ Parent | on HN ]

Re:How to steal a developer's local database by lagadu on Thursday September 01, 2016 @04:22PM (#12408575)

You generally work with copies of production databases. Hell I have prod copies of a couple banks' databases on my machine at work which I'm pretty sure violates some data protection law somewhere, despite us being (I assume) legally bound to keep the data secret.

AFAIK we're only allowed to have them on our work machines and we encourage clients to sanitize them before handing them over but not many do.

[ Parent | on HN ]

Re:How to steal a developer's local database by flukus on Thursday September 01, 2016 @08:08PM (#12409798)

I generally work with prod backups (it's not uncommon) because you get realistic performance and it makes debugging live bugs much easier.

I prefer to have an annonymization script but many companies are too cheap to allocate time for one.

[ Parent | on HN ]