News for hackers. Stuff that matters.

A comment on Former employees say Lyft staffers spied on passengers. Parent comment

Re:Former employees say Lyft staffers spied on passengers by djsumdog on Thursday January 25, 2018 @09:55PM (#16236708)
The trouble is, if you're at this level of engineering, you're probably going to be writing the isolation layer. So you already have access to the raw data and you're just going to either make things harder for yourself or only be designing for downstream security.

You can and should restrict customer service reps (only allow them to access routes/users/drivers who they have active tickets on), but at some point you're going to need to trust your developers since they can usually just query the database directly.

[ Parent | on HN ]
Re:Former employees say Lyft staffers spied on passengers by mattmanser on Friday January 26, 2018 @05:22AM (#16238145)
As I said in another comment, there's absolutely no need for an engineer to have access to live data in normal circumstances.

Learning how to recreate bugs without trace stacks or live data is a debugging skill you can learn. Often it's as simple as following the steps described in the ticket, something some developers seem to not realize, or their reading comprehension is bad.

For really complex bugs, you might need some sort of access to see the specific conditions, but it should be attempted with an anonymized version of the db that you had to request and get signed off on.

If you then really need to put in tracing, if should be temporary, the data access should be heavily restricted and it should be deleted/removed once the bug is fixed.

[ Parent | on HN ]
Re:Former employees say Lyft staffers spied on passengers by newfoundglory on Friday January 26, 2018 @05:52AM (#16238254)
> Often it's as simple as following the steps described in the ticket, something some developers seem to not realize, or their reading comprehension is bad.

That sounds like a pretty simple set of bugs you are dealing with. I don't think anyone is arguing that they need this level of information to solve "When I click this button it crashes".

[ Parent | on HN ]