News for hackers. Stuff that matters.
Re:Equifax securities fraud class action [pdf] by gnrlst on Tuesday October 22, 2019 @08:11AM (#21322714)
I'll tell you how this happens:

Colleague #1: "What password shall we set?"

Colleague #2: "Just leave it default for now as we're still testing, we will change it later".

Re:Equifax securities fraud class action [pdf] by bouncycastle on Tuesday October 22, 2019 @08:30AM (#21322836)
Colleague #3: "Sounds good to me. We're behind the firewall and the NIC used for Dell iDRAC or HP iLO is on an isolated network unique to the physical datacenter. Remote access for our techs is managed through a secured bridge that requires all sorts of security hoops on our company intranet, and remote access for general internet traffic is not available due to the firewall restrictions. There's no way hackers will get through that in the first place."
Re:Equifax securities fraud class action [pdf] by Legogris on Tuesday October 22, 2019 @08:40AM (#21322900)
Colleague #4-20: Build various integrations to database, all with their own ways of storing credentials.

Colleague #2: "It's really past due time to change the database password, but first we have to make sure all critical systems can still access the database."

Re:Equifax securities fraud class action [pdf] by bloopernova on Tuesday October 22, 2019 @09:25AM (#21323316)
Which is why forward planning and prompt action is worth so much.

I know I'm stating the obvious, but I've seen some worrying attitudes of "just in time" that seem to go hand in hand with a misunderstanding of Scrum Sprints or Kanban. Where people concentrate on the tree and ignore the vast interconnected forest around them.

Re:Equifax securities fraud class action [pdf] by dspillett on Tuesday October 22, 2019 @09:57AM (#21323617)
Hence the old adage: days of work can save you hours of planning.
Re:Equifax securities fraud class action [pdf] by elisharobinson on Tuesday October 22, 2019 @10:39AM (#21324097)
manager: why is it taking so long to deploy a simple cluster. back in my day we could code a whole ...
Re:Equifax securities fraud class action [pdf] by peterkelly on Tuesday October 22, 2019 @09:32AM (#21323386)
Re:Equifax securities fraud class action [pdf] by merhard on Tuesday October 22, 2019 @09:02AM (#21323109)
nice meme
Re:Equifax securities fraud class action [pdf] by notzuck on Tuesday October 22, 2019 @08:43AM (#21322931)
Excellent use of copy paste from another thread. Upvote!
Re:Equifax securities fraud class action [pdf] by avip on Tuesday October 22, 2019 @08:56AM (#21323060)
Good ol' "temporary permanent" solution.

https://stackoverflow.com/a/778275

Re:Equifax securities fraud class action [pdf] by Phillips126 on Tuesday October 22, 2019 @09:36AM (#21323418)
Thank you for that funny read, lots of great comments!
Re:Equifax securities fraud class action [pdf] by rjkennedy98 on Tuesday October 22, 2019 @02:46PM (#21327195)
You would be shocked at how nonchalant and downright negligent people can be about security at even the largest companies in the US. I did consulting work at a large insurance company that had the contact information, ssn, and PHI of pretty much everyone in the America (and I mean everyone). I lost track of the number of times people checked in the production password into git. In fact our production cassandra instance still was using the default cert password 'changeit' when I left. Unsurprisingly, this company was filled with contract workers and H1B workers that were barely able (if at all) to get their work done.
Re:Equifax securities fraud class action [pdf] by nonconvergent on Tuesday October 22, 2019 @12:00PM (#21325207)
Colleague #437: "So whoever first set this up has left, so I'll just follow the documentation they left to figure out what they did... Oh. ...eh, I got a deadline."