News for hackers. Stuff that matters.
Re:Intent to issue €2.5M fine to Disqus over GDPR breaches by zepolen on Thursday May 06, 2021 @11:17AM (#27064512)
They probably used yaml for their config...
Re:Intent to issue €2.5M fine to Disqus over GDPR breaches by speedgoose on Thursday May 06, 2021 @11:58AM (#27065195)
For people who are not aware, if you write the value no in YAML, it parses it as the boolean false which is then usually converted back to the string "false". The solution is to write "no" and not no, but Norway is the only country code requiring this so a lot of people forget about it.

For example I noticed this week that an environment variable in a few of my Norwegian company's deployments was "false" and not "no".

Re:Intent to issue €2.5M fine to Disqus over GDPR breaches by colejohnson66 on Thursday May 06, 2021 @05:15PM (#27069129)
Syntax highlighting to the rescue! I’ve almost been bitten by that “feature” before, but the VS Code extension for YAML caught it.
Re:Intent to issue €2.5M fine to Disqus over GDPR breaches by speedgoose on Friday May 07, 2021 @12:44AM (#27072246)
That's how I noticed the issue this week. The no value was green, which was a bit suspicious.
Re:Intent to issue €2.5M fine to Disqus over GDPR breaches by StavrosK on Thursday May 06, 2021 @12:14PM (#27065443)
This actually sounds extremely plausible.
Re:Intent to issue €2.5M fine to Disqus over GDPR breaches by eitland on Thursday May 06, 2021 @04:32PM (#27068732)
Agree, but they probably aren't off the hook just because of that.

I think user data is "fissile material" and the "fallout" from a high profile "meltdown" at certain places can easily destroy more lives than the Chernobyl actully ended up destroying.

Given this yaml and a number of other known problematic technologies probably shouldn't be used anywhere near the "reactors".

Re:Intent to issue €2.5M fine to Disqus over GDPR breaches by StavrosK on Thursday May 06, 2021 @04:38PM (#27068787)
Certainly, but I can sympathize more with a mistake than with a deliberate tracking attempt.