News for hackers. Stuff that matters.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by terminal_d on Wednesday November 16, 2022 @03:08PM (#33629764)
> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless:

Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've witnessed). Wouldn't be surprised if this turns out to be just the tip of the iceberg, because putting people with 6-12 months of programming / computer "experience" (that they only signed up for because of the money) in charge of major production systems is a recipe for disaster.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by drcross on Wednesday November 16, 2022 @03:20PM (#33629947)
>No competent employee stays in those companies

Absolutely true from first hand experience.

Imagine being a top performer doing great work for a company whose managers insist on wasting your time putting you into needless meetings getting you to explain how you're doing everything all through badly communicated text with typos and misspellings.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by rodgerd on Wednesday November 16, 2022 @05:50PM (#33632046)
I didn't know Elon owned Infosys as well.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by Gare on Wednesday November 16, 2022 @05:54PM (#33632106)
Well, at least it got Rishi('s wife) rich.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by duxup on Wednesday November 16, 2022 @03:58PM (#33630467)
I had some contact with Wipro. It was their standard operating procedure to call us up and yell at support team members that X "Hasn't worked for months and you haven't done anything." when in fact they just opened the ticket. They would lie and reference the first old ticket they could think of and say it was the same issue (it never was, they wouldn't even lie well enough to reference the same equipment).

They would declare everything was a P1 ticket and demand it be fixed immediately. Then we would get some output from the machine or even remotely access it and find that outside of testing at the factory this was the first time it was powered on. When we would ask them for configurations ... they were evasive.

If you got their end customer on the line you would find that they had been lying to them for months. This happened a lot ...

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by robofanatic on Wednesday November 16, 2022 @04:00PM (#33630508)
> Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die.

This could be true but you cant really generalize and it has nothing to do with the article. Infosys is not the only company leaking keys online. pretty sure tons of Amarican companies have done that

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by duxup on Wednesday November 16, 2022 @04:02PM (#33630536)
I think that post goes on to explain why that might be relevant.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by willywanker on Monday November 21, 2022 @06:48PM (#33699852)
Infosys bot spotted. 'Amarican' companies eh?
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by smcl on Wednesday November 16, 2022 @05:08PM (#33631501)
> Cognizant

Someone hired those clowns as contractors as extra in a previous job, to loud protests from our development team. They produced what was quite possibly the most chaotic, copy-paste, typo-laden code I have ever seen in my life.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by 0xmohit on Wednesday November 16, 2022 @09:07PM (#33634010)
This is hardly surprising. Most of them would be completely clueless about the code they've "written".
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by dessant on Wednesday November 16, 2022 @05:39PM (#33631907)
Fun fact: Mozilla projects are now developed in part by Cognizant Softvision, including Firefox for Android. Their employees are everywhere in Mozilla repositories, and their numbers seem to have increased since 2020, right after Mozilla fired a quarter of its workforce.

https://www.cognizantsoftvision.com/blog/pedal-metal-mozilla...

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by alfiedotwtf on Wednesday November 16, 2022 @06:27PM (#33632514)
This pisses me straight off. Someone needs to fork Mozilla and bring it back to its hayday
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by propogandist on Wednesday November 16, 2022 @09:17PM (#33634088)
they went woke, and are on the path to go broke. Sadly, they’re the only mainstream competition to Chrome.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by waste_monk on Wednesday November 16, 2022 @09:49PM (#33634330)
> and are on the path to go broke. Sadly, they’re the only mainstream competition to Chrome.

Is it overly cynical of me to wonder if this is Google's doing? Setting someone to infiltrate Mozilla's management and sabotage it, with the long-term goal of killing all serious non-chromium alternatives.

I don't know about the woke thing, I figure it's more likely to be about removing ad-block friendly API's in Manifest V3 (and presumably even more hostile changes in some future Manifest V4).

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by sdf4j on Wednesday November 16, 2022 @11:08PM (#33634840)
Nobody wants firefox to stay around more than google. Its one of their few escape cards in an antitrust trial for browser monopoly.

And the woke thing is non sense.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by userbinator on Thursday November 17, 2022 @12:51AM (#33635460)
Nobody wants firefox to stay around more than google. Its one of their few escape cards in an antitrust trial for browser monopoly.

Google wants Firefox to stay around, but in a form that's much closer to Chrome. Of all the browsers that still have significant userbase remaining, Firefox is an "anomaly" in that it's one the user has more control over, and Google is slowly trying to change that.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by willywanker on Monday November 21, 2022 @06:44PM (#33699822)
Already happened years ago, if you want the old Firefox with XUL extension support, full themes and zero tracking as it was before they started copying Chrome in 2011, give Pale Moon a try. It's an independent fork, the last independent browser left, with its own rendering engine Goanna that is a fork of Firefox's Gecko.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by udkl on Wednesday November 16, 2022 @08:12PM (#33633586)
This is a #TIL to me. I'm not sure I would trust these Mozilla projects going ahead.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by csande17 on Thursday November 17, 2022 @12:58AM (#33635503)
Luckily, if https://wiki.mozilla.org/QA_SoftVision_Team is any indication, they're mostly babysitting test suites and reviewing submissions to the add-on store and stuff. (That and developing Firefox for Android, but Firefox for Android has sucked and included tracking SDKs for years now.)
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by alfiedotwtf on Wednesday November 16, 2022 @06:26PM (#33632497)
I've seen Infosys-produced code that there was no way it was going to work... turns out that after I googled it, multiple lines were straight 1:1 copy pasta from multiple StackOverflow answers - just jammed together in the hope that something would work. I was shook.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by alisonatwork on Wednesday November 16, 2022 @08:23PM (#33633674)
This is unfortunately common even outside of Infosys. I've experienced it at several of my former employers, although admittedly more in China than in other countries I worked.

It's interesting when you sit beside a developer who does this kind of stuff in a pair-programming context, because it immediately becomes clear that they really don't have a clue how to read and understand code in the abstract. Their process is literally copying and pasting stuff that seems similar and then running it until some arbitrary happy path test passes, not considering that it might only be passing by accident, or that they might not even be testing a real business scenario, or that there are now a bunch of unused and misleadingly-named variables floating around. And when you point that out, there isn't even a lightbulb going on that perhaps they should try to clean things up or adapt the pattern to better fit the specific use case.

I've always attributed it to a mindset that doesn't really take quality into account. And it's hard for me to argue the point when I have also been "guilty" of doing a quick hack solution or employing YAGNI to build something that might not be DRY or especially elegant but does work to solve the problem. People who just throw everything at the wall until something randomly sticks believe they're doing the same thing. Who cares if the code is unmaintainable or not performant? Who cares if there's a bug? They still get paid anyway, and the corporate machine just keeps rolling on. So - from their point of view - why make the extra effort? For me I think it's just a neatness or tidiness compulsion that makes me want to try to make code clear, robust, backward compatible and maintainable. But realistically even if I didn't do that, I'd probably still be 20 years into my career and working as a senior dev, so what's the difference?

It makes me sad.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by avg_dev on Wednesday November 16, 2022 @09:34PM (#33634204)
I don’t know you at all aside from this post, so I could be off the mark, but I suspect you need to find a better place of employment. Places where people exercise discretion and aim for quality and ship quality do exist. They are not the norm, but they absolutely exist.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by alisonatwork on Wednesday November 16, 2022 @11:24PM (#33634946)
Thanks for the suggestion. I am pretty happy in my current place of employment where I fortunately haven't (yet) encountered this, but I have definitely been surprised in previous jobs where I encountered it despite hiring standards that theoretically should have rejected this type of candidate at the outset. I have even worked with ex-FAANG colleagues who had this approach to development. I have come to think there is only so much you can do to try solve this in the hiring funnel... Eventually people who don't code very well or don't take code quality seriously will slip through, especially in larger companies.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by mindentropy on Thursday November 17, 2022 @08:50AM (#33638829)
Man, I echo the same sentiments. Even I too have this compulsion for neatness and tidiness and find it near impossible to work on completely messed up code.

>But realistically even if I didn't do that, I'd probably still be 20 years into my career and working as a senior dev, so what's the difference?

Similar thoughts. Looking back I think about all the time I had sacrificed to make myself better but for what? There is no value for this as I have seen totally incompetent people still standing and moving much ahead. The corporate juggernaut does not give a damn about workmanship or quality, something I learnt later in my life as I took a pause to catch my breath.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by hnfong on Thursday November 17, 2022 @12:24PM (#33642312)
Somehow this triggers memories of (among all things) taking exams when I was a student.

Unless you prepared well, there's often some exam questions you are clueless about, and yet there's usually no penalty for writing some bullshit in the hopes of accidentally getting a partial score. So what students are trained to do is to write whatever bullshit that seems to be relevant and hope for the best.

I realized the mindset that makes me a quality-conscious programmer is actually the anti-thesis of this. In fact during my later years I almost couldn't do that exam-bullshitting any more. It feels so bad writing something I don't understand that I almost couldn't do it.

This might be offtopic, but I guess many people who don't have a natural OCD-tendency to deeply understand their work and care about tidiness might have to actively unlearn what they trained for at least a decade in school...

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by P5fRxh5kUvp2th on Wednesday November 16, 2022 @06:33PM (#33632586)
> No competent employee stays in those companies

I gotta say, this explains so much.

We have a FTE who came from infosys and he's very good. I have such a hard time squaring that with the team that submits an initial PR with the bin and obj directories checked in, then follows it up by adding .gitignore.txt file before FINALLY submitting a .gitignore file. And then finding them representing currency as float, or finding catch statements with a single line that rethrows it, as below (C#)

// this form throws away the stack trace from the original exception. catch(Exception ex) { throw ex; }

And when asked why this exists they add logging to it

catch(Exception ex) { _log.Debug("Unhandled exception handled.", ex); throw ex; }

----

I could go on, but the ole eyebrow just twitches whenever I think about infosys.

But then I see this other person who came from infosys. It's like trying to understand how that 6'11" basketball player came from that family who has no one over 5' tall.

Rationally I know strong technical folks can come from these companies, but damn... how? There's another poster claiming everyone makes mistakes, but no, many of the mistakes they make are not reasonable.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by QuinnyPig on Wednesday November 16, 2022 @06:37PM (#33632624)
They employ a quarter million people. Quality may vary…
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by _djo_ on Thursday November 17, 2022 @02:40AM (#33636045)
Yes. There are a number of highly skilled and talented people in Infosys and the other WITCH companies, but they're generally staffed only on the most prestigious projects and tend to move on fairly quickly. As another commenter said, in most cases they got recruited straight out of college.

So it's not that everyone at companies like Infosys are bad, it's that their hiring standards are so lax and hiring rate so high that the majority of their engineering people are mediocre at best.

The typical model of a WITCH engagement is to get a new client project that requires, say 100 engineers, and immediately go to market to hire 90% of them because they don't have a bench. Screening is minimal. They're then heavily micromanaged on the project for the first few months, where it's expected that at least half of those people will fail and either their manager or the client will demand they get rotated off and then sacked. They're replaced by another cohort freshly hired and the process repeats until you have a stable-ish team of good-enough competence about 8 months in.

It works because it's still cheaper and easier for big corps and big projects and the delivered quality is fairly shit, but still acceptable. And the margins are so good that in the rare event there are late delivery penalties they're fairly easily absorbed.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by udkl on Wednesday November 16, 2022 @08:10PM (#33633569)
He must have joined Infosys at 'on-campus' recruitment. Infosys and other companies might have visited his campus, he gave a sort of test and he was selected. Sometimes, once you pass an interview, you aren't allowed to try for other on-campus companies. So he was 'stuck' with Infosys.

The other reason is that programming as a hobby during college isn't a thing in India. (This might have changed in recent years). So you only get a chance to really mature as a programmer in the first few years out of college. So when he was ready to move on from Infosys, he had matured, but still had the Infosys 'stigma'.

And then it's really a numbers game. Infosys has hired millions in the past decade or two.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by zwkrt on Wednesday November 16, 2022 @08:23PM (#33633675)
Emphasis can be a good way to get visa endorsement for finding a better job. Also sometimes people who are booksmart are not streetsmart and end up working for a bad company.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by rk06 on Wednesday November 16, 2022 @09:39PM (#33634243)
Tier 1 companies generally hire from tier 1 colleges. Tier 2 and tier 3 college students are either ignored or not able to make it due to lack of quality education.

But those talented students take up any job offer they get (I.e. WITCH). when they get experience, they switch to higher tier companies.

There are many talented folks at WITCH companies, they just don't stay there.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by fellellor on Thursday November 17, 2022 @12:20AM (#33635282)
Programming/anything to do with PCs in India is a rich man’s hobby. Tinkering is not encouraged in colleges in the country. In any case this is a big country with a lot of talented devs. But for the same reason the pool of mediocre programmers is also pretty big.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by mindentropy on Thursday November 17, 2022 @08:30AM (#33638551)
>Programming/anything to do with PCs in India is a rich man’s hobby.

This is not true. We had a good culture of self assembled PC enthusiasts in our district. This was in early 2000s. In fact it has reduced now maybe due to lack of interest or something even though the prices of PCs have dropped significantly. I see many people use their PCs as locked up phones with no curiosity of hardware.

>Tinkering is not encouraged in colleges in the country.

This sad state is still present to this day and it has become worse as the hardware gets more and more locked down. I don't see much interest in Linux in the younger generations.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by fellellor on Friday November 18, 2022 @01:51AM (#33651249)
>This is not true.

It is absolutely true. Just because you don't consider yourself rich doesn't mean that these devices aren't out of the reach of a vast majority of the population.

Almost everyone has access to a smartphone, but most of those are poorly made, overheating pieces of plastic - barely suitable for use as a phone, let alone as a computing device on which you can learn something.

In my second statement, I'm also trying to say that though you have a huge number of people in the workforce who haven't had easy access to computing devices, there are also many who do (in absolute numbers but not in percentage). But the numbers are such that given an average Indian programmer, they are more likely to be someone who got educated in a substandard setting among unmotivated peers who have an aversion or even a fear of tinkering and putting a big investment (like a PC) at risk.

People who have money to get a PC as a hobbyist do it for unworthy reasons - like the chance to play garbage tier games like pubg or whatever, or becoming an influencer. This is a generalisation but it will affect the probabilities.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by mindentropy on Saturday November 19, 2022 @10:57PM (#33678082)
The resources that we have now is way better than what we had in our time. The interest amongst students have been more or less the same.

>that given an average Indian programmer, they are more likely to be someone who got educated in a substandard setting among unmotivated peers

This too has not changed much from our time to now. The changes I have noticed in students is the rise of memorizing leetcode type problems due to the plentiful jobs now which need this skill for interviewing.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by willcipriano on Thursday November 17, 2022 @08:50AM (#33638831)
Imagine trying to debug a issue in the middle of the night and you go to the logs to find "Unhandled exception handled." dozens of times.

I'd probably just quit.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by sbf501 on Wednesday November 16, 2022 @06:42PM (#33632669)
too bad, it's a great company name that inspires confidence... until you read a comment like this!
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by kblev on Wednesday November 16, 2022 @09:38PM (#33634229)
What about Sapient?
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by unixhero on Wednesday November 16, 2022 @11:22PM (#33634932)
AWITCH ... you forgot Accenture
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by abhinavm on Thursday November 17, 2022 @12:31AM (#33635355)
Or IWATCH
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by halfmatthalfcat on Thursday November 17, 2022 @12:52AM (#33635466)
Glad to find this mentioned, Accenture is absolutely an offender.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by unixhero on Thursday November 17, 2022 @05:57AM (#33637274)
I have had some ridiculous situations with them. For one the developers in Bangalore Delivery Center 8, and what do I know, all of them?, had to work with their private computers.

A unix engineer could only work with Aix Tar and would not touch GNU Tar on Linux, because his manager had not approved it.

Onshore engineers flying home to India due to a stomach ache, instead of seeing a doctor for free in the host country due to being afraid. Of course messing up the flow of our projects.

10/10 will leave jobs to avoid such projects and situations again.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by kapilkaisare on Thursday November 17, 2022 @09:24AM (#33639259)
> Onshore engineers flying home to India due to a stomach ache, instead of seeing a doctor for free in the host country due to being afraid.

This feels like an exaggeration to me, although I'm open to hearing specifics to the contrary. I know of (non resident) immigrants who delay medical visits and treatments until they get back to their home country, but flying home (spending a good deal of money on air fare) for just a stomach ache sounds pound foolish, which immigrants generally aren't.

Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by unixhero on Thursday November 17, 2022 @03:36PM (#33645284)
It happened, that's all I can say. At times banality knows no limits.
Re:Infosys leaked FullAdminAccess AWS keys on PyPI for over ... by paxys on Thursday November 17, 2022 @12:45AM (#33635430)
These companies literally do not want to hire competent people, because they know they won't stick around. Their business model is to hire the absolute bottom of the barrel engineers, pay them the tech equivalent of minimum wage, and sell "consulting services" to overseas firms that don't know any better.