10 ms·
Redbox left PII on decommissioned machines
- throwaway984393 2y ago[dead]
- dylan604 2y agoTake this as a lesson. If you've been a dev long enough, you've worked on a project knowing that how the project is being done isn't the best method with every intention of going back to make it better later, but not at the expense of getting the MVP up and running. You'll also have seen that never actually happening and all of those bad decisions from the beginning still living all the way to the bitter end. I'm guessing not one person involved would have ever imagined their code being left on a machine just left out in the open exposed to the public completely abandoned by the company.
- Apocryphon 2y agoOne just wonders if the cooperative-multitasking BASIC implemented in this machine really was necessary for an MVP. Other than if that just happened to be the sort of programming that the developer at the time was familiar with. Also, this really is the 'engineering' discipline with the lowest level of craftsmanship and regard for rigor, isn't it? Because the failures are usually intangible, not directly life-threatening.
- appendix-rock 2y ago[dead]
- duskwuff 2y ago> One just wonders if the cooperative-multitasking BASIC implemented in this machine really was necessary for an MVP. I have a feeling that someone already had that hammer ready and was in search of a nail. :)
- rasz 2y agoMight be case of a VB6 programmer who graduated to .Net C# but still misses the good old days.
- WhyNotHugo 2y agoWhen a developer says “this is a temporary solution” they mean “this is a temporary solution forever”.
- gscott 2y agoThe beta version works fine, lets just keep it.
- Moru 2y agoNever make the "Proof of concept" so good it is actually usable.
- Jerrrrrrry 2y agoWords to be forever-tentatively employed by :)
- macintux 2y agoWrite the proof of concept in a language that the company doesn’t want to support. Erlang, Haskell, Prolog.
- Dalewyn 2y agoThere is nothing more permanent than a temporary solution, and nothing more temporary than a permanent solution.
- throwaway365x2 2y agoThat's very true. When a customer has a problem, you create a solution to it. Often the problem is part of a much larger space, so you tend to have discussions of all the possible features you could implement. This is a necessary step to gain knowledge about the problem space, but it can lead you to think that the solution have to cover it all Time restraints leads to a "temporary" feature to solve the customer's immediate need. Most of the time it turns out that all the other features are neither necessary nor important enough to spend time on. Projects without time restraints or focus tends to create a complex system that will "solve" the entire problem space. Most of the time it turns out that our assumptions are wrong and we need to do a major refactoring. "Temporary" solutions may not have the best code structure or architecture, but it is not necessarily a bad technical debt, as many new developers to the project seems to think it is. Also, the time restraints of a temporary solution encourages the developer to create simple code and not "clever" code, because they can always blame time restraints for their lack of cleverness. If the code has been mostly unchanged for years, somewhat maintainable and solves the customer's problems, it's not really a problem.
- flomo 2y agoThey might have had the most perfectly developed decommissioning process. And nobody is going to care when their paychecks stop showing up, and everything suddenly gets trucked-off into receivership. Given the era and constraints, I don't see how it was irresponsible or 'sloppy' to have a local database on these things. This most likely is not on development.
- raffraffraff 2y agoThis. I often wonder what was left behind when the financial crash happened. Watching documentaries and movies about it, it looked me like several large banks and insurers closed up shop overnight, and people were leaving the next day with boxes containing their personal effects.
- qwery 2y agoI think you're right in general -- that is, regardless of the original company's practices, the entity selling off the assets should be required to do that responsibly -- but then: > the unit I've got an image for has records going back to at least 2015. Whether or not it's "on development" -- that's sloppy. Like how it would be a problem if your preferred grocery store kept your details on the cash register you checked out through almost ten years ago. It's a point-of-sale terminal holding on to high risk data for no reason.
- flomo 2y agoI recall being surprised to see people using a Redbox in the grocery store. Like, wow, (a) this company still exists, and (b) ppl still watch DVDs. And that was years ago. I think it's not unlikely the company was already in total zombie-mode by 2015.
- dylan604 2y ago> and everything suddenly gets trucked-off into receivership. That's the problem. These things aren't getting collected and trucked off. They are just left rotting in their installed locations. I'm pretty confident that you could just show up to any of these with a tool box to just start opening one up to take out whatever you wanted from the insides, and not one person would question you. They already said they don't care if you never returned any discs you had in your possession, so nobody would care if you emptied their inventory of discs within. And until now, I'd wager not one person inside the company ever thought they might be vulnerable to a PII attack like this either.
- guax 2y agoThe good practice of last year is the bad pattern of today.
- _heimdall 2y agoAt least in web development. There's a weird time horizon there, the good patterns from a decade ago are often still good practices. Picking up the latest and greatest web stack today will likely be a rotting, unused stack next year. Pick up rails or django and it will be largely unchanged and you'll still be able to hire for it.
- add-sub-mul-div 2y agoI love how the all-caps disgust is reserved for the greatest sin, the overengineering.
- jordigh 2y agoWhere does Foone keep finding this stuff? Earlier, Foone finds a NUC: https://news.ycombinator.com/item?id=41294585 https://news.ycombinator.com/item?id=41294585
- neonate 2y agohttps://news.ycombinator.com/item?id=41298430 https://news.ycombinator.com/item?id=41298430 had the comments
- raffraffraff 2y agoI know an employee in an IT company. He told me that they have hundreds of decommissioned laptops and no time to wipe them. And they won't pay someone else to do it because it's too expensive. So right now they are in storage. If they go bust, the storage company will likely dump them. I've seen a lot of stuff in e-waste. There are several facilities within 5 miles of my home, and you can walk right in and drop off your old TVs, toasters and laptops in large metal bins. And if you have a quiet word with the attendant you can usually walk off with stuff that someone else dropped off. "Good for the environment mate! I can use this for parts!" If social engineering works at banks, you can be damn sure it works at an e-waste facility. And if that fails, a few bank notes help. I don't do this but I have intercepted e-waste coming from family and friends. In one case I found a treasure trove of photos from my deceased sister. Nobody had ever seen them before. I also found personal documents, internet history and saved passwords in the browser, which got me into her iCloud account which, until then, nobody could access. This lead to more photos and documents. And it was all destined for e-waste.
- michaelt 2y ago> I've seen a lot of stuff in e-waste. [...] if you have a quiet word with the attendant you can usually walk off with stuff that someone else dropped off. In my country, there are specialist e-waste disposal companies large IT organisations can hire, which guarantee to remove and shred the hard drives before recycling the rest.
- 2y ago
- excalibur 2y agoI just watched a video earlier today about how if you find a working redbox, you can get movies out of it without getting charged, although you still have to enter your payment info. This prospect suddenly sounds even less appealing. https://www.youtube.com/watch?v=ucsYziSl7xk https://www.youtube.com/watch?v=ucsYziSl7xk
- JKCalhoun 2y agoSeen what the rentals are on a Redbox? Every time I would go browse their movie collection I always walked away uninterested in anything. Most of it was what I call direct-to-inflight-video.
- shiroiushi 2y agoJudging by the movies I've seen on international flights in the past few years, I think this is really unfair to inflight video. (i.e., the available movies were all highly-rated theater movies, not direct-to-video garbage.) Perhaps a better description would be "even worse than Netflix originals"...
- Larrikin 2y agoI question if this has ever been true outside of old timey planes of decades back where everyone had to watch the same movie. If you were on a decent international flight you could sometimes even see a movie still in theaters. The only real regression I've seen in my life time in in-flight entertainment is ANA removing their partnership with Nintendo to run SNES emulators to all the seats. A 14 hour flight to Narita used to involve Super Mario All Stars
- ipaddr 2y agoI didn't bring 5 dollars cash the first time I took a plane to SF from the east coast. You end up watching a movie on a projector screen without sound. I end up reading through Microsoft foundation classes books. On the way back I had my 5 dollars ready. The movie was about a brother who returns to a small town to visit his sister in a southern town. He ends up staying and helping her with the kids. But his irresponsible ways causes frustration with the sister and the kids he is watching. He leaves. End of movie. Truly awful. I wonder what the first movie was like.
- goatlabs 2y ago[flagged]
- karlgkk 2y agoThis is just wish.com ChatGPT
- goatlabs 2y ago[flagged]
- isoprophlex 2y agoNoone likes your drivel generator. Stop posting that shit here.
- karlgkk 2y ago[flagged]
- School-Cotton 2y agoEveryone who posts obviously AI-generated content on hacker news gets heavily downvoted and/or flag killed. Without exception. Why not take a hint and stop posting it?
- misiek08 2y agoI would to see people start engineering instead of overengineering, being scared of such exposure happening to them. The only thing I can’t disagree more - it’s not the graduates who write ServiceFactoryBuilder where I work at. Those are guys after 12-15 years, started with bad PHP, now being "Senior Java", but they didn’t learn much since beginning. This is how corporate software looks like.
- Spivak 2y agoAny C# devs wanna explain the XML thing? To me having a separate class to deserialize each kind of XML document to its respective object seems nice and the "right" way to use XML. The class just becomes the config file. Generic loaders but poking at the tree is super brittle. Does C# come with magic to do this better? Because if you have to invent the config file then isn't that creating a DSL and we're back to over engineering?
- paranoidrobot 2y agoI stopped reading when it got all shouty, and a quick scan doesn't show whether it's got actual sample code. It's also been a long while since I wrote any C# for real, and even longer since I had to deal with .NET's XmlSerializer. It used to be a pain in the backside to deal with XML in .NET if you wanted to just deserialise a file to an object. You'd need to mark up the class with attributes and stuff. I remember being very happy when JSON.NET came out and we could just point at just about any standard object and JSON.NET would figure it out without any extra attributes. I'm not sure if XmlSerializer ever caught up in that regard. e: Also, without seeing the code and where else it might be deployed it's not easy to know whether this is a case of over-engineering. This same code might be deployed to a phone, webserver, lambda, whatever - so having an IConfigFileLoader might make 100% sense if you need to have another implementation that'll load from some other source.
- MarkSweep 2y ago> I'm not sure if XmlSerializer ever caught up in that regard. Not really. The one thing that exists to make this easier is xsd.exe, which can generate the code for these classes from and XML Schema file. https://learn.microsoft.com/en-us/dotnet/standard/serialization/xml-schema-definition-tool-xsd-exe https://learn.microsoft.com/en-us/dotnet/standard/serializat...
- paranoidrobot 2y agoAh, yeah, xsd.exe - I had successfully wiped that from my memory. I had a ton of scripts that generated classes from XML and SQL Tables. I forget exactly how.
- asp_hornet 2y agoSounds like most idiomatic C# code bases i saw. Words cant express how happy i am to be outside that bubble
- auguzanellato 2y agoLooks like the mastodon instance got the HN hug of death, anybody archived it?
- dbg31415 2y agoI mean that’s scary, but at this point is there anybody to hold accountable?
- theanonymousone 2y ago> JUST READ THE FUCKING JSON FILE YOU ENTERPRISE FUCKERS On a codebase I worked on, accepting an expanded range of data in a field required modifying seven files in three repositories and two (or three) programming languages. Someone thought that's the right way of doing it.
- larodi 2y agoAre there any laws in any country governing how such equipment is supposed to be decommissioned in case if bankruptcy? This does not seem to be an isolated case, it just happening more and more with advance of technology.
- nextlevelwizard 2y agoWhat are they going to do? Sue the bankrupted company?
- michaelt 2y agoIf instead of a load of old computers the bankrupt company had a pile of old tyres, I'd expect the receivers winding up the bankrupt company would dispose of the old tyres properly, paid for with the company's assets before anything is distributed to creditors.
- nextlevelwizard 2y agoIf someone creates this fucked up compute stack and handles the customer data this poorly, what makes you think they would be any better at disposal even if there was some laws around it? It is not like law makers have any idea either what is going on.
- BlueTemplar 2y agoThey are not the company under discussion.
- Cthulhu_ 2y agoWhen a company goes bankrupt, a curator comes in who oversees the decomissioning of the company and its assets; I don't know if a curator is a government agent or a private company (probably either), but they become responsible for the company and in this case the customer data.
- larodi 2y ago
- nightski 2y ago[flagged]
- xnorswap 2y ago> Redbox.HAL.Configuration > .ConfigurationFileService implements IConfigurationFileService > STOP MAKING SERVICES AND FACTORIES AND INTERFACES AND JUST READ THE FUCKING > JSON FILE YOU ENTERPRISE FUCKERS I know it's cool to "hate" on OO, but "just read the fucking file" doesn't work if you want to run your unit tests without reading a fucking file. It makes sense to abstract configuration behind an interface so you can easily mock it our or implement it differently for unit testing. Perhaps you also want to have some services configured through a database instead. This isn't a ConfigurationFileServiceFactoryFactory.
- rkachowski 2y agomost of these issues disappear with the introduction of first class functions. There's nothing noble about the thick indirection inherent in old school enterprise programming.
- gpderetta 2y agoA fist class function is just an interface. Just ask the venerable master Qc Na.
- xnorswap 2y agoCould or should there just be a `IConfigurationService` instead of a separate IConfigurationFileService? Yes, probably. "Interface all the things" is a bit lazy, but it's easy, especially if you have Moq as a way to auto-mock interfaces and a DI framework to setup factory methods. But spinning into rage just because you see an interface or abstract factory isn't healthy.
- throwaway365x2 2y agoI don't follow .Net closely, but it seems like there should be a better alternative. Java has a library called "Mockito" that can mock classes directly without requiring an interface. I assume something similar exists for .Net, as they have similar capabilities. Making an interface for one class, just so another class can be tested seems like we allow the tool (tests) to determine the architecture of what it is testing. Adding complexity in the name of TDD is a close second on my list of triggers There's nothing that triggers* me more than seeing an interface that only has one implementation. That's a huge code smell and often a result of pre-mature architecture design in my opinion. It also often leads to complexity where if you have an interface, you create a factory class/method to instantiate a "default" implementation. Fortunately it seems that it is not used as often as before. Our code has no factories and only a few interfaces, that actually have a practical use. The same applied to my previous workplace * The trigger applies to 2024 Java code written as if it was 2004. I may have a form of PTSD after many years of interfaces and FactoryFactory, but fortunately times have changed. I don't see much of that today except in legacy systems/organizations.
- ChicagoDave 2y agoI worked at RedBox in 2010. C# with embedded Lua for the screens. The intent was to build a flexible architecture for CoinStar to use on many kiosk businesses. The PII is likely log files that should have been erased nightly, but I don’t remember. I know the guy that designed the architecture. He’s a friend that I’ve argued with about over-engineering things. He never cared if people understood his work, which is a common theme with old school engineering.
- danielmg 2y agoIt's not just an 'old school' thing. FFS look at the state of the Javascript ecosystem.
- ChicagoDave 2y agoThere certainly are spots of over-engineered solutions in today’s world, but overall I do believe things like cloud serverless, and domain-driven design (modularization) have reduced complexity in a natural fashion. These over-engineered systems usually came out of client server architectures using heavy inheritance object pyramids, which we definitely don’t build as much anymore.
- JoachimS 2y agoNot an old school engineering. There a fresh engineers rolling of the production line everyday that behaves exactly like this. I would even venture to say that senior engineers are probably much better at documenting, writing clean code, not over engineer things. My personal experience is that bad engineers move into project management, administration much faster. Which is a problem in itself since they end up being the boss of the engineers that are better than what they are.
- Jach 2y agoI agree on the management aspect, and even promoting good engineers "too high" on the "parallel promotion track" can effectively take them out of the engineering work just as much as if they went into pure management. "Does the CTO still code at least sometimes?" is the only tell I have for whether a company has fallen into that trap or not. For the engineers themselves, though, I think it's a mixed bag when it comes to "older" ones. That is, correlations on just age in the field are weak. Sometimes they're great, sometimes they're really meh. Whether something is over-engineered or not really is case-by-case, part of the problem is sometimes something looks over-engineered but is just the normal thing to them by now, nothing special, even though its architecture handles a lot of concerns that a more naive and obviously not over engineered style would have produced. In that case, they're validated sooner or later. Sometimes they're more up to date about various new things than even the energetic young bucks, sometimes they're too stuck in their ways. I've seen examples of both knowing about modern hardware details (and being able to take advantage of them) and having a stale idea of how CPUs work that wasn't even quite accurate in the 70s. (So, not too different from a lot of fresh engineers who get educated on such simple models.) I've noticed no correlation with age on whether someone has completely mistaken ideas about JVM performance. Being stuck in their ways in particular applies to things beyond the pure code and coding style -- and it's not necessarily a bad thing. If they've managed well so far without pick-any-of good documentation, good debuggers, good source control, good editors, good open source, methods to thoroughly avoid various causes of engineering pain, etc., why bother doing or taking advantage of those things now? And if they're skilled, they might even be right, it's probably best not to disrupt them if they're not a bus factor risk. But if they're more on the meh side of things overall, they can hold things back too much. (By "older", I mostly mean those who were practicing since the late 90s/early 2000s. But I keep in mind that the global supply doubles every several years or so, so it's quite possible for someone with only around 5 years of experience to be in the top half of seniority already.)
- gU9x3u8XmQNG 2y agoI once worked for an MSP that would reuse decommissioned storage for other customers and services. Tried to convince them to stop, and even setup a service on lunch breaks to attempt and sanitise them using open guidelines available at that time - an automated service that would display drive sanitisation status on a text based panel next to a multi disk bay caddy in the storage room. I resigned because of this, and many other similar business practices - all just to make more money (it was not malicious otherwise). The business is rather successful to this day. I only hope they have stopped such activities. And yet I still lose sleep about this..
- klennyo 2y ago[dead]
- nihilist_t21 2y agoAhh I miss Foone's threads on Twitter/X!!! They were always such an interesting joy to read. I know they migrated off of Twitter/X and they were one of the ones I was most sad to see leave. But given 95-99% of the accounts I follow never left, I'm not going to bother to cultivate another social media account just for Foone's threads, or whomever else's which I've forgotten left Twitter/X.
- th0ma5 2y agoI am so glad people are leaving Twitter even if they don't do anything else, and maybe especially lol
- patrickhogan1 2y agoThats terrible. User doesn't say how they got the machine. Maybe a bankruptcy liquidation auction. Sidenote: As a personal mental quirk, does anyone else ever accidentally read "Redbox" as "Roblox" and then have to double-check?
- Lammy 2y ago[flagged]
- dang 2y agoPlease don't cross into personal attack on HN, no matter how annoying you find someone else's writing. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- Alupis 2y agoAs an aside, I see we've re-invented Twitter-style blog posts - but did anyone stop and ask why? This format is so tedious to read - one sentence fragment at a time. It's like reading someone's subconscious inner-dialog shower thoughts.
- th0ma5 2y agoSort of the other way, many social networks had longer formats and Twitter eventually adopted it. On twitter it actually never quite made sense but on fedi stuff it works a lot better.