Hacker News Reader

Comment by xwolfi | Hacker News Reader

When that happened to us, we found an article showing Tesla got hacked the same week as us (was aws) and they got the money back, so why not us?

We got the money back and fired the guy who had a jenkins opened without password, granting terminal access to anyone.

View on HN

It's a shame you failed to learn a lesson about how security is something the entire team is responsible for, and how a mistake like deploying something without a password is a failure of your processes rather than a failure of any one person. By firing the guy all you've done is made everyone paranoid which will slow you down; similar mistakes are still just as likely to happen again.

You say: "We got the money back and fired the guy who had a jenkins opened without password, granting terminal access to anyone."

Why did you fire the employee (?) so quickly? Did he have a history of negligence and/or incompetence on the job and this was the last straw that broke the camel's back?

Well, a guy who learned a thing or two the hard way and won't do that ever again got fired.

Why was that guy running Jenkins without a password?

Years ago when I actually did any devops running services without a password was common. They would configured to only be accessible using SSH from a locked down IP range. It's far more secure than password based access (if you get it right).

Yes, but that was a design/security choice. What OP described seems like a pure negligence ("setting up authentication is hard, so let's skip it").

Reply on news.ycombinator.com