no29

the sky is falling.. the sky is falling

i made a note to check this a few weeks later.. lo' and behold, equifax lawyers up, appeals, and now this guy gets to play in big boys court.

2018-01-31 CASE_TRANSFERRED TO SUPERIOR COURT, RECORD AND EXHIBITS TRANSFERRED

2018-01-30 NOTICE OF APPEAL FILED BY APPELLANT EQUIFAX CREDIT INFORMATION SERVICES, INC MAILED TO RESPONDENT HAIGH, CHRISTIAN G.

2018-01-30 SUBSTITUION OF ATTORNEY-CIVIL AS TO PLAINTIFF HAIGH, CHRISTIAN G.

just a wild guess.. expect an appeal and a less than friendly attorney to be present at the next hearing.

i'd also worry about removal to federal court and consolidation - now that a judge has actually raised a federal question about the fcra

i actually wanted to see what one had to do help and wanted to skim a howto... i noticed there's a tutorial link at the top but you have to sign in/up to see what's there.

what kind of scandalous mysteries are in that tutorial that require hiding it behind a login?

legal doesn't know what it doesn't know

implementing controls to prevent or detect this kind of copypasta is very hard.. even more so at larger "serious" companies that have dozens of development teams spread across the world working on an enormous catalog of products

this happens far more than people want to admit.. there's a very slippery slope when it comes to searching for help online.. it's amazing how quickly a google search leads to a stackoverflow post that has sample/example code which then winds up in your company's codebase.. even at "serious" places

writing a clear external code usage policy that's covered in those yearly training programs that developers hate and blow through as fast as possible is about as good you're going to get stopping this kind of thing

it's beyond disingenuous and flat out dishonest for npm to say the integrity of the packages was never jeopardized. within minutes there were reports that packages had been replaced with questionable and malicious content.

https://news.ycombinator.com/item?id=16087079

this is probably a good indication of how a much more serious security event would be treated by the organization.. just sayin

independent site that maps packages to author certs that npm uses for verification at install time?

also, this is a problem that every package mgmt system faces. they alert on changes on upgrade but there's a requirement at the end user level to verify that at install time, the cert being trusted is the right one.

maybe it's time to push for adding signed packages to npm

long discussion here: https://github.com/node-forward/discussions/issues/29

not op, but google cache has a copy if the link isn't working

https://webcache.googleusercontent.com/search?q=cache:4PCbv-...

> One client was feeling bored, disengaged and undervalued at his small company. His role wasn’t a particularly good fit for his strengths and he didn’t have as much responsibility as he would have liked. Through exploring his interests and strengths he proposed a change to his manager to take on more work related to the financials of the company - despite feeling that he didn’t have the formal training necessary, this was an area where he wanted to grow. Based on that conversation, he ended up taking over all financial aspects of the company and absolutely loves his new role and responsibilities.

he must have one heck of a charming personality. is fantasy corp hiring for ceo? i have no experience or relevant skills.

the article doesn't make it clear but they're actually cooking him in boiling water.

must've missed the chapter on schadenfreude in civics and ethics.

rcs has been around ~40 years. you're not old school. you're sloppy.

This man is a living history of Microsoft and one of the best resources for WINAPI development.