zlacker

> The attackers gained access to a legacy, third-party cloud file storage system.

I think the answer is ok but the "third-party" bit reads like trying to deflect part of the blame on the cloud storage provider.

>>arbll+(OP)
The whole codebase & tools at whatever company I ever worked at was using 99% legacy stuff. Its wild...

Often times it would have been easier to rebuild the whole project over trying to upgrade 5-6 year old dependencies.

Ultimately the companies do not care about these kinda incidents. They say sorry, everyone laughs at them for a week and then after its business as usual, with that one thing fixed and still rolling legacy stuff for everything else.

>>zwnow+o3
> Often times it would have been easier to rebuild the whole project

Sure buddy, sure

>>weird-+C5
I inherited a few codebases as solo dev and I am confident in my abilities to refactor each of them in 1-2 months without issues.

I can imagine that in a team that might be harder, but these are glorified todo apps. I am well aware that complete rebuilds rarely work out.

>>weird-+C5
The company that bought mine spent two years trying to have Team A rewrite a part of our critical service as a separate service to make it more scalable and robust and to enable it to do more. They wanted to do stupid things like "Lets use GRPC because google does!" and "Django is slow" and "database access is slow (but we've added like six completely new database lookups per request for uh reasons)"

They failed so damn bad and it's hilariously bad and I feel awful for the somewhat competent coworker who was stuck on that team and dealt with how awful it was.

Then we fired most of that team like 3 times because of how value negative they have been.

Then my coworker and I rebuilt it in java in 2 months. It is 100x faster, has almost no bugs, accidentally avoided tons of data management bugs that plague the python version (because java can't have those problems the way we wrote it) and I built us tooling to achieve bug for bug compatibility (using trivial to patch out helpers), and it is trivially scalable but doesn't need to because it's so much faster and uses way less memory.

If the people in charge of a project are fucking incompetent yeah nothing good will ever happen, but if you have even semi-competent people under reasonable management (neither of us are even close to rockstars) and the system you are trying to rewrite has obvious known flaws, plenty of time you will build a better system.

>>arbll+(OP)
For all their boasting, I can't help but wonder how their response would have been different if the attackers actually had gotten their hands on sensitive data.

>>mrguyo+yr1
but the issue wasn't python or django, RPC or REST

it was the ORM and the queries themselves

>>zwnow+o3
All stuff is legacy the moment you deploy it.

All work created by a company decays, it's legacy code within months.

>>bearja+Tm3
Yea it shouldn't be this way. Its only happening due to lack of standards and the software world essentially being the wild west.