> Can't believe this is real to be honest...
Why not? It's pretty much in line with expectations on my end.
Why not? It's pretty much in line with expectations on my end.
Things I still regularly come across:
- developers with copies of the production database on their laptop
- said laptop doesn't have an encrypted hard drive
- every developer having access to production databases, including people hired yesterday
- default userids / passwords hardcoded in firmware
- the marketing department having access to the production database in bulk
- datalakes with zero access controls that perfectly mirror the production db
- sharepoints without proper authentication storing mountains of customer data
Anyway, I could go on like this for a while. And usually the company employees are aware of these, they just haven't gotten around to plugging the holes or they were never going to unless someone told them to because it is convenient. Occasionally there is serious pushback, for instance against developers having a recent copy of the production database on their laptop is in some places considered perfectly normal.
> every developer having access to production databases, including people hired yesterday
Do you expect new developers to have a wait period before being able to access sensitive materials? That seems like a recipe for disaster, you’re openly saying “I don’t trust you” at the start of your relationship with someone, when it’s the most volatile.
I’m almost positive that doing it will just cause your new devs to resent their new bosses from day 1.
Your original comment makes it seem like you feel someone should not have access simply because they’re new. Not that nobody should have access at all.
I wonder how that correlates with companies bragging that they only take day or even few hours to have new hire code landing at production "coz they are so agile"