Hacker News Reader

Comment by miohtama | Hacker News Reader

> The repositories include a large amount of intellectual property… connection strings, cloud access keys, blueprints, design documents, [single sign-on] passwords, API Keys, and other critical internal information.”

Any senior developer or a security researcher knows this kind of secrets should not be part of the source code repository. Has Mercedes-Benz a rotten software development culture?

View on HN

Senior developer or a security researcher?! This is like.. maybe you have to tell an intern kind of thing.

What I want to know is how are they not using a secret manager (like Doppler or AWS Secrets Manager) at a company of this size? They could have avoided all of this. These types of leaks can cost companies everything (from their data to customer trust).

The root cause: They are not using it because engineers who committed securities to a GitHub repository are not going to have any repercussions. Their salary does not depend on, like the salary of their bosses. So it does not cost anything on a personal level.

You are very correct but it’s also not on the dev product teams to decide the best practices for secrets at large companies. It’s the responsibility of the security and devops team to implement best practices.

Sure, it ought to come from above. But what software dev in 2024 doesn't know that keeping everything in the source code is really really bad?

They call themselves a software company. The guys in India that develop the software know what they are doing but the managers in Germany have no clue what they are doing. Sitting all day in meetings planning strategies for beating Tesla. The guys in India are mostly fixing bugs in software released years ago.

Many car companies are transitioning from a predominantly mechanical engineering space to a predominantly software engineering space, along with all the legacy mindset that comes with. It's par for the course when they can't understand that they're now a tech company and need to invest as such.

Reply on news.ycombinator.com