how does this stop being the case? money &gt; all else.

Their investors are too big to fail (to recoup their investments by IPO offloading to the sucker public).

My family and friends outside the tech industry have almost no clue about nearly all these scandals - especially the data breaches and the former CEO&#x27;s indiscretions. About the only thing they hear is that some Uber drivers have assaulted passengers in the past, but they write that off against the fact that a lot of Taxi drivers have done the same in the past.It is a telling example that the pain point of a bad taxi service in a city is usually enough for them to conformance rationalise that Uber is still a better alternative, despite any of these issues.

She used uber because the service is fantastic.

It&#x27;s already way more common to use &quot;Uber&quot; as a verb, or even a noun, that doesn&#x27;t necessarily even mean Uber the company itself.People have asked me before if I&#x27;m about &quot;to uber&quot; or &quot;take an uber&quot; someplace and they say it in an obvious way that implies &quot;any ridesharing company&quot; (or lyft in my case since most people know I only lyft nowadays).Uber just as a word for ride-sharing has become ingrained and won&#x27;t be easy to get rid of, IMO.

Never underestimate the power of marketing. My mother for instance would use Uber over any ride-sharing system due to its insane exposure and the fact that these stories remain relatively unheard of in comparison.

I am amazed at the things Uber gets through and is still standing after...

Obviously because only now it&#x27;s come to the public&#x27;s attention.

&gt; Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection.&quot;Sorry we left uranium in your house a year ago and didn&#x27;t bother telling you. Here&#x27;s a coupon for free cancer screenings.&quot;

&gt; Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection.This happened more than a year ago, and only now that they&#x27;re planning on offering identity theft protection? That&#x27;s ridiculous.

The current deletion process is smooth and can be completed in-app.

When I deactivated my account it was a huge pain, I had to reply to 2 emails, and in the end it took 5 days to complete. That alone annoyed me enough to never go back.

Same here. That and that video from the driver that bought a black car to drive it for Uber and ended up in massive debt.

Don’t let hypocrisy stop you from doing the right thing. Sometimes you need to climb one tree to cut down another.[1] That’s ok.[1] tbh I don’t think you do, but I like the analogy so I’m keeping it.

We can vote for people who don&#x27;t want the US to kill civilians while not using Uber. I don&#x27;t see the conflict here.

If you&#x27;re not willing to restructure your entire life to the point of renouncing citizenship of the country you were born into then you shouldn&#x27;t ever make any choices based on moral principles whatsoever? uh.. what??<a href="https:&#x2F;&#x2F;yourlogicalfallacyis.com&#x2F;black-or-white" rel="nofollow">https:&#x2F;&#x2F;yourlogicalfallacyis.com&#x2F;black-or-white</a>

You&#x27;ll find that thinking like that will only lead to misery at worst and hypocrisy at best. For example, if you live in the United States (though this logic applies to any country, really), you&#x27;ll be interested to know that the US holds the world record for the amount innocent civilians killed [1].[1] <a href="https:&#x2F;&#x2F;www.globalresearch.ca&#x2F;u-s-holds-the-world-record-of-killings-innocent-civilians&#x2F;5393789" rel="nofollow">https:&#x2F;&#x2F;www.globalresearch.ca&#x2F;u-s-holds-the-world-record-of-...</a>EDIT: I realize I sound far more judge-y than intended in these posts. My overall point is that people should just do whatever makes &#x27;em happy while doing the best you can (w.r.t. everything else). Trying to emphasize the morality in your actions is just wrong, imo.

I also do this where possible, but Lyft doesn&#x27;t operate outside the US. I wish they would launch in the UK, at least.

Only reason I use them is because of Uber Green, otherwise I use Cabify and tell everyone to do the same.

Are you saying the end justify the means?  The problem is that over and over and over we see companies breaking the rules, reaping massive rewards as a result of unethical practices, saying &quot;sorry&quot; and then carrying on with no real consequences.  It sets a horrible precedent and unless people start being punished instead of rewarded(!!!) for their actions nothing will change.

I don&#x27;t buy your view of what transpired. &quot;In an ideal world&quot;, &quot;making a near perfect switch like that is probably unlikely&quot;, &quot;took a hit on our reputation&quot;, etc. None of these truly recognize the actual weight of what Uber has done as an organization.

I disagree that Lyft would not exist; Lyft invented the UberX category. Originally Kalanick complained about Lyft&#x27;s creative interpretation of the law, before succumbing to internal employee pressure to introduce a competitor. Years after its introduction, Kalanick admitted that he didn&#x27;t believe in UberX until it demonstrated its success.That said, almost all of the notable legislative and regulatory battles were conducted and won by Uber.The wrongful actions by companies do get forgiven eventually, as toxic executives leave (as in the case of the CEO, Legal Officer, and now the CSO), but no public is foolish enough to immediately absolve any company of wrongdoing. Uber will have a reputation for sexual harassment long after it meets or exceeds the standards of other large companies.

You&#x27;ve got your history wrong. Lyft actually launched their ride sharing service before UberX. So don&#x27;t take credit for Lyft&#x27;s existence.

Sorry, no.It&#x27;s not like Uber did one bad thing. Uber has been a fountain of terrible things for years and years. You even admit that Uber&#x27;s market-dominant position has been been achieved through those terrible things. And those are only the terrible things that we&#x27;ve discovered despite Uber&#x27;s energetic attempts to cover things up. Lord knows what horrors you&#x27;re still hiding.Until Uber loses their ill-gotten lead, I won&#x27;t even consider using them.

I drove for Lyft and Uber during that era, and I promise you lyft was doing just as much to fight those protectionist policies, they were doing it with a lighter touch.  In many places they were making headway, and then Uber&#x27;s asshole tactics wound up turning it into a two-steps-back situation (getting ridership access to San Diego Airport e.g.)

Uber employee chiming in - while I entirely sympathize with HN&#x27;s frustrations around our ethics and can&#x27;t really justify our actions around this data breach, it is very much worth noting that Lyft would not exist were it not for Uber&#x27;s extremely aggressive practices. There were&#x2F;are far too many protectionist policies at play at most locales that -- not out of pure coincidence -- needed a company as aggressive as Uber to pave the path for a better option for both riders and drivers (over existing taxis).We fought all the battles, took a hit on our reputation and set it up nicely for Lyft who very smartly played along with the nice guy approach to capitalize. Net-net, no Uber would have most likely meant existing taxis everywhere and as most riders&#x2F;drivers will tell you, there is nothing inherently better about either app, they offer the same, pay the same but vastly differ in perception.That said, we took our aggressive attitude way too far. In an ideal world, Travis would have evolved or replaced himself a couple of years back once the company essentially reached escape velocity where our consumers themselves became our most fervent supporters. Unfortunately that did not play out and making a near perfect switch like that is probably unlikely.Given this important context, I hope you will give Uber another chance as in the end, Dara and the employees are genuinely trying to evolve by doing the right things and putting all of this behind us. You can get some sense of this from going to sites like reddit.com&#x2F;r&#x2F;uberdrivers (or r&#x2F;lyft) and seeing the changing perception at least from the driver side of things.

You might have a point if this was a different company, but look at the context - it&#x27;s Uber. Probably one of the outright most scummiest companies out there.

&gt; this kind of attitude is exactly what got Trump electedNot really seeing the connection here

Good, it&#x27;s important to judge a company of 10k people on one person&#x27;s story. That&#x27;s usually a great strategy.I&#x27;m not defending uber, but this kind of attitude is exactly what got Trump elected. You can&#x27;t generalize and demonize entities based on one person&#x27;s view.

Ever since Susan Fowler told her story about what happened to her at Uber, I have only used Lyft, and have encouraged all my friends to do the same.I plan to never use Uber again.

&gt; The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher.Why do big firms get off easier than the smaller firms?

Something nice is also the fact that the people impacted by the breach must be told 72 hours max after the company is aware of the hack.

This would have been interesting if GDPR was applied.<a href="https:&#x2F;&#x2F;www.gdpr.associates&#x2F;data-breach-penalties&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.gdpr.associates&#x2F;data-breach-penalties&#x2F;</a>&quot;There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher.The Parliament had requested for fines to reach €100 million or 5% of the company’s global annual turnover. The agreed fines are the compromise that was reached.&quot;

This is not true. Back when JPM was being fined billions of dollars when the Southern District of NY was after them, they were quaking in their boots internally while at the same time redlining PR efforts to project external calmness.Huge fines do exactly what they’re intended to do. JPM for instance responded by making legitimate operational changes to detect all manner of financial malfeasance within their organization.

Even larger fines seem to draw weak behavior change. The U.S. corporate structure is remarkable in that sense. It shields employees (especially executives who often don&#x27;t carry out orders) from criminal and financial responsibility for their actions.

&gt;Just pay the tollespecially when the cost of doing the right thing is higher.i mean look at HSBC - laundered trillions of dollars of mega-organized-crime money. for a decade. 400m dollar fine probably isnt even .01% of what they made off that endeavor

&gt; The reason being that the parents effectively considered the fine a &quot;late pickup fee&quot;, and one they were more than willing to pay.The real question in this story is this: If you find that you have customers who are willing to pay you more for providing more service ... why not provide that service? You get more money, your staff gets paid overtime, parents get peace of mind, everyone&#x27;s happy.

Here&#x27;s an article about that: <a href="http:&#x2F;&#x2F;www.nytimes.com&#x2F;2005&#x2F;05&#x2F;15&#x2F;books&#x2F;chapters&#x2F;freakonomics.html" rel="nofollow">http:&#x2F;&#x2F;www.nytimes.com&#x2F;2005&#x2F;05&#x2F;15&#x2F;books&#x2F;chapters&#x2F;freakonomic...</a>

This is mentioned in Dan Ariely&#x27;s Predictably Irrational.

It&#x27;s in the book Freakonomics, when talking about economic, social, and moral incentives.The day care changed what was a social incentive for an economic one, and then couldn&#x27;t reverse the consequences: Not fining the parents anymore didn&#x27;t reduce the number of late ones to previous levels.

I know about day care in Bay Area which is charging $20 per 5 minutes delay. I guess that&#x27;s the reason:)

Wait until the EU GDPR kicks and in fines of up to 4% of annual turnover or 20 million kick in...

And the fine should always be bigger than whatever the company pocketed from the &quot;crime&quot; during that time.I think it was AT&amp;T or Verizon that got fined the &quot;record&quot; $3 million by the FTC for tracking users&#x27; browsing behaviors for like 2 or 3 years.The FTC should have asked (subpoena I should say) the company for reports on how much money it made per user from that tracking for the whole period, and then charge it a multiples of that.Did it make $1 billion? Charge it $2 or $3 billion.And do this sort of stuff across industries with a regular occurrence, so that companies can &quot;expect&quot; such audits, and so they don&#x27;t just think it&#x27;s a one in a decade fine that maybe one company in the industry will get.I think you&#x27;ll see abusive behavior drastically reduce.

The way you fix this is by making each 5m late cost 2 gallon of milk. If you are late for 15m that&#x27;s 6 gallons of milk, an operational burden has been passed to the late parent. It&#x27;s embarrassing to bring in 6 gallons of milk, an inconvenience to buy and deliver it, and an effective deterrent.

Well, day care operators have since learned...... as I sit in my home office, just over an hour away from day care closing time I assure you I&#x27;m watching the clock like a hungry hawk watching a mouse. See, my kid&#x27;s day care charges a mere $600 per hour late (billed in 1 minute increments).I don&#x27;t see kids parents late that often :-) and we&#x27;ve come close to missing it, but haven&#x27;t in two years.

our daycare calls the police ... quite a deterrent I&#x27;d say

I recall a story (that I&#x27;ll probably recount incorrectly) about a daycare business deciding that too many parents were arriving late to pick up their children (meaning that staff had to stay late with the kids), so they instituted a fine for late pickups.The result was that more parents were late. The reason being that the parents effectively considered the fine a &quot;late pickup fee&quot;, and one they were more than willing to pay. If the parents were fined a day&#x27;s daycare fee for being ten minutes late you can bet their attitude would change.I see company fines in the same light - they formalise the process of absolving responsibility and moving on. Just pay the toll and continue to handle your customer data cavalierly.

The bad PR might hurt more but I would error on the side of caution and say it has little effect. I have talked to drivers and passengers and they are unaware of those things .

And then we can go back to getting ripped off by taxis. I’ve lost more money in taxi rip offs than I ever spent on Uber.Other than the sexist nonsense of the CEO, there really is an irrational hatred of Uber. Are many of us secretly moonlighting as cab drivers?Uber’s nonsense is minuscule compared to generations of taxi corruption.This isn’t me excusing Uber but it does seem like many people, especially Europeans have an inordinate amount of glee over anytime AirBnB or Uber get in trouble. Has the hacker ethic really devolved into statism?We should be cheering over disruption of the status quo. Does anyone actually long for the days of getting ripped off by over-regulated and over taxed hotels and taxis?Do you people actually like having government pick winners and losers? Do you actually trust government to do the right thing? Governments have a strong track record of stifling innovation, abridging freedom and giving regulatory handouts to the privileged classes. People here get all kinds of sanctimonious when it comes to patents and copyrights yet seem to fall firmly on the side of the entrenched incumbents when it comes to things like disrupting hotels and taxis. It’s a weird double standard; a hatred of government when they want to prevent people from stealing movies, but a love of government when they want to prop-up taxis and hotels.

What? Uber acted in an unethical manner? Seriously, is anyone surprised? I kinda hope (but not really) that they get hacked again in June 2018 and play the same trick.. us in the EU will have a party on Uber&#x27;s corpse over GDPR.

I bet the statutes define fines the same for any party with some maximum. States could charge a percentage of revenue, cash on hand, valuation, but those are easily fudged to minimize liability.

&quot;In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014.&quot;Because you know...20k really really hurts for a company like Uber.

They agreed to pay and nobody heard about it for a long time. I&#x27;d say they asked for the right amount

Only $100k? They really should have tried for more... not that I support stealing PII.

At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, the company paid hackers $100,000 to delete the data and keep the breach quiet.

Credit Monitoring is the shittiest way to resolve these issues.I&#x27;ve stopped using any credit card numbers for anything ditial. I can change paypal passwords weekly If I&#x27;m that paranoid.

Working at another large tech company, this does not surprise me.Edit: I mean it would surprise me if it wasn&#x27;t recommended practice, but it would also surprise me if it was somehow strictly enforced.

This is so gob-smackingly uncommon I started asking &quot;do you require 2fa for your github accounts&quot; as part of my interview questions when I was looking for jobs (i.e. I&#x27;d ask my interviewers).I don&#x27;t know how to feel knowing that there is even one software-focused company out there that doesn&#x27;t enforce 2fa on its github accounts. Like... how?! Why?!

Unless 2fa was bypassed with the token you get from GitHub in order to use the git client via https.

I mean they don&#x27;t say how they accessed the GitHub repo or whether there was a vulnerability in Github itself that allowed access

The most I&#x27;ve ever personally seen a company do is require a VPN for their privately-hosted repos. For others using GitHub or Bitbucket? Never anything beyond a standard login.

uber engineer here, we have 2fa set up for everything. Starting my day takes about 5 different 2fa checks (ssh access, aws, phabricator, team chat, etc)

You couldn&#x27;t enforce 2FA on GHE for the longest time. GHE version 2.8.0 lists [0] &quot;Enforce two-factor authentication&quot; as a feature. 2.8.0 was released November 2016. According to the article,&gt; Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said.I don&#x27;t know if they were using GHE. If they were, at the time it did not come with a good way for them to enforce 2FA for users.[0] <a href="https:&#x2F;&#x2F;enterprise.github.com&#x2F;releases&#x2F;2.8.0" rel="nofollow">https:&#x2F;&#x2F;enterprise.github.com&#x2F;releases&#x2F;2.8.0</a>

that doesn&#x27;t protect you from GitHub employees snooping around.

Github 2FA has been part of the first-day training&#x2F;laptop setup for a while now (I joined in may) and there&#x27;s security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake.One snippet of the email the article didn&#x27;t mention was that Sullivan&#x27;s firing happened pretty much right after Dara learned of the breach and an investigation was conducted. It definitely inspires more confidence in leadership seeing that the CEO will not tolerate unethical behavior.

Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don&#x27;t have 2FA - because they don&#x27;t login - but they have full access to most source.In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to source code with secrets in it.

2FA doesn&#x27;t help if they used SSH access

Maybe it&#x27;s just me, could &quot;private GitHub coding site&quot; have meant a private GitHub repo with GitHub pages turned on?If that were the case, there would be no authentication whatsoever to access the closed-source site; the hacker would have just needed to guess the right url.

Do we know how the attackers accessed the github repo? If it was via malware on the employee&#x27;s machine, or cookie theft then 2fa wouldn&#x27;t have helped.

2FA wouldn&#x27;t have necessarily solved this, if the hackers had access to an engineer&#x27;s ssh keypair (e.g stolen laptop) they could clone repos as they pleased. 2FA isn&#x27;t a silver bullet.

No, 2FA would not have prevented disclosure of credentials in GitHub. The fix for that is to not check credentials in to GitHub. Nothing else.

Two factor won&#x27;t protect you from a spear-fishing attack.The attacker can submit your info to GitHub the moment you submit to the malicious site. You receive the token via SMS as expected, enter it on the second page of the malicious site, granting them access.

I&#x27;m surprised Uber doesn&#x27;t have their engineers set up 2FA for GitHub. Super simple to implement and require organization-wide[1] and would have prevented this. Then again, not storing credentials in GitHub would also have prevented this . . .[1] <a href="https:&#x2F;&#x2F;help.github.com&#x2F;articles&#x2F;requiring-two-factor-authentication-in-your-organization&#x2F;" rel="nofollow">https:&#x2F;&#x2F;help.github.com&#x2F;articles&#x2F;requiring-two-factor-authen...</a>

It&#x27;s very common, but there are lots of ways of addressing it.

From what I hear it&#x27;s pretty common...

They key part is &quot;Warning: Once you have pushed a commit to GitHub, you should consider any data it contains to be compromised. If you committed a password, change it! If you committed a key, generate a new one.&quot;Removing the secrets from the repository is nice to have, but not that necessary - what is mandatory is to ensure that the compromised secrets are no longer useful, since they aren&#x27;t secret any more and won&#x27;t be ever again.

I am rather disappointed in github for publishing this guide. The portion at the top stating&gt; Warning: Once you have pushed a commit to GitHub, you should consider any data it contains to be compromised. If you committed a password, change it! If you committed a key, generate a new one.Is a good argument as to why you shouldn&#x27;t let users erase this data from history, it&#x27;s already out there so no matter how painful or convoluted your process is for regenerating auth credentials is, you need to do it if you&#x27;ve published them into your SCM. If the process is painful you might want to simplify it because you&#x27;ll probably need to do it sometime in the future again... yes even you large corporate workers who have no control over credential regeneration, an arduous process leads to credential sharing between projects which is another horrible thing.

Just pigging-backing on your comment. If you did, here&#x27;s a guide from Github on how to remove it: <a href="https:&#x2F;&#x2F;help.github.com&#x2F;articles&#x2F;removing-sensitive-data-from-a-repository&#x2F;" rel="nofollow">https:&#x2F;&#x2F;help.github.com&#x2F;articles&#x2F;removing-sensitive-data-fro...</a>

git-secrets is a pre-commit hook that regexp&#x27;s out secrets and blocks commits<a href="https:&#x2F;&#x2F;github.com&#x2F;awslabs&#x2F;git-secrets" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;awslabs&#x2F;git-secrets</a>

Things like this make me feel much less concerned about the confidence gap.

It&#x27;s not foolproof but this tool needs to be more widely-known - it would&#x27;ve saved me on countless occasions.

We use a tool under a Linux Foundation project called anteater <a href="https:&#x2F;&#x2F;github.com&#x2F;opnfv&#x2F;releng-anteater" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;opnfv&#x2F;releng-anteater</a>, which does the same thing (but is for a jenkins &#x2F; gerrit workflow). A key difference from looking at talisman, is anteater uses standard RegEx rather then code to seek out strings, so anyone can add their own strings &#x2F; file names easily into a simple yaml file. Like wise they can use regex to provide a waiver, should something be incorrectly reported.I am thinking now would be a good time to port it to working with webhooks as well.The tool would have blocked the aws credentials from being checked in: <a href="https:&#x2F;&#x2F;github.com&#x2F;opnfv&#x2F;releng-anteater&#x2F;blob&#x2F;master&#x2F;master_list.yaml#L55" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;opnfv&#x2F;releng-anteater&#x2F;blob&#x2F;master&#x2F;master_...</a>

You can use tools like Talisman which registers a Git hook to check if you are checking in anything that looks like secret.<a href="https:&#x2F;&#x2F;github.com&#x2F;thoughtworks&#x2F;talisman" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;thoughtworks&#x2F;talisman</a>

I&#x27;m not even mad, thats a good bug bounty

There are a few SaaS offerings that will let you do that. LastPass or onepassword are two commonly used.One you can use something like keypass to store a database in a shared location if you don&#x27;t trust the SaaS offerings.If you are looking at storing credentials for automation purposes, and don&#x27;t have a secret store built in, you could look at something like Hashicorp Vault to help provide this for you

We&#x27;re using Keepass &#x2F; MacPass password protected vault shared with the team using Dropbox. It&#x27;s really good and essentially free to use if you use a free Dropbox account.

When it comes to security, there are no dumb questions.

In person I use a thumb drive. You could encrypt the credentials using PGP and send it to a coworker if they are remote.Sometimes I just go on google hangouts and share my screen if I&#x27;m feeling lazy.

I think that something like Stack&#x27;s Blackbox is the best idea. This ansible-based setup also explains the concepts pretty well: <a href="http:&#x2F;&#x2F;ansiblecookbook.com&#x2F;html&#x2F;en.html#how-do-i-store-private-data-in-git-for-ansible" rel="nofollow">http:&#x2F;&#x2F;ansiblecookbook.com&#x2F;html&#x2F;en.html#how-do-i-store-priva...</a>

We launched EnvKey[1] a couple months ago to offer an easy-to-integrate solution to this issue.1 - <a href="https:&#x2F;&#x2F;www.envkey.com" rel="nofollow">https:&#x2F;&#x2F;www.envkey.com</a>

I&#x27;ve never used it in production (my last shop was heavily AWS based and relied on IAM), but I always like the look of Hashicorp&#x27;s Vault [0]<a href="https:&#x2F;&#x2F;www.vaultproject.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.vaultproject.io&#x2F;</a>

Dumb question: What&#x27;s the best practice to share authentication credentials across the team for services that don&#x27;t have an IAM feature?

Totally agree. I am moving secrets onto consul&#x2F;vault - would like to hear what others use for the same.

Store credential information where it is used. It is not used by the repository, so it is an improper location for it.If someone gains access to a system that uses the credentials, then there is, in principle, no difference between puppeteering that system versus stealing its credentials.

But you have to put them somewhere; how is idk, AWS credential management secured?

You could have a git hook (even remote) that would check for pre-configured patterns and reject the push if it contains them.Quick google yielded this <a href="https:&#x2F;&#x2F;github.com&#x2F;awslabs&#x2F;git-secrets" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;awslabs&#x2F;git-secrets</a>

Plug: <a href="https:&#x2F;&#x2F;github.com&#x2F;thoughtworks&#x2F;talisman" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;thoughtworks&#x2F;talisman</a>

Really surprising to see that sensitive credentials were checked in to VCS. Apart from peer code review, how can a company avoid developers checking in sensitive data to VCS?

Yeah, but hopefully they can&#x27;t do much if they just have your code base. If the secrecy of your code is the only thing stopping hackers from exploiting you, you&#x27;re missing some gaping holes in your infrastructure. With that said, nothing wrong with using secrecy as a additional barrier, but shouldn&#x27;t be the only, and if it&#x27;s not the only, you&#x27;re not &quot;so owned at that point&quot;.

&quot;Don&#x27;t check secrets into VCS, folks! &quot;I suppose? But at this point they have your code base. You are so owned at that point.

&gt; Don&#x27;t check secrets into VCS, folks!Ok, how do you handle a bootstrap problem?

I really wish AWS would stop enabling master API keys by default. As soon as you create an AWS account you are given API keys which basically have SUDO permissions to your entire account. That is super dangerous and is probably the same key set that these hackers got ahold of. AWS needs to disable these full access API keys by default and instead should encourage users to generate keys for specific access to limit what they can do.

&gt; Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company.Don&#x27;t check secrets into VCS, folks!

I wish I was a fly on the wall at Transport for London. Or to be at that meeting TfL will be having with Uber, when Uber are going to magically prove themselves to be a &#x27;fit and proper&#x27; company. At some point after some British chat about the weather someone on the TfL side of the table might ask: &#x27;So, that data breach...&#x27;

One would hope the next settlement would have more teeth.If I was running the FTC, I would not settle this time, because it&#x27;s blatantly obvious Uber was acting in bad faith last time around.

I hope the earlier agreement contains language that allows it to be voided, and put all the original violations back on the table. If there is no such term, this is one relatively straightforward way to improve the handling of these matters in future (if a company was unaware of other breaches at the time and appeared to act in good faith, the FTC could always choose to let the original agreement stand.)

If the FTC doesn&#x27;t act on this they are toothless. Uber&#x27;s blatant disregard to anything accountable or respectable is astounding:&quot;In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014. After last year’s cyberattack, the company was negotiating with the FTC on a privacy settlement even as it haggled with the hackers on containing the breach, Uber said. The company finally agreed to the FTC settlement three months ago, without admitting wrongdoing and before telling the agency about last year’s attack.&quot;

People keep bringing this link up every time, but obscure the actual reason that was done: it puts the developers depending on the library in legal jeopardy. Licenses like &quot;Do Whatever The Fuck You Want To&quot; [0] are in the same boat.Redhat also stopped including JSMin for the same reason. [1][0] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;WTFPL" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;WTFPL</a>[1] <a href="https:&#x2F;&#x2F;bugzilla.redhat.com&#x2F;show_bug.cgi?id=455507" rel="nofollow">https:&#x2F;&#x2F;bugzilla.redhat.com&#x2F;show_bug.cgi?id=455507</a>

It all started when Google banned all software that can not be used for Evil: <a href="http:&#x2F;&#x2F;wonko.com&#x2F;post&#x2F;jsmin-isnt-welcome-on-google-code" rel="nofollow">http:&#x2F;&#x2F;wonko.com&#x2F;post&#x2F;jsmin-isnt-welcome-on-google-code</a>

&quot;Don&#x27;t be evil&quot; - a command not a mantra.

&gt; What ever happened to our mantra (really Google&#x27;s but it reflected the whole valley) &quot;Don&#x27;t be evil&quot;?The kool-aid wore off and everyone realized it never had any meaning to begin with.

I woke up an Silicon Valley has really become an Evil place. What ever happened to our mantra (really Google&#x27;s but it reflected the whole valley) &quot;Don&#x27;t be evil&quot;?We really need to change.

It&#x27;d be nice if I could register for 2FA with all the various agencies. Commenters have suggested paying a fee to &#x27;freeze&#x27; credit activities but the process to &#x27;unfreeze&#x27; them requires no new information than what&#x27;s already in most of these leaks...

Yeah, this happens a lot here. I mean the cheapest and most effective way for companies to get away.

I moved to the US in April was and shocked by the Equifax breach, but more surprised to hear from a coworker how often these “free credit&#x2F;identity monitoring for a year” situations occur.One co-worker is covered by no less than four groups who failed to look out for him earlier, all for trusting companies to not screw up PII or remember that data is a liability.

&gt; Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protectionThis got to be a running joke now. Companies lose the data and offer credit&#x2F;theft protection than facing the consequences. If Equifax could get away with the giant breach, I am sure Uber will not even feel the heat. smh.

Do you believe this kind of thing is simply unavoidable? I wonder if this could&#x27;ve been avoided by simply making it impossible to access data without being connected to a VPN in addition to having some sort of physical device connected to your computer.

If the attack was conducted using login credentials found on github how does this prove that 2FA&#x2F;SSO are not enough? Wouldn&#x27;t 2FA have prevented easy use of these credentials?

81% — that is a very precise number.Folks should be using short lived aws tokens to avoid the possibility of having tokens in source control: <a href="http:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;IAM&#x2F;latest&#x2F;UserGuide&#x2F;id_credentials_temp_request.html" rel="nofollow">http:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;IAM&#x2F;latest&#x2F;UserGuide&#x2F;id_credentia...</a>

81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches or data leaks. Most organizations believe that 2FA and SSO are the answer but this proves that 2FA&#x2F;SSO are not enough.

&quot;Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company.&quot;Seems to suggest they committed AWS credentials into source control?

No, it does not. Tough luck if you are a drive, btw. You&#x27;ll be made redundant to self-driving cars soon.

It never fucking ends with this company, does it?

I think its time that Uber starts paying a real and deathly penalty for their pattern of behaviors.

If companies hiring the &quot;best and brightest&quot; can&#x27;t keep your data secure, what hope is there for the average non-tech company? Low tech lock-and-key solutions don&#x27;t seem so bad now. If only they could scale...

It&#x27;s not related to this particular breach, but given this and Uber&#x27;s other issues, it&#x27;s not out of the realm of possibility that at some point they had a more serious breach involving loss of password hashes or interception of credentials at login.(But in all likelihood the poster&#x27;s account was just compromised through the usual means, otherwise there would be more reports of hacked accounts.)

In the disclosure it says that the attack included names, email addresses and phone numbers. It did not contain any passwords or social security numbers, so your passwords must have been compromised in some other way.

Uber accounts are frequently sold on underground markets - they&#x27;re sourced via endpoint malware and shared passwordsYou should check over all of your accounts and machines - I doubt it has anything to do with this leak

check your email on <a href="https:&#x2F;&#x2F;haveibeenpwned.com" rel="nofollow">https:&#x2F;&#x2F;haveibeenpwned.com</a>

Yep.About that time my Uber account was &#x27;hacked&#x27; and someone kept requesting rides in Florida and I had to cancel them as fast as they made them.I emailed Uber support and they got back to my 3 days later.Then someone proceeded to try to gain access to every account I had with that email and password (yeah, yeah, I know). The next worse was someone getting into my DigitalOcean account and launching an instance.It has finally settled down, I occasionally get alerts from people trying to break into something but lots of 2FA and no shared passwords anymore.I am not sure if this was Uber&#x27;s fault or another site&#x27;s but the timeframe of Oct 2016 lines up.

&quot;For $100K we will delete the information, Scouts honor!&quot;...

Generally your finance department needs approve purchases beyond a certain dollar amount. This is pretty standard stuff.If they got it approved as such don&#x27;t you think the CEO would have been informed that there was line item from Security for ransom?The article states the CEO didn&#x27;t find out about the hack until a month after.

Who needs to approve it? How would you know they didn&#x27;t?

Yes, this is spot-on, the just published New York Times article details this: <a href="https:&#x2F;&#x2F;www.nytimes.com&#x2F;2017&#x2F;11&#x2F;21&#x2F;technology&#x2F;uber-hack.html" rel="nofollow">https:&#x2F;&#x2F;www.nytimes.com&#x2F;2017&#x2F;11&#x2F;21&#x2F;technology&#x2F;uber-hack.html</a>

IIRC Uber has had a very large bug bounty program with substantial payouts. It seems possible this was billed under the guise of a bounty.

Maybe it&#x27;s personal cash. 100k is barely a weekend in Vegas for these people.

The CSO was able to arrange for $100K to be paid out without any oversight of what that money was for?If it was paid to hackers it&#x27;s unlikely that finance cut a check. I&#x27;m imagining this was paid in bitcoin or similar. How was this able to be approved?I&#x27;m guessing someone created a fake invoice? Wouldn&#x27;t that constitute fraud?

IANAL but I did some basic visualization work as part of a story on US state data breach regulations. What may be Uber&#x27;s undoing is that they must have the drivers license numbers for all of their drivers on file and that is considered PII by 45 states (nevermind that they also missed their reporting deadline).And if you&#x27;re interested, a gif of the data:<a href="https:&#x2F;&#x2F;imgur.com&#x2F;Rm32MeC" rel="nofollow">https:&#x2F;&#x2F;imgur.com&#x2F;Rm32MeC</a>

Regarding Joe&#x27;s previous behaviour:
<a href="https:&#x2F;&#x2F;www.theverge.com&#x2F;2016&#x2F;7&#x2F;10&#x2F;12127638&#x2F;uber-ergo-investigation-lawsuit-fraud-travis-kalanick" rel="nofollow">https:&#x2F;&#x2F;www.theverge.com&#x2F;2016&#x2F;7&#x2F;10&#x2F;12127638&#x2F;uber-ergo-invest...</a>
<a href="https:&#x2F;&#x2F;lawyerist.com&#x2F;ubers-secret-encrypted-far-reaching-investigation-opposing-counsel&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lawyerist.com&#x2F;ubers-secret-encrypted-far-reaching-in...</a>A lot more will likely leak out now. Iceberg tip located.

I can not believe Joe Sullivan would just sit there during this. There has to be so much more to this story.I can not imagine he would be on board with negotiating with the hacker, and cannot imagine him sitting idly for a year after the cover up.

Maybe if you can organize a class lawsuit.

I&#x27;m getting sick of this stuff. As a user of Uber (or Equifax), would I have any case if I tried to sue them for mishandling private data (I live in Massachusetts)?<a href="http:&#x2F;&#x2F;www.mass.gov&#x2F;ago&#x2F;doing-business-in-massachusetts&#x2F;privacy-and-data-security&#x2F;standards-for-the-protection-of-personal.html" rel="nofollow">http:&#x2F;&#x2F;www.mass.gov&#x2F;ago&#x2F;doing-business-in-massachusetts&#x2F;priv...</a>

At this point if the next headline is “Uber sold nuclear submarine secrets to China whilst kicking puppies” I won’t bat an eyelid.

&gt; Uber paid hackers $100,000 to delete stolen data and keep quietReally? Really? Come on!!!

Another breach that 2FA and SSO didn&#x27;t stop. 81% of all breaches now originate from compromised credentials mainly acquired from 3rd party data breaches. Most organizations believe that 2FA and SSO are the answer but this proves they are not enough.

Well I hope Uber asked for the hard drive shredder receipt this time around.

No, don&#x27;t get hung up on unnecessary details.The reasonable company director should have known X and when found out was bound to report it. Person Y did not report it, should have known as it was their job to know and there aren&#x27;t extenuating circumstances. Guilty. 6 months. Next case.&quot;I don&#x27;t know anything about this company I accept 7 figure sums to oversee as a director.&quot; Should never be any kind of legal defence. If senior management and directors have something personally at risk you&#x27;ll see vastly improved behavior. Right now we&#x27;re selecting for the opposite and seeing the inevitable results.There is a story like this about directors and management cover ups every single day

Doesn&#x27;t PCI work well in general? It has a large amount of overhead but we see very few credit card breaches from within the &quot;PCI vault,&quot; while we see many Social Security number breaches and email&#x2F;password combinations.For example, the Target credit card breach occurred because malware intercepted the credit card information at the Point of Sale appliances before the information was encrypted and transmitted.Prison time seems extreme, but Congress should should absolutely establish statutory fines (for companies) for breaches of PII. Then any company officer can save the company money by simply spending more on prevention because it will lower breach insurance premiums.

You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats.WEll that&#x27;s already happening without jail time so maybe give it a whirl. LEt&#x27;s get real here, the idea of suits going to jail is just scary to some people but it&#x27;ll be fine.

How to implement though?You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats. Also never underestimate just how disorganised large organisations are, incompetence at addressing issues is systemic and goes far beyond data protection. What seems like malice is sometimes just plain stupidity.It has to be backed by some sort of regulatory framework. Just like a fire code or employment rights. But crafted in a way that it doesnt end up like PCI, ratings agencies or financial auditors. IE creating an industry that sells compliance and not actual security.Perhaps something light, like mandetory minimum bug-bounty schemes for all companies, where fines (or more) are imposed for not addressing issues and an independant regulator works with larger companies to resolve issues (or penalise the company severely if they deliberately wont).

You&#x27;re in charge of security at a large e-commerce company, and your view is that your company is bound to get hacked?I think that&#x27;s a very sad commentary on how little your company values security.

You raise a difficult issue - how you would honestly resolve it. On one hand, CSOs cannot be personally liable for every hack. On the other, they shouldn&#x27;t be given a pass on everything either.So how does one draw the lines between bad luck, reasonable security problems, everyday poor performance, civil liability, and criminal negligence?&gt; A random engineer could make a mistake that gets hackers a step closerThat could be prevented, to a large extent, with much tighter controls. Of course, those controls would greatly increases the cost of operations and other things.Is it possible we&#x27;re all accustomed to the wrong model, that our standard of IT security is like the standard of car safety in the early auto industry (and maybe until the 1970s) - far too lenient? Maybe we should be facing the potential fact that the normal cost of IT should include those controls and other security expenses.

I’m not sure the previous comment is saying in all circumstances. I agree with what you’re saying - because higher officials obviously aren’t able to catch every mistake made by every engineer but I think the parent comment really meant that if there is gross negligence or intent to cover up breaches then that seems like a crime that the individual should be punished for.

Not because you got hacked. No. Hell no. I never suggested that and reject it totally.We&#x27;re talking about cover up, if you cover up the fact someone stole private data belonging to other people you took responsibility for. If you try and pretend it didn&#x27;t happen because you might get away with it then claim you didn&#x27;t know when it comes out? Then yes, absolutely, you deserve to risk jail time for that. As does your board of directors.CSOs, senior management, boards of directors should be personally responsible for their own actions. They need to have something at stake that they really dread losing when making the decision &quot;perhaps we can get away with this?&quot;

It&#x27;s not really much about that Uber got hacked, which is bad enough. It&#x27;s that they paid off the hackers and didn&#x27;t tell anyone they got hacked until now.

If you can demonstrate due process and reasonable effort to secure against breaches, your doing your job. For instance with described procedures, sane defaults, locked down environments ect. But if you&#x27;re a CSO and have not described threatmodels, workflows, and security practices, then you&#x27;ve not done your job and should be held accountable for data breaches.

I&#x27;m in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear.No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can&#x27;t really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against.There are millions of motivated adversaries out there and a finite number of employees at your company to outsmart them. It&#x27;s a game you can&#x27;t win. The larger your company becomes, the broader your attack surface becomes, and the higher value a target you become.You just have to hope that when you get hacked, it is a &quot;forgiveable&quot; hack like a zero-day or highly targeted attack.If CSO&#x27;s are to be personally accountable for the malicious actions of others, it needs to be due to clear negligence on their part and the responsibilities need to be clearly defined.

There is personal liability for board members and management boards (CEO etc.) in many (most?) jurisdictions, usually including for some things that they should have known but didn&#x27;t know, typically if the &quot;not knowing&quot; part can be characterized as gross negligent.Also, the personal liability for board members and managers is something that is exceedingly pursued by shareholders and creditors (for the financial liability) and prosecutors (for the criminal liability) compared to how it used to be.I don&#x27;t think it matters much, though.

What&#x27;s the largest group of people you&#x27;ve managed?

Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known.The &quot;I didn&#x27;t know, I just took a vast salary to play golf&quot; argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will resign, those who take the job would actually take an interest and have the ability to do so.An idea whose time has come.

The fact that this is a big company is exactly why strict access policies are necessary! I might trust a handful of administrators, or a limited set of engineers whose data access is audited, but I sure as hell would not trust thousands of engineers with my private data.Other tech companies (e.g Google) safely silo PII data, and any access has to be audited.I cannot wait before GDPR is implemented in Europe... at least companies will be seriously fined if they want to cut corners on privacy and data protection.

as the size of the company grows past a certain size, especially these &quot;move fast and break things&quot; idiots, i feel like the likelihood of this goes up. there are more and more people, someone is bound to do something stupid.

Yes, and this is from 2014! They really did not learn anything, and Kalanick&#x27;s apologies and statements about &quot;becoming more mature&quot; were all just bullshit.

We already knew that -- viz Uber showing off their ability to track famous users at a party.see<a href="https:&#x2F;&#x2F;www.forbes.com&#x2F;sites&#x2F;kashmirhill&#x2F;2014&#x2F;10&#x2F;03&#x2F;god-view-uber-allegedly-stalked-users-for-party-goers-viewing-pleasure&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.forbes.com&#x2F;sites&#x2F;kashmirhill&#x2F;2014&#x2F;10&#x2F;03&#x2F;god-view...</a><a href="https:&#x2F;&#x2F;www.cnet.com&#x2F;news&#x2F;god-view-under-spotlight-as-uber-investigation-intensifies&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cnet.com&#x2F;news&#x2F;god-view-under-spotlight-as-uber-i...</a>and<a href="https:&#x2F;&#x2F;www.cnet.com&#x2F;news&#x2F;uber-lawsuit-alleges-startup-tracked-celebs-politicians&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cnet.com&#x2F;news&#x2F;uber-lawsuit-alleges-startup-track...</a>

They stored AWS storage credentials in clear, in a (private) Github repo...This is so baffling coming from one of the largest tech companies in the world.Among other things, this shows that they do not have proper access policies to user data (e.g anybody working at Uber can get access to any user&#x27;s data), which in my opinion is a larger issue than this individual hacking case.

Wouldn&#x27;t the easy solution to this class of problems be to require some sort of physical device to be connected to your machine in order to access certain sets of data? Assuming the device itself couldn&#x27;t be spoofed, wouldn&#x27;t that solve this once and for all?

The &quot;success at any cost&quot; mentality may have some costs, in retrospect

At what point can we just let a company die? Is there even such a line to be crossed anymore? Personal data leaks and illegal cover-ups, Greyball, utter disregard for regulations, IP theft, a culture systemic harassment and sexism, etc etc etc. Uber just needs to die so that the rest of us can have some semblance of faith in the system left.

Put a lawyer in charge when your strategy is to defend lawsuits against issues and mitigate the fallout of issues, rather than to, you know, prevent the security issues

Welcome to lobbying ver, 2.0.Instead of giving cash bribe, bribe with cushy jobs with high salary and no real responsibility, since no one would expect a lawyer to understand what even to delegate to members of IT security team.

Security, as far as a corporate entity is concerned, is fundamentally a way to reduce business and legal risk. A lawyer at the top, making those decisions with the input of technologists, seems like it should be reasonable when things are working correctly. This isn&#x27;t a failure of skillset or knowledge, it&#x27;s a failure of ethics and leadership. (Which should, to be clear, be punished far more severely than skill-related incompetence.)

&gt; Joe Sullivan, the outgoing security chief, spearheaded the response to the hack last year, a spokesman told Bloomberg. Sullivan, a onetime federal prosecutor who joined Uber in 2015 from Facebook Inc....Why on earth would a software-based company like Uber that stores a boatload of confidential employee and customer information on its servers put a non-technical person of any sort, lawyer or not, in charge of its security team?

Nope, they don&#x27;t know. My non-tech friends are all using Uber &#x2F; UberEats with no clue about the company, and the CEO. They just see an easy to use app to get what they want quickly.

Does anybody have a link to a good source on this? I&#x27;m behind on this myself.

I don&#x27;t know. I&#x27;ve received a lot of flak for even using Uber from non-tech friends&#x2F;dates recently. I think the continual tide of negative publicity is definitely having a material effect on their brand image.

&gt;and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customersI don&#x27;t think the average Joe is up to date with this news, or even care about.

Tony is a changed man!  He even voluntarily subjected himself to regulation.  We need a new target.

Magneto is pretty concerned with ethics and morality, I think Uber is more owned by Tony Stark on a particularly bad binge.

I&#x27;m not sure if that&#x27;s an accurate analogy. Few politicians would want to find themselves working in the climate Trump has found in Washington, (if anything, he has proven that a groundswell of popular support can&#x27;t unseat a party establishment). Also, it simply would be inaccurate to describe Uber&#x27;s actions as impotent.Edit: allow me to replace the word &quot;found&quot; with &quot;created.&quot; I was just using a figure of speech.

Just yesterday, I got some serious flak for suggesting that changing one person in leadership wasn&#x27;t enough to make them not evil. I&#x27;m sad to see just how bad this is&#x2F;was, but I&#x27;m not one bit surprised.

I propose a new law, similar to Godwin&#x27;s.&quot;As an online discussion grows longer, the probability of a comparison involving Trump approaches 1&quot;

No substance post, seeking the political low hanging fruit.  Looks like the new crowd here loves it, giving you plenty of up votes.

Uber is like the Donald Trump of corporations. It sets new ground in how openly vile you can be without any consequences. Just like Donald Trump the real danger is not in Uber itself but in whatever it will be that uses it as a role model.

In that case, yes. But they were definitely spying on journalists, law enforcement and other potentially critical users

&gt;to spy on their employees and customersTo be fair, they weren&#x27;t spying on their customers. They were fingerprinting phones which is against the Apple ToS.

Protip: Uber&#x27;s own bullshit aside, their drivers are employees.Who are getting screwed.

I haven&#x27;t heard stories about how Uber employees are getting screwed. (Presumably financially?) Are you referring to Uber drivers in this comment?

You can move fast and break things without being a jerk or a misogynist. They don&#x27;t get an excuse because they mixed the two up.

AirBnb had to fight a very similar path and the only bad press I can remember about them was that tone deaf&#x2F; offensive political marketing campaign they had.

No excuses for a systemically misogynistic corporate culture. I deleted Uber. You probably should too.<a href="https:&#x2F;&#x2F;www.theguardian.com&#x2F;technology&#x2F;2017&#x2F;jun&#x2F;13&#x2F;uber-ceo-travis-kalanick-leave-absence-scandal" rel="nofollow">https:&#x2F;&#x2F;www.theguardian.com&#x2F;technology&#x2F;2017&#x2F;jun&#x2F;13&#x2F;uber-ceo-...</a>

Plenty of companies have disrupted plenty of industries by now, but without this kind of behavior. I don&#x27;t see how the way they dealt with the data breach was required to disrupt the local ground transportation industry, nor was the way they&#x27;ve treated employees (including drivers) and customers.

I never quite know how to think about them. On the one hand, they’d changed an entire industry in a way that people wanted but was getting serious resistance from the entrenched players. They had to break a lot of rules and go around a lot of people with a whole lot of connections to get where they are and in the process made a lot of enemies.I expect blowback. I expect negative news. They essentially pulled it off by looking at every day as combat where fighting dirty was rewarded.

Now with them investing heavily in self driving cars, they aim to avoid paying drivers.

As much as I hate blaming the victim, but giving your personal info just to get a Taxi ride is utterly moronic. I don&#x27;t want to have any relation of any sorts with a Taxi, I ride I pay and bye.Having to register for that is quite surreal.

That&#x27;s silly. Uber has a revolving door with Google and Facebook. Nobody is getting screwed, or it would not work to hire people away.

And testing their self driving cars without getting the proper permits. And hiding shit like this from investors so they’ll lose a lot of money later.I would never work as an engineer for a company like that. How can I trust that it will honor any deal I make and not screw me? I have to think about that with every company but this one in particular can’t even spell ”integrity”.

That concealing was a year ago. Now discovered by an internal investigation and disclosed. CEO has been different for a few months too.

Man, I don&#x27;t know if Uber is evil or if most tech companies are evil and Uber just doesn&#x27;t drop the kind of money on PR strategery that an evil company need to drop in order to seem normal.  But either way, holy cow does that company come off as toxic.  They&#x27;ve completely revolutionized the drive-for-hire industry and all anyone ever hears about it what a D-bag their CEO is or how toxic and mysogonist their work environment is or how hard they work to spy on their employees and customers (to the point that the CEO of Apple had to have a Come To Jesus talk with the CEO of Uber) or how their employees feel like they are getting screwed or, now, how they are concealing massive data breaches.  It&#x27;s like how I imagine Uber would be if it was run by Magneto instead of Tony Stark.

What would be the tax implications of this in USA? I imagine there isn&#x27;t a bill given by another entity, but this is rather a bitcoin&#x2F;cash transaction. In my country this would mean this payout would be hit with all the taxes [1], pretty much doubling the cost.--[1] Income tax, unemployment insurance, healthcare, and maybe even pension. All going to the benefit of the country as there is no identifiable human on the receiving end.

&gt; Why was this only worth 100K?Gotta be careful dealing with company like Uber. At some price point they might just hire hitmen to kill you instead.

Why was this only worth 100K?  How did they verify info was deleted?  And how does this show up on an expense report at the end of the year?

Uber Paid Hackers to Delete Stolen Data on 57M People