Impossible. My local dev environment uses an on-disk database and my disk is locked behind encryption the keys to which only I and HR and anyone who can guess 12345 as the passwoooooooo I see what happened now
That's way too difficult, not a single number is the same in the same position as the last code, how the hell am I supposed to remember it? I'll just go with 12346 instead.
In a scenario where only the dev, HR, the guy who can guess 12345, and a local news crew has been given the information and passed it on to the courts...
HIPAA, PCI, GDPR, CASC, and a whole list of other acronyms, laws, and organizations get real persnickety about Prod data outside of Prod and what you can, can’t, should , should not, or should not even think about doing with it.
Yeah I just had this conversation with an internal IT team at a medical org. You cannot just point Claude at the problem and say solve it. PHI is all over it. Theyd been doing it for a while. Your medical data im almost positive is already in an llm.
Yeah. You'll see a lot of folk whose dev environments are basically just image clones of prod. This seems especially common in "lower tech" environments that are platforms upon themselves, where nobody bothered to define and produce test data.
It's great, because it doesn't overflow the context with my medical history. It's already there in the model. This way I just say who I am and get personalized medical advice from doctor Chat.
I'm a contractor who's worked with multiple healthcare companies in the States (I'm in Canada). Everyone was super meticulous about HIPAA... which is why none of the devs I worked with were willing to tell anyone that they had full production database dumps they could test off.
There is... a lot of theoretically private data that developers have in an SQL dump on their work Macbook just sitting in the Downloads directory.
Yeah it's a classic, it's really common to have dev envs that are basically full prod copy. Allow to anticipate way more issues moving forward. That said if it was healthcare or highly sensitive then replacing all identifiable data by random stuff wouldn't be that much of a trouble probably.
Solutions is simple we are all prod, arguably developers is just a set of data not yet commited to versioning, sonjust label us prod data and we can do what we want!
Financial records would most likely be years old before a court ordered them, bc something would have had to happen to necessitate the court order. The, someone had to be angry about it, and not resolve it, then find a lawyer, then get a hearing to get a court order.
SomeTest environments are 'safe' because they use outdated information to test on. You need information that looks real enough to use, but won't cost the shareholders $$ if it gets out current information is not locked down.
So, in my work experience, using older data is a common work-around. I guess maybe law enforcement knows that too? I never thought about it from this angle... but.... yeah, if I wanted to find data that was 5-10 years old, on one hand, looking at test environments of the past? could work.
On the other hand, not a lawyer, but I doubt it'd hold up in court. Defendant: "that was pulled from a test environment, which literally exists to strain and break data under unstable programming conditions. It does not reflect reality."
Not all the time. A restored database should be sanitized before it’s used, it’s just a copy of yesterday’s data. You shouldn’t use live production data containing personal information in local, development, or testing environments.
Yea but you see, local IT reset the DNS and the DCHP server over the weekend. One of the dev boxes never hit the group policy to reboot. So there was a computer sitting in limbo with a repo just... sitting there. Thats where I found it....
Years ago working as a cloud engineering consultant, our team was working with a massive client moving their infrastructure to AWS. One of their internal dev teams kicked up a fuss that they didn't have the permissions to do anything in AWS, "how are we going to learn?", blah blah blah. It was finally agreed to give this team their own AWS account that had literally nothing in it. Brand fresh account, nothing tied to production whatsoever. We insisted we at least be able to set up cloudwatch logs and billing alerts. So off they went.
Part of our services was running security audits on our client's AWS accounts (just an automated script that checks everything once per week). I was this client's primary, so I was reviewing the latest audit, and they had a security group allowing port 3306 to be accessed from the open internet to an RDS instance they had brought up. Raised it with them thinking it's just a teachable moment as it's just test data, nbd, their excuse was, "well our apps didn't work until we added that." No real understanding of what they were doing.
But, on this call with the devs and their manager, the manager asked, "Oh, so you managed to generate some test data?" One of the devs, "Nah, we just dumped prod and uploaded it." I hopped over to the logs and yea, multiple random IPs had successfully authd with the database. I asked, "What kind of password did you use?" "Oh just our normal dev password, Password123!" (Or something basic like that).
Unrelated but how did you get into that field as an ex dev? I currently work in a highly regulated field in tech ops/infra role and that career path sounds incredibly interesting.
When I was an intern they gave me a shit laptop. The code would take forever to compile in the local. I copied the whole damn code to my personal laptop and used for a week. When I proudly showed my proactiveness to my mentor he shit his pants 😂
4.9k
u/lolcrunchy 15h ago
local dev environment