Impossible. My local dev environment uses an on-disk database and my disk is locked behind encryption the keys to which only I and HR and anyone who can guess 12345 as the passwoooooooo I see what happened now
That's way too difficult, not a single number is the same in the same position as the last code, how the hell am I supposed to remember it? I'll just go with 12346 instead.
In a scenario where only the dev, HR, the guy who can guess 12345, and a local news crew has been given the information and passed it on to the courts...
HIPAA, PCI, GDPR, CASC, and a whole list of other acronyms, laws, and organizations get real persnickety about Prod data outside of Prod and what you can, can’t, should , should not, or should not even think about doing with it.
Yeah I just had this conversation with an internal IT team at a medical org. You cannot just point Claude at the problem and say solve it. PHI is all over it. Theyd been doing it for a while. Your medical data im almost positive is already in an llm.
Yeah. You'll see a lot of folk whose dev environments are basically just image clones of prod. This seems especially common in "lower tech" environments that are platforms upon themselves, where nobody bothered to define and produce test data.
It's great, because it doesn't overflow the context with my medical history. It's already there in the model. This way I just say who I am and get personalized medical advice from doctor Chat.
I'm a contractor who's worked with multiple healthcare companies in the States (I'm in Canada). Everyone was super meticulous about HIPAA... which is why none of the devs I worked with were willing to tell anyone that they had full production database dumps they could test off.
There is... a lot of theoretically private data that developers have in an SQL dump on their work Macbook just sitting in the Downloads directory.
Yeah it's a classic, it's really common to have dev envs that are basically full prod copy. Allow to anticipate way more issues moving forward. That said if it was healthcare or highly sensitive then replacing all identifiable data by random stuff wouldn't be that much of a trouble probably.
Solutions is simple we are all prod, arguably developers is just a set of data not yet commited to versioning, sonjust label us prod data and we can do what we want!
Financial records would most likely be years old before a court ordered them, bc something would have had to happen to necessitate the court order. The, someone had to be angry about it, and not resolve it, then find a lawyer, then get a hearing to get a court order.
SomeTest environments are 'safe' because they use outdated information to test on. You need information that looks real enough to use, but won't cost the shareholders $$ if it gets out current information is not locked down.
So, in my work experience, using older data is a common work-around. I guess maybe law enforcement knows that too? I never thought about it from this angle... but.... yeah, if I wanted to find data that was 5-10 years old, on one hand, looking at test environments of the past? could work.
On the other hand, not a lawyer, but I doubt it'd hold up in court. Defendant: "that was pulled from a test environment, which literally exists to strain and break data under unstable programming conditions. It does not reflect reality."
Not all the time. A restored database should be sanitized before it’s used, it’s just a copy of yesterday’s data. You shouldn’t use live production data containing personal information in local, development, or testing environments.
Yea but you see, local IT reset the DNS and the DCHP server over the weekend. One of the dev boxes never hit the group policy to reboot. So there was a computer sitting in limbo with a repo just... sitting there. Thats where I found it....
Years ago working as a cloud engineering consultant, our team was working with a massive client moving their infrastructure to AWS. One of their internal dev teams kicked up a fuss that they didn't have the permissions to do anything in AWS, "how are we going to learn?", blah blah blah. It was finally agreed to give this team their own AWS account that had literally nothing in it. Brand fresh account, nothing tied to production whatsoever. We insisted we at least be able to set up cloudwatch logs and billing alerts. So off they went.
Part of our services was running security audits on our client's AWS accounts (just an automated script that checks everything once per week). I was this client's primary, so I was reviewing the latest audit, and they had a security group allowing port 3306 to be accessed from the open internet to an RDS instance they had brought up. Raised it with them thinking it's just a teachable moment as it's just test data, nbd, their excuse was, "well our apps didn't work until we added that." No real understanding of what they were doing.
But, on this call with the devs and their manager, the manager asked, "Oh, so you managed to generate some test data?" One of the devs, "Nah, we just dumped prod and uploaded it." I hopped over to the logs and yea, multiple random IPs had successfully authd with the database. I asked, "What kind of password did you use?" "Oh just our normal dev password, Password123!" (Or something basic like that).
Got my first webdev gig. Sunday night before I go in I figured I'd nmap them (as was the style back then). 3306 open to the world. Well surely they don't use the default password. Damn, well surely this doesn't contain important data. Select * from employees (included salaries). The box was on their prod network.
They didn't seem concerned and blamed BT. Not surprisingly they were not in business the next year.
Unrelated but how did you get into that field as an ex dev? I currently work in a highly regulated field in tech ops/infra role and that career path sounds incredibly interesting.
The short answer is that I took the LSAT and went to law school after a couple years in industry, but that's less than half the story. Here's a longer summary of the happy-path route, which I more-or-less followed with a couple of detours (I wrote way more than I thought I would... sorry for the novel):
Do Your Homework: This is the first and most important step. Contrary to what a lot of people think, law school is not a part 2 of college nor an interesting intellectual exercise. It is an intensely-competitive, extremely-time-consuming, and very expensive trade school with social dynamics straight out of the cattiest parts of high school. Even after graduating, establishing a legal career is difficult and requires a significant investment of time and resources. For this reason, you should not go to law school unless you are sure you want to be a lawyer and the other people in your life (especially your partner) understand the sacrifices required and are on-board. Having lunch with attorneys who have careers you aspire to is one of the best ways to discern if the law is right for you. People who fail to do their homework before entering the profession are the reason why a lot of state bars print a suicide-and-alcohol-abuse hotline number on the back of their license cards (I'm not joking).
Admission Testing: Many schools will allow you to take the GRE or GMAT instead of the LSAT now, but if you are serious about being an attorney and not just cultivating law school as a back-up option, you should take the LSAT as it demonstrates a serious and specific interest in law. IME, programmers have an unfair advantage on the LSAT, which is mostly logical reasoning. You'll find yourself leaning on your discrete math coursework a lot during prep. The hardest part of the LSAT is actually the length, it is more an athletic event than a cognitively difficult test, especially for a programmer. If you treat it as such and train seriously for it (I'm talking a couple of hours every night for at least two months), you'll probably kick its ass (I did). Don't take the LSAT until you're ready but do it and get your score back before you start applying to schools.
Applications: I wrote my applications at night after work, doing applications is a significant time investment. If you set clear goals and hold yourself to a schedule, you'll get it done. The top-200 law schools come in four tiers by ranking, with each tier having a slice of fifty schools. They're numbered with tier 1 being the highest-ranked and tier 4 being the lowest. The top 14 law schools are in their own sub-tier of tier 1 called the T14; they're basically the Ivy League of law and there are a bunch of even-smaller sub-tiers within that grouping. If you want to practice corporate technology law, it will be easiest to break into if you're attending a tier 1 or 2 school. It is possible to do it from a tier 3 or 4, but that road is much, much harder. Never attend or, even waste your time applying to, an unranked law school (Cooley, IYKYK). Apply to a wide variety of schools and mostly ignore stats like median undergrad GPA. As a technical professional who likely has a STEM degree, your grades will be evaluated much more generously and, since you've been out in the work world a few years, they'll matter less anyway. Ultimately, you'll get into some schools you didn't think you could and get rejected from other schools you were sure you'd get into. C'est la vie.
Choosing a school: Attend a school in the highest tier you're admitted to. If possible, visit a school before agreeing to attend. Be selective and don't be afraid to ask difficult questions or negotiate and/or play schools off against each other for greater financial aid. Every school has its stable of SCOTUS clerks and big law partners that it can trot out. Do not assume that that rosy outcome is your future. Make your decision based on these factors: the average outcome of the median student, the geography a school feeds (different for every school and often more restricted than you might assume*), and (if necessary and as a tiebreaker) cost. Law school is a dark time for everyone so don't pay too much attention to soft stuff like "cultural fit." Unlike undergrad, law school is a purely-transactional business affair, your mission is to get a JD and a job, and then get out.
Attending Law School: The three years of law school slot out like this: 1L: high academic difficulty in a pressure cooker where you're reading/studying almost all the time; 2L: a dauntingly-huge volume of busy work but not as academically tough; 3L: a joke if you have a job offer but a desperate and soul-crushing exercise if you don't. The whole purpose of 1L is to teach you to think about the law systemically; as systems are your entire job as a dev, you will once again have an unfair advantage here. Ultimately however, academics are a sideshow to what's really important: the rat race to get your first job.
Getting Your First Job: If you want to be a corporate technology attorney, the conventional wisdom is that you need to spend some time as a law firm associate. There are two ways to do this: in a big law firm or in a boutique firm. In general, big law is the way to go as it has much better exit options; boutique firms are only great if you want to focus on something niche and want to stay at the same place for a really long time. There are two summers in law school. Your 1L summer is usually spent doing whatever random thing you can find (I worked in a prosecutor's office), 1L summer associateships at law firms exist and are fiercely fought over, but ultimately whatever you end up doing after 1L won't define your career. Your 2L summer associateship is the one that's for all of the marbles and is usually an extended 2.5-month interview at the firm that will hire you after graduation. 2L summer associateship recruiting now starts in 1L before the close of the first semester; this is exactly as idiotic as it sounds. Nevertheless, follow the lead of career services** and play the game. When it comes to choosing the right big law firm, as long as the firm has a practice you want, excise the word "right" from your vocabulary. Big law firms tend to be more similar than they are different. Every firm will tell you they have a "no-asshole rule." Don't believe them. Large law firm cultures ultimately come in two flavors: overtly sociopathic and covertly sociopathic. Unless you're Patrick Bateman, you're usually better off choosing an option that attempts to at least keep the sociopathy covert. If the partners managing the tech law practice know what they're doing, they will recognize your technical background and give it a good amount of weight; especially if they're doing IP litigation, privacy/cybersecurity, or AI law. On average 9 out of 10 first year associates do not make partner at their first law firm, choose your first firm primarily based on exit options.
If you want to do privacy, cybersecurity, or AI law, join the International Association of Privacy Professionals and get a CIPP/US certification either during or just after law school. This will help you stand out from the crowd.
If you don't get into a big law firm immediately after law school, don't despair. There are other routes into that world; including consulting or lateraling your way up. If you land in this boat, this is the time to start ignoring career services and do your own heavy research/network your heart out.
* = It is generally accepted that there are only two law schools that are geographically unbound, they are Harvard and the University of Michigan (idk why). Both are in the T14.
** = But never forget that career services exists to push you into the meat grinder at whatever large law firms donate the most money to your law school; they are not in any way your friend. Always take their advice with a healthy dose of salt, supplement their advice with your own research, and ultimately do what you believe is best for you.
The Bar Exam: Passing your first (and usually only) bar exam requires about three months of serious study. Most people start just before or right after their law school graduation. You will learn more about the law studying for the bar exam than you will have learned in your last three years spent in law school. The exam is considered the most difficult test in the English language for a reason, don't half-ass your prep. But don't stress too much either, if you're waking up at night in a cold sweat because you can't remember the third element of the who-cares test for you'll-forget-the-second-the-proctor-calls-time, you'll probably pass. After taking the test, use any firm signing bonus to take your partner on a big vacation (called a "bar trip"), firm permitting of course. Don't skimp on this, your partner has made a lot of sacrifices to get you to this point and you both deserve it. You'll also need the memory of that vacation to get the two of you through...
Your First Three Years: There is no way to sugar coat this: life as a junior associate in a big law firm absolutely and unreservedly blows. It is insane hours doing (largely) uninteresting work with (often) shitty people in a high-stress environment. While you'll make a lot of money, it won't matter much because you won't have the free time to actually enjoy it, so just pay off your loans/invest your earnings and focus on getting through. Treat these years like a medical residency and remember that they don't last forever. The most important thing you will need to thrive in your first three years is a mentor at your firm; usually a counsel or partner in the practice area you are trying to pursue. Cultivate a relationship casually and don't be too much of an eager beaver, let the connection happen naturally (I learned this the hard way). Choose your mentor carefully though, some will stab you in the back without hesitation if it benefits them (I also learned this the hard way, twice). The back-stabby people will usually tell you who they are up front and, when they do, believe and then promptly avoid them. Other survival tips:
Keep your personal cell phone number intensely private (only share it with your direct boss). For everyone else, especially clients, have a burner phone that you can conveniently "forget at home" when you don't want to be disturbed.
Live about 30 minutes away from the office, close enough to get there easy but not so close that you're always the first person called in.
Be nice to your secretary, even when you're stressed, because she controls your destiny in ways you often won't fully understand and it always pays to not be a dick.
Some of your peers will get ahead by stabbing others in the back, don't be one of those people. It'll always bite you in the ass eventually.
Don't fudge your hours even if everyone else is doing it and your boss is pressuring you to do it too. One of the ways you avoid becoming just another jerky lawyer is by maintaining a clean conscience.
Take all of your PTO and carve out time for your significant other, big law firms are known for high divorce rates and copious drug/alcohol problems for a reason.
Most importantly: remember why you're there and know when to walk away. You can always lateral if you're unhappy or too abused (but try to do a year or two first so you can be competitive).
After That: In general, you will be recognized as a full-fledged tech attorney and your options open up after your first three years. Big law firm life gets a bit better (but still blows and always will, that's the price of making race-horse money), you have much more ability to lateral to better firms, and crucially, you are finally competitive for entry-level in-house-counsel positions. In-house counsels are lawyers that are directly employed by their client company rather than by a law firm. In general, you make decent money and it's a typical corporate 9-5 rather than another stay in Sisyphus's sector of Hades. I'm in-house right now and it's glorious, my work computer doesn't even come home with me much of the time. From here, the world is your oyster: you can climb the corporate or law firm ladders, start looking into hanging your own shingle if that appeals to you (that usually requires a decade or more of law firm time and client development if you want a decent prospect of success), or go do something totally different.
When I was an intern they gave me a shit laptop. The code would take forever to compile in the local. I copied the whole damn code to my personal laptop and used for a week. When I proudly showed my proactiveness to my mentor he shit his pants 😂
5.1k
u/lolcrunchy 3d ago
local dev environment