5 ms·

Nothing I've worked on has been nearly to this scale, but having management understand and ignore warnings is commonplace. Just today, I pointed out that a bac

Nothing I've worked on has been nearly to this scale, but having management understand and ignore warnings is commonplace. Just today, I pointed out that a backend web service system for an important (HR) function was so insecure that simply putting a single quote in an end-user input field would crash it, and that a SQL injection would be trivial. After a little arguing from them ("You don't know what a SQL injection is") they changed their tune to "Just put a limit on the frontend", and when I told them that could be trivially bypassed, they said "No one will ever think to try that." When I pressed further, they continued to "It's an internal app, no one would attack it" then to "And do you want me to put locks on all the doors and cabinets around the office too?" So that's a case where there's some reasonable level of understanding and just a refusal to act. I also recall a time (at a different company) when I discovered a public read/write anonymous FTP server setup externally facing with no firewall rules. When I pointed out the problem, they said, "that's what our customers are used to, we're not going to change it." and when I pushed, "No one will ever find it anyways." Literally less than a month later that server was overrun with illicit content. It happens. Unfortunately, as we've seen with the Volkswagen debacle as well, it happens even when regulation or (in the Challenger case) human life is on the line.

chapium 11y ago
Honestly, if its concerning personal data held by hr I would expect locks on the cabinets. At most places you cannot sneeze in HR without running into security.
heywire 11y ago
They'll pay attention when someone emails them their own salary information. I'm kidding, that would be career suicide. Printing it out and leaving it on the printer would be much better.
- jayhuang 11y ago
  That's of course, assuming that there isn't a record of who is printing what. Which would probably be a dangerous assumption.
  - JustSomeNobody 11y ago
    This is why one should always lock his computer if he's going to be away from it. (Someone may sneak and print something from it while you're not looking).
    - tokai 11y ago
      Or why you should never lock your computer, so you can claim that you have been used as you print away.
SilasX 11y ago
You and I have different definitions of "understanding". I would not count them as understanding the dangers that a mischievous person could do.
pault 11y ago
People born after the 1970s may not be aware of the Teton Dam collapse, but it was another case of total disregard for many, many expert warnings of disaster in the rush to build something big and impressive. Here's kind of a cheesy documentary clip describing the incident [1], but the book Cadillac Desert [2] goes into some detail if you're curious. [1] https://www.youtube.com/watch?v=cdOGPBnfoKE https://www.youtube.com/watch?v=cdOGPBnfoKE [2] http://www.amazon.com/Cadillac-Desert-American-Disappearing-Revised/dp/0140178244 http://www.amazon.com/Cadillac-Desert-American-Disappearing-...
- ArkyBeagle 11y ago
  FWIW, there is a four-hour PBS style documentary based on the book. This book is the most prescient thing about the biggest issue ( multiply prescience by the size of the issue and it sorts to the top ) I probably will ever read. https://en.wikipedia.org/wiki/Cadillac_Desert_%28film%29 https://en.wikipedia.org/wiki/Cadillac_Desert_%28film%29
sillysaurus3 11y ago
They possibly felt that you were suggesting it was a lot of work to fix this, when in reality it would take a couple of hours to add sanitization checks to the inputs. You're also overestimating the business impact of a security breach. This is an area where people's moral compass overrides their shrewdness. Notice that Anthem is still in business despite the worst possible breach, for example. It's worth trying to improve security, if possible. But it takes one of two things: (a) leverage, or (b) patience. One of the main reasons that companies get a security audit is because a different company forces them to. They get an audit in order to obtain a CFD (client facing document) saying that they are secure. Without this, the other company will not do business with them, which is the sole reason why the security audit happens. The other way -- patiently pointing out ways of improving the situation, and explaining the business merits of allocating time to this pursuit -- does not usually result in meaningful security improvements. This is an unfortunate fact of the industry, partly because security breaches do not usually put a company out of business. There are exceptions to this, but that is the common case.
- steven777400 11y ago
  To be fair, it would be a lot of work to fix the backend. The SQL is dynamically generated for every request, and the code that does so is thousands of lines long, with nested subroutines that construct sub-portions of the query, so there is no easy way to check where things need to be parameterized. Also there is some injection from unusual places (like a search options object separate from the search criteria object which includes the ASC/DESC which, you guessed it, is directly injected). Realistically, to be safe, you'd have to gut the whole thing and replace it. You can be a "little safe" by doing something silly like replacing ' with '' but that doesn't protect in non-string cases, etc, and I wouldn't propose a solution like that because it could give a false sense of security. I understand the push-back. The backend is maintained by others and it would add to their workload to secure it. That's a real and actual cost. As for the business impact, you are right. I just wanted it to be "on the table" that I informed people of the situation, so that if there is an exploit in the future, I don't get the "why didn't you tell anyone this was vulnerable?" or something like that.
  - 11y ago
gist 11y ago
> Nothing I've worked on has been nearly to this scale, but having management understand and ignore warnings is commonplace. So you are implying that every warning issued management ends up resulting in a failure of medium, large or catastrophic proportions? There is no data available almost certainly on warnings issued where nothing has happened.
- steven777400 11y ago
  No. I'm disclaiming that although I've never worked on anything where lives are on the line, in my experience, having management ignore, yet understanding, warnings is commonplace. I then cited two anecdotes where warnings had been given. In one case, a breach followed, in the other, so far it has not. I would assume most warnings that are ignored turn out to be non-issues.
tokai 11y ago
«And do you want me to put locks on all the doors and cabinets around the office too?"» Every place I've worked have had that. I would have answered yes.
ArkyBeagle 11y ago
The more I think about the Volkswagen debacle, the more I realize that it's an artifact of "nothing you do or say is guaranteed to be private forever." This could have a huge chilling effect.
- bitJericho 11y ago
  Having been taken to court I can tell you this is completely true in all facets of life with anybody you interact with. It's dangerous to even joke about misdeeds. Always act with the utmost virtuousness lest it may come back at you someday. And yeah that has cost me.
  - ArkyBeagle 11y ago
    I am told that China very nearly had an Industrial Revolution but that the Mandarins - whose credo was "that which is not required is forbidden, and that which is not forbidden is required" took over and it stopped. China became frozen in amber, so to speak.
    - bitJericho 11y ago
      I'm not saying you cant break or bend the rules. Just don't advertise it and do it for the right reasons!

chapium 11y ago

Honestly, if its concerning personal data held by hr I would expect locks on the cabinets. At most places you cannot sneeze in HR without running into security.

heywire 11y ago

They'll pay attention when someone emails them their own salary information. I'm kidding, that would be career suicide. Printing it out and leaving it on the printer would be much better.

jayhuang 11y ago
That's of course, assuming that there isn't a record of who is printing what. Which would probably be a dangerous assumption.
- JustSomeNobody 11y ago
  This is why one should always lock his computer if he's going to be away from it. (Someone may sneak and print something from it while you're not looking).
  - tokai 11y ago
    Or why you should never lock your computer, so you can claim that you have been used as you print away.

SilasX 11y ago

You and I have different definitions of "understanding". I would not count them as understanding the dangers that a mischievous person could do.

pault 11y ago

People born after the 1970s may not be aware of the Teton Dam collapse, but it was another case of total disregard for many, many expert warnings of disaster in the rush to build something big and impressive. Here's kind of a cheesy documentary clip describing the incident [1], but the book Cadillac Desert [2] goes into some detail if you're curious. [1] https://www.youtube.com/watch?v=cdOGPBnfoKE https://www.youtube.com/watch?v=cdOGPBnfoKE [2] http://www.amazon.com/Cadillac-Desert-American-Disappearing-Revised/dp/0140178244 http://www.amazon.com/Cadillac-Desert-American-Disappearing-...

ArkyBeagle 11y ago
FWIW, there is a four-hour PBS style documentary based on the book. This book is the most prescient thing about the biggest issue ( multiply prescience by the size of the issue and it sorts to the top ) I probably will ever read. https://en.wikipedia.org/wiki/Cadillac_Desert_%28film%29 https://en.wikipedia.org/wiki/Cadillac_Desert_%28film%29

sillysaurus3 11y ago

They possibly felt that you were suggesting it was a lot of work to fix this, when in reality it would take a couple of hours to add sanitization checks to the inputs. You're also overestimating the business impact of a security breach. This is an area where people's moral compass overrides their shrewdness. Notice that Anthem is still in business despite the worst possible breach, for example. It's worth trying to improve security, if possible. But it takes one of two things: (a) leverage, or (b) patience. One of the main reasons that companies get a security audit is because a different company forces them to. They get an audit in order to obtain a CFD (client facing document) saying that they are secure. Without this, the other company will not do business with them, which is the sole reason why the security audit happens. The other way -- patiently pointing out ways of improving the situation, and explaining the business merits of allocating time to this pursuit -- does not usually result in meaningful security improvements. This is an unfortunate fact of the industry, partly because security breaches do not usually put a company out of business. There are exceptions to this, but that is the common case.

steven777400 11y ago
To be fair, it would be a lot of work to fix the backend. The SQL is dynamically generated for every request, and the code that does so is thousands of lines long, with nested subroutines that construct sub-portions of the query, so there is no easy way to check where things need to be parameterized. Also there is some injection from unusual places (like a search options object separate from the search criteria object which includes the ASC/DESC which, you guessed it, is directly injected). Realistically, to be safe, you'd have to gut the whole thing and replace it. You can be a "little safe" by doing something silly like replacing ' with '' but that doesn't protect in non-string cases, etc, and I wouldn't propose a solution like that because it could give a false sense of security. I understand the push-back. The backend is maintained by others and it would add to their workload to secure it. That's a real and actual cost. As for the business impact, you are right. I just wanted it to be "on the table" that I informed people of the situation, so that if there is an exploit in the future, I don't get the "why didn't you tell anyone this was vulnerable?" or something like that.
- 11y ago

gist 11y ago

> Nothing I've worked on has been nearly to this scale, but having management understand and ignore warnings is commonplace. So you are implying that every warning issued management ends up resulting in a failure of medium, large or catastrophic proportions? There is no data available almost certainly on warnings issued where nothing has happened.

steven777400 11y ago
No. I'm disclaiming that although I've never worked on anything where lives are on the line, in my experience, having management ignore, yet understanding, warnings is commonplace. I then cited two anecdotes where warnings had been given. In one case, a breach followed, in the other, so far it has not. I would assume most warnings that are ignored turn out to be non-issues.

tokai 11y ago

«And do you want me to put locks on all the doors and cabinets around the office too?"» Every place I've worked have had that. I would have answered yes.

ArkyBeagle 11y ago

The more I think about the Volkswagen debacle, the more I realize that it's an artifact of "nothing you do or say is guaranteed to be private forever." This could have a huge chilling effect.

bitJericho 11y ago
Having been taken to court I can tell you this is completely true in all facets of life with anybody you interact with. It's dangerous to even joke about misdeeds. Always act with the utmost virtuousness lest it may come back at you someday. And yeah that has cost me.
- ArkyBeagle 11y ago
  I am told that China very nearly had an Industrial Revolution but that the Mandarins - whose credo was "that which is not required is forbidden, and that which is not forbidden is required" took over and it stopped. China became frozen in amber, so to speak.
  - bitJericho 11y ago
    I'm not saying you cant break or bend the rules. Just don't advertise it and do it for the right reasons!