5 ms·

First off, putting a negative spin to competition already tells me you have either a very narrow view or see something I dont. When iojs forked from nodejs, it

First off, putting a negative spin to competition already tells me you have either a very narrow view or see something I dont. When iojs forked from nodejs, it was a competitor. Linux is a competitive landscape. Browsers are a competitive landscape. The idea that cooperation and consistancy leads to the best possible product is only as accurate as who is trusted to be the leader. There are some pretty dumb leaders out there but convincing enough to be trusted with millions of dollars. Second off, the government didnt force all devices to be vulnerable. "Agile" development practices which we trust so much are what led us here. Build first, worry about security later. The fact that a persons information is valuable to the creator of these devices and they provide a direct gateway so they could be accessed by a third party. And the fact that consumers ignore any possible issues that may arise because they see the benefits. You talk about logic, well logically we wouldnt have computers or any of this if it wasnt for competition abd the desire to evolve. And logically trust and freedom allowed these vulnerabilities to ho unchecked because the software is not open source and companies are free to do whatever they want since its up to the consumer to judge whether its worth it or not. I understand why you want to make this political and pro-love because arguably any problem can be answered by pro-love. But logically, you should think before you dpeak and attempt to frame your argument with a consistant locigal tree than start blaring out hatred for the capitalist system

mhurron 10y ago
> "Agile" development practices which we trust so much are what led us here. Build first, worry about security later Hardly. It's not like everyone stopped caring about security once they moved to Agile flows. The industry never cared about security. This last attack on Dyn appears to be Mirai again, so devices with unchangeable default username/password combinations. The same poor practices that have existed since there were engineering practices at all.
- bogomipz 10y ago
  >"This last attack on Dyn appears to be Mirai again, so devices with unchangeable default username/password combinations" The credentials can't be changed on these? Ouch. I didn't know this. Has Mira released any kind of firmware upgrades for their set top boxes and IP cameras?
  - mhurron 10y ago
    Many, if not most, can not. Sometimes even if the user thinks they have. https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/ https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powe... 'That’s because while many of these devices allow users to change the default usernames and passwords on a Web-based administration panel that ships with the products, those machines can still be reached via more obscure, less user-friendly communications services called “Telnet” and “SSH.” ... “The issue with these particular devices is that a user cannot feasibly change this password,” Flashpoint’s Zach Wikholm told KrebsOnSecurity. “The password is hardcoded into the firmware, and the tools necessary to disable it are not present. Even worse, the web interface is not aware that these credentials even exist.”'
Hydraulix989 10y ago
It's not just Agile, it's competitive enterprises at work. Ship a product now (before your competitor), get EMA; or spend many extra months pentesting and laboriously auditing your code OpenBSD-style. It's much easier to win the market first and then go on PR damage control the next time there's a security incident, pointing the blame on those "evil hackers" while your software has more holes than Swiss cheese. Meanwhile, as an engineer, it's much easier to appease upper management and meet your deadlines (set artificially close by people who don't understand the development process) by writing unsecure code, shipping, and then if something happens, talking your way out of said responsibility. Meanwhile, you're stressed out because of how impossibly unrealistic the deadlines are, and so you're making more mistakes; maybe you're also running off solely caffeine and three hours of sleep the night before while on the trajectory towards burn-out because you're putting in so many hours.
- SturgeonsLaw 10y ago
  > Ship a product now (before your competitor), get EMA; or spend many extra months pentesting and laboriously auditing your code OpenBSD-style. Somewhere in there is a middle ground that doesn't involve hardcoded backdoors

mhurron 10y ago

> "Agile" development practices which we trust so much are what led us here. Build first, worry about security later Hardly. It's not like everyone stopped caring about security once they moved to Agile flows. The industry never cared about security. This last attack on Dyn appears to be Mirai again, so devices with unchangeable default username/password combinations. The same poor practices that have existed since there were engineering practices at all.

bogomipz 10y ago
>"This last attack on Dyn appears to be Mirai again, so devices with unchangeable default username/password combinations" The credentials can't be changed on these? Ouch. I didn't know this. Has Mira released any kind of firmware upgrades for their set top boxes and IP cameras?
- mhurron 10y ago
  Many, if not most, can not. Sometimes even if the user thinks they have. https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/ https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powe... 'That’s because while many of these devices allow users to change the default usernames and passwords on a Web-based administration panel that ships with the products, those machines can still be reached via more obscure, less user-friendly communications services called “Telnet” and “SSH.” ... “The issue with these particular devices is that a user cannot feasibly change this password,” Flashpoint’s Zach Wikholm told KrebsOnSecurity. “The password is hardcoded into the firmware, and the tools necessary to disable it are not present. Even worse, the web interface is not aware that these credentials even exist.”'

Hydraulix989 10y ago

It's not just Agile, it's competitive enterprises at work. Ship a product now (before your competitor), get EMA; or spend many extra months pentesting and laboriously auditing your code OpenBSD-style. It's much easier to win the market first and then go on PR damage control the next time there's a security incident, pointing the blame on those "evil hackers" while your software has more holes than Swiss cheese. Meanwhile, as an engineer, it's much easier to appease upper management and meet your deadlines (set artificially close by people who don't understand the development process) by writing unsecure code, shipping, and then if something happens, talking your way out of said responsibility. Meanwhile, you're stressed out because of how impossibly unrealistic the deadlines are, and so you're making more mistakes; maybe you're also running off solely caffeine and three hours of sleep the night before while on the trajectory towards burn-out because you're putting in so many hours.

SturgeonsLaw 10y ago
> Ship a product now (before your competitor), get EMA; or spend many extra months pentesting and laboriously auditing your code OpenBSD-style. Somewhere in there is a middle ground that doesn't involve hardcoded backdoors