6 ms·

Engineering needs to stop being subordinate to anything but top management (if at all). An MBA can always outrank an engineer's decision and that is a big reaso

Engineering needs to stop being subordinate to anything but top management (if at all). An MBA can always outrank an engineer's decision and that is a big reason why we have crap devices out in the field.

mnm1 10y ago
Without labor laws to back something like this up, all it does is get engineers fired. Non-software engineering fields do have such laws, I believe. An MBA cannot make a civil engineer build a bridge that is unsafe because they want to save money. After all, it's the project engineer's signature on the final work. (Please correct me if I'm wrong.) On the other hand, a large proportion of startups are doing something illegal or unethical and the only recourse for the engineer there is to quit or be fired. In some egregious cases, that may be worth it. Mostly, it's not. That's how our labor system is set up. I've always said, if you want to kill someone, start a corporation. It's the easiest way to get have someone else do it for you and get away with it. Anything less than murder in business is not even a consideration (unless the business gets punished which it most likely won't be).
- ComradeTaco 10y ago
  I am a structural EIT. Industry focus on safety is paramount. Seniority is very much respected so there are almost no young MBAs and they exist almost exclusively at the corporate level. Only a full engineer can legally stamp off on the final drawings and the accompanying calculations and I've never really seen a business type ever try to interfere in that.
  - LoSboccacc 10y ago
    Keyword: legally. Spftware is often built to the cheapest spec that'll sell. Even peacemaker are often carring vulnerabilities.
- nickpsecurity 10y ago
  Aerospace regulates software and hardware. Software standard is DO-178B. Thanks to it, the systems get great quality assurance. A common thing that emerged from that are partitioning RTOS's that separate critical and untrustworthy stuff. They also usually have trusted boot. The cheapest CPU I saw supporting those was a Freescale one for $4 a piece in quantities of 100 units. So, yeah, even in softwarw one can do as you suggest. Multiple times it's been done with things improving across the board. In DO-178B, an additional effect is an ecosystem of tooling, reusable components, and consultants sprang up to make each project a bit cheaper and less risky.
sillysaurus3 10y ago
It's simply difficult to secure devices. It's hard the same way engineering is hard. I know it's fashionable to blame the MBAs instead of blame ourselves, but at the end of it, we're the ones who write insecure code. And I don't think that if you give an engineer an extra week or two to focus on security that you'd end up with a measurably more secure device. Securing something is a different skillset from building it. Pentests are probably the answer.
- blacksmith_tb 10y ago
  Secure against a dedicated attacker, yes. But telnet listening on port 23 and a conistent default admin password on all your devices is really not that hard to improve on (and that's the sort of device that BrickerBot is killing).
  - sillysaurus3 10y ago
    Perhaps. But someone thought it was a good idea to put up a telnet port 23 default-admin-password interface. The point is, if you give that person two weeks to focus on securing the product, I'm not sure they would realize it's a bad idea to do that. People who are bad at security don't realize they're bad at security. Which is why it's probably important to bring in an outside team to break the product. Or to put it another way, if we're not proposing to bring in an outside team to conduct a pentest, what's the alternative?
    - eropple 10y ago
      I've done intentionally insecure things because I simply straight-up did not have time to do them correctly. Shared keys, shared password across an entire infra--lots of stupid things because my deadline wasn't moving and hours counted. The difference, of course, is that I retain control of my stuff and I'm not pushing things out to other people. Pentests are, to be clear, great, and there are plenty of people who Dunning-Kruger their way through security decisions. But time is definitely a factor in this stuff.
      - 10y ago
086421357909764 10y ago
I would argue, security needs to be a part of planning day 1 rather than looked at as a bolt on prior to involving upper management. It needs to be treated as a core functionality rather than an external concept. The biggest issue I see is we are patching and finding fixes for something that could easily be remedied if address before engineering takes place. Most firms i've worked with put it on the back burner or are stuck with the notion of i'm an engineer i'm smart so deal with it.
- JustSomeNobody 10y ago
  > I would argue, security needs to be a part of planning day 1 rather than looked at as a bolt on prior to involving upper management. Nothing I said implied bolting anything on prior to involving upper management. ANY decision at any time during the process can be overruled by any MBA. That needs to change.
ska 10y ago
Of course the other way around most often just gives you devices in the field nobody buys. In this, like most things, you need a balance. If you aren't commercially driven in some fundamental way you probably won't last long enough for any of this to make a difference. Of course if you apply that the wrong way, you end up with devices that suck and/or harm users. This way leads to regulation typically, since Smiths invisible and myopic hand usually acts too slowly for people to be convinced it will get to the right place, if we just wait long enough.
- jasonm23 10y ago
  > Smiths invisible and myopic hand I'm intrigued by this phrase, could you explain it please?
  - wtracy 10y ago
    https://en.m.wikipedia.org/wiki/Invisible_hand https://en.m.wikipedia.org/wiki/Invisible_hand Adam Smith used the phrase "invisible hand" to describe the way markets reward certain business ventures. The previous poster called the invisible hand "myopic" in reference to consumers being focused on cheap devices with features that immediately benefit themselves.
  - ska 10y ago
    I mean by this that in practice markets perform a sort of local optimization algorithm that can take a long time to discover better local maxima.
pfooti 10y ago
I don't disagree, but on the other hand, there's the question of what makes a "Good Engineer". There's plenty of fields where engineers (and other technical folk like architects or even, say, doctors) are certified by professional organizations. Those orgs can keep you from practicing your profession without their approval, and if you do something unethical they can pull your license to operate. The organizations also provide their membership with strong support to stand up to management against bad practices. On the one hand, this certainly makes a lot of sense, especially these days with so many stories about terrible engineering (either just bad or as a result of unethical behavior) causing real harm. On the other hand, it's precisely organizations like this (effectively guilds or unions) that tech "leaders" try to disrupt. They tend to be pretty conservative.
rdiddly 10y ago
On the other hand, if you let the engineers run the shop, you might end up with another Juicero... an exquisitely designed product with few customers.
- deleted 10y ago
  [deleted]
- JustSomeNobody 10y ago
  Quite possible. Not sure why that should negate anything I said. It is quite obvious that products like the Juicero are easily developed with MBAs at the helm. If engineers run the shop you might even end up with another Uber. And we all know what a disaster that is. However, at some level, MBAs and engineering need to be on level terms. If there's a conflict it can be resolved by going higher up the chain and both sides have the opportunity to make their case.
na85 10y ago
Yes, no engineer has ever made a bad design or decision, ever.
- jacquesm 10y ago
  That's totally besides the point. The idea here is that no engineer would knowingly sign off on something bad.
  - jsmthrowaway 10y ago
    A rather optimistic idea, I'd contend.
    - 086421357909764 10y ago
      I concur, in fact, how many IT professionals make bad SECURITY decisions because they in fact are trained to build and maintain an working infrastructure first and foremost.
  - na85 10y ago
    Which is a silly assertion
- flukus 10y ago
  Perfect is the enemy of good.
- JustSomeNobody 10y ago
  Nothing I said implies engineers don't make bad decisions. What I implied is even the GOOD decisions can be overruled by any MBA at any time.
flukus 10y ago
Is it that simple? Having veto over certain decisions might solve some vectors, but security isn't an item to check off before you release a product, it's an ongoing maintenance concern because it's living in an ever evolving ecosystem. Being able to put your foot down doesn't allocate resources for security updates.

mnm1 10y ago

Without labor laws to back something like this up, all it does is get engineers fired. Non-software engineering fields do have such laws, I believe. An MBA cannot make a civil engineer build a bridge that is unsafe because they want to save money. After all, it's the project engineer's signature on the final work. (Please correct me if I'm wrong.) On the other hand, a large proportion of startups are doing something illegal or unethical and the only recourse for the engineer there is to quit or be fired. In some egregious cases, that may be worth it. Mostly, it's not. That's how our labor system is set up. I've always said, if you want to kill someone, start a corporation. It's the easiest way to get have someone else do it for you and get away with it. Anything less than murder in business is not even a consideration (unless the business gets punished which it most likely won't be).

ComradeTaco 10y ago
I am a structural EIT. Industry focus on safety is paramount. Seniority is very much respected so there are almost no young MBAs and they exist almost exclusively at the corporate level. Only a full engineer can legally stamp off on the final drawings and the accompanying calculations and I've never really seen a business type ever try to interfere in that.
- LoSboccacc 10y ago
  Keyword: legally. Spftware is often built to the cheapest spec that'll sell. Even peacemaker are often carring vulnerabilities.
nickpsecurity 10y ago
Aerospace regulates software and hardware. Software standard is DO-178B. Thanks to it, the systems get great quality assurance. A common thing that emerged from that are partitioning RTOS's that separate critical and untrustworthy stuff. They also usually have trusted boot. The cheapest CPU I saw supporting those was a Freescale one for $4 a piece in quantities of 100 units. So, yeah, even in softwarw one can do as you suggest. Multiple times it's been done with things improving across the board. In DO-178B, an additional effect is an ecosystem of tooling, reusable components, and consultants sprang up to make each project a bit cheaper and less risky.

sillysaurus3 10y ago

It's simply difficult to secure devices. It's hard the same way engineering is hard. I know it's fashionable to blame the MBAs instead of blame ourselves, but at the end of it, we're the ones who write insecure code. And I don't think that if you give an engineer an extra week or two to focus on security that you'd end up with a measurably more secure device. Securing something is a different skillset from building it. Pentests are probably the answer.

blacksmith_tb 10y ago
Secure against a dedicated attacker, yes. But telnet listening on port 23 and a conistent default admin password on all your devices is really not that hard to improve on (and that's the sort of device that BrickerBot is killing).
- sillysaurus3 10y ago
  Perhaps. But someone thought it was a good idea to put up a telnet port 23 default-admin-password interface. The point is, if you give that person two weeks to focus on securing the product, I'm not sure they would realize it's a bad idea to do that. People who are bad at security don't realize they're bad at security. Which is why it's probably important to bring in an outside team to break the product. Or to put it another way, if we're not proposing to bring in an outside team to conduct a pentest, what's the alternative?
  - eropple 10y ago
    I've done intentionally insecure things because I simply straight-up did not have time to do them correctly. Shared keys, shared password across an entire infra--lots of stupid things because my deadline wasn't moving and hours counted. The difference, of course, is that I retain control of my stuff and I'm not pushing things out to other people. Pentests are, to be clear, great, and there are plenty of people who Dunning-Kruger their way through security decisions. But time is definitely a factor in this stuff.
    - 10y ago

086421357909764 10y ago

I would argue, security needs to be a part of planning day 1 rather than looked at as a bolt on prior to involving upper management. It needs to be treated as a core functionality rather than an external concept. The biggest issue I see is we are patching and finding fixes for something that could easily be remedied if address before engineering takes place. Most firms i've worked with put it on the back burner or are stuck with the notion of i'm an engineer i'm smart so deal with it.

JustSomeNobody 10y ago
> I would argue, security needs to be a part of planning day 1 rather than looked at as a bolt on prior to involving upper management. Nothing I said implied bolting anything on prior to involving upper management. ANY decision at any time during the process can be overruled by any MBA. That needs to change.

ska 10y ago

Of course the other way around most often just gives you devices in the field nobody buys. In this, like most things, you need a balance. If you aren't commercially driven in some fundamental way you probably won't last long enough for any of this to make a difference. Of course if you apply that the wrong way, you end up with devices that suck and/or harm users. This way leads to regulation typically, since Smiths invisible and myopic hand usually acts too slowly for people to be convinced it will get to the right place, if we just wait long enough.

jasonm23 10y ago
> Smiths invisible and myopic hand I'm intrigued by this phrase, could you explain it please?
- wtracy 10y ago
  https://en.m.wikipedia.org/wiki/Invisible_hand https://en.m.wikipedia.org/wiki/Invisible_hand Adam Smith used the phrase "invisible hand" to describe the way markets reward certain business ventures. The previous poster called the invisible hand "myopic" in reference to consumers being focused on cheap devices with features that immediately benefit themselves.
- ska 10y ago
  I mean by this that in practice markets perform a sort of local optimization algorithm that can take a long time to discover better local maxima.

pfooti 10y ago

I don't disagree, but on the other hand, there's the question of what makes a "Good Engineer". There's plenty of fields where engineers (and other technical folk like architects or even, say, doctors) are certified by professional organizations. Those orgs can keep you from practicing your profession without their approval, and if you do something unethical they can pull your license to operate. The organizations also provide their membership with strong support to stand up to management against bad practices. On the one hand, this certainly makes a lot of sense, especially these days with so many stories about terrible engineering (either just bad or as a result of unethical behavior) causing real harm. On the other hand, it's precisely organizations like this (effectively guilds or unions) that tech "leaders" try to disrupt. They tend to be pretty conservative.

rdiddly 10y ago

On the other hand, if you let the engineers run the shop, you might end up with another Juicero... an exquisitely designed product with few customers.

deleted 10y ago
[deleted]
JustSomeNobody 10y ago
Quite possible. Not sure why that should negate anything I said. It is quite obvious that products like the Juicero are easily developed with MBAs at the helm. If engineers run the shop you might even end up with another Uber. And we all know what a disaster that is. However, at some level, MBAs and engineering need to be on level terms. If there's a conflict it can be resolved by going higher up the chain and both sides have the opportunity to make their case.

na85 10y ago

Yes, no engineer has ever made a bad design or decision, ever.

jacquesm 10y ago
That's totally besides the point. The idea here is that no engineer would knowingly sign off on something bad.
- jsmthrowaway 10y ago
  A rather optimistic idea, I'd contend.
  - 086421357909764 10y ago
    I concur, in fact, how many IT professionals make bad SECURITY decisions because they in fact are trained to build and maintain an working infrastructure first and foremost.
- na85 10y ago
  Which is a silly assertion
flukus 10y ago
Perfect is the enemy of good.
JustSomeNobody 10y ago
Nothing I said implies engineers don't make bad decisions. What I implied is even the GOOD decisions can be overruled by any MBA at any time.

flukus 10y ago

Is it that simple? Having veto over certain decisions might solve some vectors, but security isn't an item to check off before you release a product, it's an ongoing maintenance concern because it's living in an ever evolving ecosystem. Being able to put your foot down doesn't allocate resources for security updates.