5 ms·

Like I said, none of that would have happened if Equifax had used very basic network safety principles. This has nothing to do with Java EE.

yogthos 9y ago
None of that would've happened if Struts didn't have remote code execution bugs in it either. My original point was precisely that there are many attack vectors, and a complex stack makes it nearly impossible to account for all of them.
- wglb 9y ago
  Name one that is immune. Clue: none are.
  - grzm 9y ago
    This kind of statement is the basis of a lot of false equivalence. You're right: there have been exploits found in many different types of systems. Is it easier for bugs to hide in complex systems? Are some systems more complex than others? I think it's pretty unconstriversial to say the answer to both of these are yes. I don't see your parent saying that this could only occur in this stack.
    - wglb 9y ago
      Ok, let's try from this angle? Are you familiar with Capability Maturity Model https://www.sei.cmu.edu/reports/93tr024.pdf https://www.sei.cmu.edu/reports/93tr024.pdf? Now we know how to build reliable software to fly airplanes and land men on the moon. The CMM level 5 is a pretty effective component of this. Now if you take the bottom 400 companies of the fortune 500, where do you think their public-facing web sites fare on the CMM scale? As another part of the exercise, what software that does anything remotely interesting is not complex?
      - grzm 9y ago
        Thanks for the link. I haven't read it, but from the name and the little I know about NASA software development practices, it's not clear to me at all that these are inconsistent. They're orthogonal, if anything. Are they not? Is there something in CMM that says that complex systems are not more difficult to understand (and therefore more likely to hide/contain bugs)? Where a particular set of companies falls on such a scale is also independent of this, isn't it? I feel like I'm missing something (which admittedly may be because I haven't read the linked PDF), so if you'd be willing to take the time to expound, I'd appreciate it.
        wglb 9y ago
        The point of the CMM is that it is a measure of an organization's capability to develop error free software. The trick is that it is a very time consuming, deliberate process. Not exactly agile. Read: vastly increases cost of developing software, certainly increases time to market.
        grzm 9y ago
        Thanks for the synopsis. Given what you've written here I don't see how that would be in opposition to what I've written above. A team could have a goal of writing simpler, composable code and use CMM to measure their capability against CMM criteria. Or am I misunderstanding?
        wglb 9y ago
        Without question. But CMM covers more than that--how requirements are gathered, reviewed, approved; who in the chain has the proper training and at what level. It much more than just coding. And how all of this is measured. So if the goal is writing simpler code, it is about how you would measure that.

yogthos 9y ago

None of that would've happened if Struts didn't have remote code execution bugs in it either. My original point was precisely that there are many attack vectors, and a complex stack makes it nearly impossible to account for all of them.

wglb 9y ago
Name one that is immune. Clue: none are.
- grzm 9y ago
  This kind of statement is the basis of a lot of false equivalence. You're right: there have been exploits found in many different types of systems. Is it easier for bugs to hide in complex systems? Are some systems more complex than others? I think it's pretty unconstriversial to say the answer to both of these are yes. I don't see your parent saying that this could only occur in this stack.
  - wglb 9y ago
    Ok, let's try from this angle? Are you familiar with Capability Maturity Model https://www.sei.cmu.edu/reports/93tr024.pdf https://www.sei.cmu.edu/reports/93tr024.pdf? Now we know how to build reliable software to fly airplanes and land men on the moon. The CMM level 5 is a pretty effective component of this. Now if you take the bottom 400 companies of the fortune 500, where do you think their public-facing web sites fare on the CMM scale? As another part of the exercise, what software that does anything remotely interesting is not complex?
    - grzm 9y ago
      Thanks for the link. I haven't read it, but from the name and the little I know about NASA software development practices, it's not clear to me at all that these are inconsistent. They're orthogonal, if anything. Are they not? Is there something in CMM that says that complex systems are not more difficult to understand (and therefore more likely to hide/contain bugs)? Where a particular set of companies falls on such a scale is also independent of this, isn't it? I feel like I'm missing something (which admittedly may be because I haven't read the linked PDF), so if you'd be willing to take the time to expound, I'd appreciate it.
      - wglb 9y ago
        The point of the CMM is that it is a measure of an organization's capability to develop error free software. The trick is that it is a very time consuming, deliberate process. Not exactly agile. Read: vastly increases cost of developing software, certainly increases time to market.
        grzm 9y ago
        Thanks for the synopsis. Given what you've written here I don't see how that would be in opposition to what I've written above. A team could have a goal of writing simpler, composable code and use CMM to measure their capability against CMM criteria. Or am I misunderstanding?
        wglb 9y ago
        Without question. But CMM covers more than that--how requirements are gathered, reviewed, approved; who in the chain has the proper training and at what level. It much more than just coding. And how all of this is measured. So if the goal is writing simpler code, it is about how you would measure that.