4 ms·

"I’m not unsympathetic to the needs of software developers." Yes she is. I read this as completely unrealistic expectations from the author. Struts is maintain

• grzm 9y ago
  > Struts is maintained by one person. I see nowhere in the op-ed piece where Tufekci mentions Struts or implies that she holds Struts responsible for this. She is clearly laying this at Equifax's feet, and their responsibility in their choice of software and the industry as a whole for actively pushing against better software practices and responsibility. The section you quoted is followed by: > Some number of unexpected errors — bugs — are unavoidable in computer programs. It would be unreasonable to allow a consumer to sue a software company every time a program suffered a glitch. She's laying out a much more nuanced argument than you're given her credit for. You're right in that this seems to be zero-day which are more difficult to defend against, but there are practices (among them, defense in depth, and pen tests) which can limit the attack surface. Also actively looking for known exploit types (rather than specific exploit instances). For example, buffer overflows are a known attack vector in C, so people harden their code against buffer overflows. Deserialization attacks are known in Java, so people harden their code against deserialization attacks. SQL injection attacks are a known exploit type, so people learn to parameterize their SQL queries. It's clear that this is something you care about and are passionate about. For topics that affect me like this, I consciously take a breath and re-read what I've reacted to, to see if my second (or third) read matches up with my first.
  • danjoc 9y ago
    She's blaming the software industry and software failure. That's Apache, and Struts. If she wanted to lay it on Equifax, she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music, https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... The people that actually "do" are Chief Peon of Cube Farms, doing whatever the boss with a music degree tells them is priority. >You're right in that this seems to be zero-day which are more difficult to defend against There's no nuance. It is under-reporting the facts to make her hit piece look stronger. It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success. >but there are practices Which don't help at all against a zero-day in a dependency.
    • grzm 9y ago
      > She's blaming the software industry and software failure. That's Apache, and Struts. I interpret her differently: > There are technical factors that explain why cybersecurity is so weak, but the underlying reason is political, and it’s pretty simple: Big corporations have poured large amounts of money into our political system, helping to create a regulatory environment in which consumers shoulder more and more of the risk, and companies less and less. > This is a general feature of our lopsided world, but software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. Information technology arrived on the scene only recently, so it has faced fewer of the kinds of regulations that consumers and citizens, in more progressive eras, managed to impose on other industries. To me, that reads as taking corporate interests and business motives to task, not software practices. Software development (like any other work) is a cost, and businesses need to balance those costs against business revenues. I'd argue who's chosen for C-level positions is a business decision, not a software practice one. If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree? Testing and quality control is expensive. If we can roll out a feature (or just continue business) spending as little as possible on testing and QA, it can certainly be an understandable decision (whether or not you agree) to do as little QA and testing as possible: you're not providing any new features (which may increase revenues): you're just increasing cost. > It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success. It's not clear to me which leadership you're referring to here. The government? The corporate leadership? Someone else? If the corporate leadership, I think that's entirely the point Tufekci is making.
      • danjoc 9y ago
        >software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity. TIL: No warranty == impunity. Nobody MADE Equifax use Struts. The source is open to inspection. The bug existed there for 8 years. Let's see how many audits Equifax did on the source code with no warranty. >If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree? If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. He'd find a different line of work. If he did write it, he would never release it for the world to use for free. Who would do that? "Here's this thing I worked on for over a decade. You can use it for free. Please sue me if you have any issues. Thanks."