4 ms·

IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.

by rapsey 8y ago

user5454 8y ago
While true in many cases, in my experience it's not only the engineers. Unless you have the senior managers on board as well, they'll just lean on the engineers to "ship now".
- rapsey 8y ago
  And those managers don't care either because their area is in electronics not software. IoT is electronics people coming into the software world and building software like it's the 90s.
varjag 8y ago
They are generally designed by electronic engineers and programmed by programmers. And most programmers don't care about security all that much.
- rapsey 8y ago
  > and programmed by programmers Not in my experience. But it's obviously not the same everywhere.
  - varjag 8y ago
    Maybe in garage projects, but there it can as well be in the opposite way. Would be really surprised to see it mixed in a corporate setup or with even smaller design contractors.
raverbashing 8y ago
While EEs are part to blame, the other half is just graduated (or "bootcamp graduated" - let's put it this way) developers that know all the node.js shortcuts but don't know about the fundamentals of internet security.
- icebraining 8y ago
  Not sure we can blame bootcamps - I learned nothing about internet security in my software engineering college course.
  - Double_a_92 8y ago
    But you probably knew that is was something to consider. And weren't told that you are basically a full fledged developer after a 3 month web dev course and after reading "cracking the coding interview". The Dunning–Kruger effect is heavily at work there.
    - pavel_lishin 8y ago
      I'm not the person you responded to, but not really. My college courses - admittedly as a Computer Science major, not Software Engineering - were laughably lacking any practical education. The closest we had was one group project, and we didn't even learn about things like version control. Security? Forget it. I've never gone to a bootcamp, but I'd wager that they at least mention security in their classes. College was the equivalent of the PHP documentation that had incredibly insecure examples that people "learned" from.
lnsru 8y ago
That’s wrong. An engineer has a couple managers above. Product, project, platform manager. You name it. Engineer is just another blue collar worker nowadays. No decision making power. I was not allowed to save company $40k, they told that numbers shouldn’t interest me. If management says, we need no encryption and authentifition, it’s totally ok. I just print their emails with this statement for later.
- est 8y ago
  > Product, project, platform manager you'd be surprised to learn how many pieces of code were designed, written and shipped by one man army.
- rapsey 8y ago
  Managers get their cues from engineers. Electronics companies obviously mostly have electronics engineers and they run the engineering side.
- dpark 8y ago
  Engineering is absolutely not blue collar, but this has nothing to do with the issue you’re facing. If you found an opportunity to save $40k and they said you shouldn’t care about numbers, then either you have poor management or there’s more to the story that you didn’t share. At the very least competent management should have been able to explain why saving the $40k was the wrong trade off.
  - lnsru 8y ago
    Yes, competent management. Didn’t experienced much companies having it. With competent management I could save my salary for couple years in this project alone. The client ist other branch of the same company. I could design a pcb with components for our needs, instead of that management wants to go with expensive 3rd party module having all bells and whistles on it. Edit: pcb design is risky. But the system is very primitive having voltage regulator and single integrated circuit in it. I doubt this department with current performance would survive as independent company.
- consp 8y ago
hatsunearu 8y ago
As an electronics engineer with a decent grasp on software as well... that hurts ;(

IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.

by rapsey 8y ago

IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.

user5454 8y ago

While true in many cases, in my experience it's not only the engineers. Unless you have the senior managers on board as well, they'll just lean on the engineers to "ship now".

rapsey 8y ago
And those managers don't care either because their area is in electronics not software. IoT is electronics people coming into the software world and building software like it's the 90s.

varjag 8y ago

They are generally designed by electronic engineers and programmed by programmers. And most programmers don't care about security all that much.

rapsey 8y ago
> and programmed by programmers Not in my experience. But it's obviously not the same everywhere.
- varjag 8y ago
  Maybe in garage projects, but there it can as well be in the opposite way. Would be really surprised to see it mixed in a corporate setup or with even smaller design contractors.

raverbashing 8y ago

While EEs are part to blame, the other half is just graduated (or "bootcamp graduated" - let's put it this way) developers that know all the node.js shortcuts but don't know about the fundamentals of internet security.

icebraining 8y ago
Not sure we can blame bootcamps - I learned nothing about internet security in my software engineering college course.
- Double_a_92 8y ago
  But you probably knew that is was something to consider. And weren't told that you are basically a full fledged developer after a 3 month web dev course and after reading "cracking the coding interview". The Dunning–Kruger effect is heavily at work there.
  - pavel_lishin 8y ago
    I'm not the person you responded to, but not really. My college courses - admittedly as a Computer Science major, not Software Engineering - were laughably lacking any practical education. The closest we had was one group project, and we didn't even learn about things like version control. Security? Forget it. I've never gone to a bootcamp, but I'd wager that they at least mention security in their classes. College was the equivalent of the PHP documentation that had incredibly insecure examples that people "learned" from.

lnsru 8y ago

That’s wrong. An engineer has a couple managers above. Product, project, platform manager. You name it. Engineer is just another blue collar worker nowadays. No decision making power. I was not allowed to save company $40k, they told that numbers shouldn’t interest me. If management says, we need no encryption and authentifition, it’s totally ok. I just print their emails with this statement for later.

est 8y ago
> Product, project, platform manager you'd be surprised to learn how many pieces of code were designed, written and shipped by one man army.
rapsey 8y ago
Managers get their cues from engineers. Electronics companies obviously mostly have electronics engineers and they run the engineering side.
dpark 8y ago
Engineering is absolutely not blue collar, but this has nothing to do with the issue you’re facing. If you found an opportunity to save $40k and they said you shouldn’t care about numbers, then either you have poor management or there’s more to the story that you didn’t share. At the very least competent management should have been able to explain why saving the $40k was the wrong trade off.
- lnsru 8y ago
  Yes, competent management. Didn’t experienced much companies having it. With competent management I could save my salary for couple years in this project alone. The client ist other branch of the same company. I could design a pcb with components for our needs, instead of that management wants to go with expensive 3rd party module having all bells and whistles on it. Edit: pcb design is risky. But the system is very primitive having voltage regulator and single integrated circuit in it. I doubt this department with current performance would survive as independent company.
consp 8y ago

hatsunearu 8y ago

As an electronics engineer with a decent grasp on software as well... that hurts ;(