4 ms·

This. Leaving databases exposed to the net. Leaving S3 buckets open to the public. All of these sorts of things needs to carry punishments not for the people w

by geggam 8y ago

This. Leaving databases exposed to the net. Leaving S3 buckets open to the public. All of these sorts of things needs to carry punishments not for the people who are told to set the stuff up. It needs punishment for the management who doesnt allow time to set things up properly

bdcravens 8y ago
> It needs punishment for the management who doesnt allow time to set things up properly Hard to show it was management's fault, and not the result of a developer who really didn't have the AWS skills (though that's probably still the fault of management, for not verifying skillsets before hiring or giving AWS keys) Everything we know about iteration cycles, quick access to devops resources, etc, will change when prison time becomes an option.
- torstenvl 8y ago
  > Hard to show it was management's fault, and not the result of a developer... No. A leader is ultimately responsible for everything that happens or fails to happen under his or her leadership. Full stop. The people in charge of your hypothetical developer are the only ones with the ability to put processes in place to prevent it from happening. They are the least-cost avoider. Therefore, the power and the responsibility belong there. Strict liability for the least-cost avoider is a sound strategy from both a moral perspective and a law & economics perspective. When proving knowledge and proximate cause are difficult, and someone is clearly in charge, and the harm is great - you place the liability on the people in charge whenever something goes wrong, and be done with it.
  - bdcravens 8y ago
    As a member of upper management, how would you address this then? More QA? More management of development practices? Move way from "devops" and back toward a world where there's a clear isolation between ops and development? Over the past few years, developers have seen more and more autonomy and power. I can't imagine there's a way to avoid walking some of that back (if it can be)
    - TeMPOraL 8y ago
      > As a member of upper management, how would you address this then? By specifying what is and what isn't allowed wrt. user data in products. By ensuring it gets included in new employee training, and communicating that exposing the company to data-related risks is a serious, fireable offense. By having internal checks and audits that monitor data risk and keep it low. I.e. basically the same things you'd address risk of financial malfeasance. > Move way from "devops" and back toward a world where there's a clear isolation between ops and development? It's not really about "devops" vs. dev/ops separation - it's about not moving fast and breaking other people's things. You can solve that with good professional practices, but there needs to be an incentive to adopt them (as opposed to the existing incentives to ignore them, in pursue of short-term profit).
usaphp 8y ago
Say you have a medical office, and you installed a cheap door lock which most burglars can easily crack, then a burglar breaks into your office, steals Ssn and other private info, should the doctor who runs the office go to prison for that?
- yladiz 8y ago
  That's not equivalent. The equivalent would be the database or S3 bucket having a low quality password like "password".
- deleted 8y ago
  [deleted]
- bluntfang 8y ago
  are you saying leaving open filesystems and databases is the same as using a cheap lock?
- dec0dedab0de 8y ago
  I think it would be reasonable to have a law that says you need to have X level of security for certain information. Then it would be criminal to provide less than that level of security, especially just to save money. I just think it would have to somehow have exemptions for honest mistakes, and clever attackers.
  - Nasrudith 8y ago
    The problem with that is the devil is in the details and it fails to account for changes properly in technology and excludes far better alternatives. Say for instance there is a requirement that there must be DES encryption of passwords. That would be a downright terrible law on several levels - first of which is that the best way to secure passwords is not keeping them in the first place but a hash. The encryption standard is as laughable now as requiring banks lock their vaults with a simple warded lock - the kind where skeleton keys work because shaving the teeth from the key means it no longer has anything to catch on while it turns the lock.
- 8y ago
striking 8y ago
If management asks you to cut corners to ship the app, ask them to put it in writing. There's nothing wrong with iterating quickly, but developers are responsible for making sure their systems are secure and resisting shipping applications that aren't. It is a developer's responsibility to push back on shipping broken software. If they're forced to, they need to make sure there's a paper trail that shows that. Otherwise it's indistinguishable from a developer just having done a bad job of their own accord.
- geggam 8y ago
  See developer get RIF'd

by geggam 8y ago

bdcravens 8y ago

> It needs punishment for the management who doesnt allow time to set things up properly Hard to show it was management's fault, and not the result of a developer who really didn't have the AWS skills (though that's probably still the fault of management, for not verifying skillsets before hiring or giving AWS keys) Everything we know about iteration cycles, quick access to devops resources, etc, will change when prison time becomes an option.

torstenvl 8y ago
> Hard to show it was management's fault, and not the result of a developer... No. A leader is ultimately responsible for everything that happens or fails to happen under his or her leadership. Full stop. The people in charge of your hypothetical developer are the only ones with the ability to put processes in place to prevent it from happening. They are the least-cost avoider. Therefore, the power and the responsibility belong there. Strict liability for the least-cost avoider is a sound strategy from both a moral perspective and a law & economics perspective. When proving knowledge and proximate cause are difficult, and someone is clearly in charge, and the harm is great - you place the liability on the people in charge whenever something goes wrong, and be done with it.
- bdcravens 8y ago
  As a member of upper management, how would you address this then? More QA? More management of development practices? Move way from "devops" and back toward a world where there's a clear isolation between ops and development? Over the past few years, developers have seen more and more autonomy and power. I can't imagine there's a way to avoid walking some of that back (if it can be)
  - TeMPOraL 8y ago
    > As a member of upper management, how would you address this then? By specifying what is and what isn't allowed wrt. user data in products. By ensuring it gets included in new employee training, and communicating that exposing the company to data-related risks is a serious, fireable offense. By having internal checks and audits that monitor data risk and keep it low. I.e. basically the same things you'd address risk of financial malfeasance. > Move way from "devops" and back toward a world where there's a clear isolation between ops and development? It's not really about "devops" vs. dev/ops separation - it's about not moving fast and breaking other people's things. You can solve that with good professional practices, but there needs to be an incentive to adopt them (as opposed to the existing incentives to ignore them, in pursue of short-term profit).

usaphp 8y ago

Say you have a medical office, and you installed a cheap door lock which most burglars can easily crack, then a burglar breaks into your office, steals Ssn and other private info, should the doctor who runs the office go to prison for that?

yladiz 8y ago
That's not equivalent. The equivalent would be the database or S3 bucket having a low quality password like "password".
deleted 8y ago
[deleted]
bluntfang 8y ago
are you saying leaving open filesystems and databases is the same as using a cheap lock?
dec0dedab0de 8y ago
I think it would be reasonable to have a law that says you need to have X level of security for certain information. Then it would be criminal to provide less than that level of security, especially just to save money. I just think it would have to somehow have exemptions for honest mistakes, and clever attackers.
- Nasrudith 8y ago
  The problem with that is the devil is in the details and it fails to account for changes properly in technology and excludes far better alternatives. Say for instance there is a requirement that there must be DES encryption of passwords. That would be a downright terrible law on several levels - first of which is that the best way to secure passwords is not keeping them in the first place but a hash. The encryption standard is as laughable now as requiring banks lock their vaults with a simple warded lock - the kind where skeleton keys work because shaving the teeth from the key means it no longer has anything to catch on while it turns the lock.
8y ago

striking 8y ago

If management asks you to cut corners to ship the app, ask them to put it in writing. There's nothing wrong with iterating quickly, but developers are responsible for making sure their systems are secure and resisting shipping applications that aren't. It is a developer's responsibility to push back on shipping broken software. If they're forced to, they need to make sure there's a paper trail that shows that. Otherwise it's indistinguishable from a developer just having done a bad job of their own accord.

geggam 8y ago
See developer get RIF'd