4 ms·
As a developer, yes. I really wish more developers had at least a basic ethical grounding and didn't just go "fuckit, revenue!". (Or, in larger companies, "fuc
by groby_b 8y ago
As a developer, yes.
I really wish more developers had at least a basic ethical grounding and didn't just go "fuckit, revenue!". (Or, in larger companies, "fuckit, my boss told me")
And when you consider opportunity cost - even just double-checking you aren't affected takes a minute of time, as a consumer, that means this hack just wasted close to a thousand years of human life.
Where's the accounting for the opportunity cost of that?
- stanleydrew 8y agoOnly a handful of people will actually bother to check whether they were affected.
- groby_b 8y agoThat will be more than mitigated by the large number of people who'll have to fight off identity theft. It's also an intentionally low-balled number. In other words, this is an irrelevant nit that serves no purpose except derailment.
- closeparen 8y agoThere is no such thing as being "done" with security. You can as deep as you want, with as large a team as you want, and never be able to say "okay, we're secure now." If basic ethical grounding requires security to be the top priority, and security work is inexhaustible, then it must be unethical to ever work on the product being secured.
- inetknght 8y agoThere is no such thing as being "done" with safety. You can go as deep as you want with as large a team as you want and never be able to say "okay we're safe now." If basic ethical grounding requires safety to be the top priority, and safety work is inexhaustible, then it must be unethical to ever work on the product being safe.
- closeparen 8y agoAbsolutely correct. Safety is about managing risks, not eliminating them completely at all costs. An airline which truly saw safety as the top priority would never put a plane in the air. Making money is the top priority; safety (or security) is one consideration that influences how you go about it.
- groby_b 8y agoNo, but there is such a thing as "following best practices". An ethical approach requires you to reason about which actions are moral, not to be "done" with something. As I said, even a basic knowledge would be really helpful.
- late2part 8y agoIt's easy to reference amorphous "best practices." As Tannenbaum said, it's nice to have so many to choose from. The real challenge is deciding which practices apply, and what authority to figure to recognize when determining "best."
- groby_b 8y agoThat involves both declaring bright lines, and making tradeoffs between cost and risk. It's almost as if it was a question of ethics.
- closeparen 8y agoI agree. But following best practices is a completely different thing from treating security as the top priority. Best practices include tradeoffs that balance security risk with cost and businesss needs.