3 ms·

Yes, yes I do as a developer! The thing is that a lot of these "hacks" aren't even that sophisticated. A lot of them are engineers not paying enough attention.

Yes, yes I do as a developer! The thing is that a lot of these "hacks" aren't even that sophisticated. A lot of them are engineers not paying enough attention. The security dimension of many, many products can be improved tremendously picking off some low hanging fruits. Ever since companies like Google pushed for HTTPS, it's proliferated all over the place. Just by Google emphasizing it and talking about the need for secure communication even inside one's own network, my own company started doing the same. Enabling HTTPS and SSL wasn't that hard, especially since companies Let's Encrypt came along. It just wasn't prioritized. Once it was, our engineering team made it super easy to get certificates from LE and we all learned standardized ways for securing our traffic. Security is often low priority because people are really bad at planning for unlikely events with potentially catastrophic consequences. I'm not saying we can be invulnerable but we need to raise the lowest common denominator so that it's not a walk in the park to steal millions of records. You just need the weakest link to make everyone vulnerable but I do think positive collective behavior can counter that -- especially when you make it easy with things like Let's Encrypt.

notyourday 8y ago
> Yes, yes I do as a developer! The thing is that a lot of these "hacks" aren't even that sophisticated. A lot of them are engineers not paying enough attention. I dont think you have quite thought it through. Do you honestly want to have to do code audit on all libraries you use? Freeze all versions? Have a chain of signoffs for every change? I have briefly done consulting in a place like that -- developers were absolutely miserable. Think about every single corporate IT policy that exists and apply it not just to your desktop/laptop/phone but to what you do on that desktop/laptop/phone. Security is about management of risk.
- ryandrake 8y ago
  It’s not “either or”, but as someone who has worked at various places along the spectrum of practices ranging from “default password is password” to DO-178B [1], I greatly prefer environments with strict and rigorous design, testing, change control, and security auditing. The chaos of moving fast and breaking things (and fixing them, and breaking them again, and fixing them again, then getting hacked and having to pull 24 hour days to mitigate...) is a recipe for burnout. 1: https://en.m.wikipedia.org/wiki/DO-178B https://en.m.wikipedia.org/wiki/DO-178B
  - notyourday 8y ago
    If DO-178B were to be applied to "internet" I would not be surprised if we were thinking that uucp is amazing invention in 2018. I'm going to repeat it again - we do not have a security problem with software. We have a risk management problem. There's absolutely no reason for Marriott store information on previous guests past certain statue of limitations. In fact, they could probably offloaded it to Iron Mountain after 180 days. Storing it online has a certain risk profile. That risk was not correctly evaluated ( probably not evaluated at all ) and hence it was not minimized. Storing credit card information ( even encrypted ) after the card was charged and transaction creates another risk profile. It also was not evaluated and it was not mitigated. Businesses are obsessed with data without understanding the risk.
- reaperducer 8y ago
  I dont think you have quite thought it through. Do you honestly want to have to do code audit on all libraries you use? Freeze all versions? Have a chain of signoffs for every change? If developers demand that the tools they use are better built, then the market will deliver tools/frameworks/etc... that are secure from the start. "Good" coding has become "good enough" coding, and the problem exists from the bottom of the stack to the top.
  - notyourday 8y ago
    > If developers demand that the tools they use are better built, then the market will deliver tools/frameworks/etc... that are secure from the start. This is never going to happen because what is considered secure in one place is not considered secure in another place. > "Good" coding has become "good enough" coding, and the problem exists from the bottom of the stack to the top. Because it is about risk management, not about absolutes. It is absolutely irrelevant that a smart samsung TV that I have in my office has garbage security because it is used as one thing and one thing only - dumb 48" HDMI monitor not connected to wireless network. Its Wifi antenna connector has been cut. It matches my risk profile.
- deleted 8y ago
  [deleted]

notyourday 8y ago

> Yes, yes I do as a developer! The thing is that a lot of these "hacks" aren't even that sophisticated. A lot of them are engineers not paying enough attention. I dont think you have quite thought it through. Do you honestly want to have to do code audit on all libraries you use? Freeze all versions? Have a chain of signoffs for every change? I have briefly done consulting in a place like that -- developers were absolutely miserable. Think about every single corporate IT policy that exists and apply it not just to your desktop/laptop/phone but to what you do on that desktop/laptop/phone. Security is about management of risk.

ryandrake 8y ago
It’s not “either or”, but as someone who has worked at various places along the spectrum of practices ranging from “default password is password” to DO-178B [1], I greatly prefer environments with strict and rigorous design, testing, change control, and security auditing. The chaos of moving fast and breaking things (and fixing them, and breaking them again, and fixing them again, then getting hacked and having to pull 24 hour days to mitigate...) is a recipe for burnout. 1: https://en.m.wikipedia.org/wiki/DO-178B https://en.m.wikipedia.org/wiki/DO-178B
- notyourday 8y ago
  If DO-178B were to be applied to "internet" I would not be surprised if we were thinking that uucp is amazing invention in 2018. I'm going to repeat it again - we do not have a security problem with software. We have a risk management problem. There's absolutely no reason for Marriott store information on previous guests past certain statue of limitations. In fact, they could probably offloaded it to Iron Mountain after 180 days. Storing it online has a certain risk profile. That risk was not correctly evaluated ( probably not evaluated at all ) and hence it was not minimized. Storing credit card information ( even encrypted ) after the card was charged and transaction creates another risk profile. It also was not evaluated and it was not mitigated. Businesses are obsessed with data without understanding the risk.
reaperducer 8y ago
I dont think you have quite thought it through. Do you honestly want to have to do code audit on all libraries you use? Freeze all versions? Have a chain of signoffs for every change? If developers demand that the tools they use are better built, then the market will deliver tools/frameworks/etc... that are secure from the start. "Good" coding has become "good enough" coding, and the problem exists from the bottom of the stack to the top.
- notyourday 8y ago
  > If developers demand that the tools they use are better built, then the market will deliver tools/frameworks/etc... that are secure from the start. This is never going to happen because what is considered secure in one place is not considered secure in another place. > "Good" coding has become "good enough" coding, and the problem exists from the bottom of the stack to the top. Because it is about risk management, not about absolutes. It is absolutely irrelevant that a smart samsung TV that I have in my office has garbage security because it is used as one thing and one thing only - dumb 48" HDMI monitor not connected to wireless network. Its Wifi antenna connector has been cut. It matches my risk profile.
deleted 8y ago
[deleted]