4 ms·

“Even highly trained software engineers can barely get security correct. What makes this journalist think somebody with a few years of high school programming c

“Even highly trained software engineers can barely get security correct. What makes this journalist think somebody with a few years of high school programming can do any better?” Why would they have to be better? You just made very point here. Some high schooler with a boot camp can do just as well as many “highly trained software engineers”.

alistairSH 8y ago
But would they do just as well? The state of data protection and security in the industry may seem abysmal because of several well publicized breaches, but in some of those cases (Equifax comes to mind), it was a lack of experts that caused the problem.
- osdiab 8y ago
  I think what he’s saying is that the industry’s still working despite the fact that such experts are generally not present, and that this can continue. Separately, I think that people consistently haven’t actually penalized most companies for security breaches, anyway. Big brands get hacked, everybody collectively moans for a week, and then they go back to using the exact same products. People publically get mad, but they don’t vote with their wallets, revealing how they really feel about security.
brlewis 8y ago
First, why don't we fix the cost of medical care by letting vocational schools train doctors? After all, there are high-profile medical errors and the world goes on. (In case the sarcasm isn't obvious, my point is that the existence of errors by professionals doesn't mean the entire system would be just as good if staffed by non-professionals.)
- throwanem 8y ago
  Actually, we kind of do, in physician assistants. Having in recent years received most of my medical care, including emergency care, from PAs, and only rarely seen an MD, I have to say, I'm not sure you're doing a great job supporting your case - the care I've received from PAs has in no respect been below the standard I'd expect to receive from MDs.
  - brlewis 8y ago
    I don't think the "blue collar" label applies to physician assistants. https://www.google.com/search?q=physician+assistant+training https://www.google.com/search?q=physician+assistant+training
    - throwanem 8y ago
      No, but it doesn't matter. The comparison between a doctor and a physician assistant is quite closely parallel with that between a "conventional" and a boot-camp-trained SDE. Especially since our field has no certification requirements, minimum necessary training, or indeed any qualifications whatsoever beyond simply demonstrating the ability to do the work!
- InGodsName 8y ago
  Does most of the software involve mission critical work where failure means death or loss of vital organs? Outside some key areas, most of the software work is not that important. So this comparison isn't fair. My girlfriend does React/JS apps for local businesses and she's teaching some other women in the neighbor too. No she doesn't know how webpack works but she has learned enough to produce results. Whenever she gets stuck, she looks for Stackoverflow or GitHub issue links and 80% of the time finds the answer there. Rest of the time she gives up on a tool and uses other tool which doesn't suffer from the same issue. Sorry i used to think i am very smart because i am a programmer but it turns out others were simply not introduced to the programming way. Programming is wayy easier now with all the tooling/guides/courses available now.
  - brlewis 8y ago
    I think it's great that many other people are taking an interest in programming and doing it. And it's true that to think oneself very smart for being able to program is the wrong attitude. But this thread that you're replying in started with this particular assertion from the article: "But any blue-collar coder will be plenty qualified to sling JavaScript for their local bank." An app that's secure enough for a bank is unfortunately not something one can make without a lot of training. Maybe someday.

alistairSH 8y ago

But would they do just as well? The state of data protection and security in the industry may seem abysmal because of several well publicized breaches, but in some of those cases (Equifax comes to mind), it was a lack of experts that caused the problem.

osdiab 8y ago
I think what he’s saying is that the industry’s still working despite the fact that such experts are generally not present, and that this can continue. Separately, I think that people consistently haven’t actually penalized most companies for security breaches, anyway. Big brands get hacked, everybody collectively moans for a week, and then they go back to using the exact same products. People publically get mad, but they don’t vote with their wallets, revealing how they really feel about security.

brlewis 8y ago

First, why don't we fix the cost of medical care by letting vocational schools train doctors? After all, there are high-profile medical errors and the world goes on. (In case the sarcasm isn't obvious, my point is that the existence of errors by professionals doesn't mean the entire system would be just as good if staffed by non-professionals.)

throwanem 8y ago
Actually, we kind of do, in physician assistants. Having in recent years received most of my medical care, including emergency care, from PAs, and only rarely seen an MD, I have to say, I'm not sure you're doing a great job supporting your case - the care I've received from PAs has in no respect been below the standard I'd expect to receive from MDs.
- brlewis 8y ago
  I don't think the "blue collar" label applies to physician assistants. https://www.google.com/search?q=physician+assistant+training https://www.google.com/search?q=physician+assistant+training
  - throwanem 8y ago
    No, but it doesn't matter. The comparison between a doctor and a physician assistant is quite closely parallel with that between a "conventional" and a boot-camp-trained SDE. Especially since our field has no certification requirements, minimum necessary training, or indeed any qualifications whatsoever beyond simply demonstrating the ability to do the work!
InGodsName 8y ago
Does most of the software involve mission critical work where failure means death or loss of vital organs? Outside some key areas, most of the software work is not that important. So this comparison isn't fair. My girlfriend does React/JS apps for local businesses and she's teaching some other women in the neighbor too. No she doesn't know how webpack works but she has learned enough to produce results. Whenever she gets stuck, she looks for Stackoverflow or GitHub issue links and 80% of the time finds the answer there. Rest of the time she gives up on a tool and uses other tool which doesn't suffer from the same issue. Sorry i used to think i am very smart because i am a programmer but it turns out others were simply not introduced to the programming way. Programming is wayy easier now with all the tooling/guides/courses available now.
- brlewis 8y ago
  I think it's great that many other people are taking an interest in programming and doing it. And it's true that to think oneself very smart for being able to program is the wrong attitude. But this thread that you're replying in started with this particular assertion from the article: "But any blue-collar coder will be plenty qualified to sling JavaScript for their local bank." An app that's secure enough for a bank is unfortunately not something one can make without a lot of training. Maybe someday.