4 ms·

I think this critique applies to any specialised profession dealing with a different profession - just because they don't know what you know, doesn't make them

I think this critique applies to any specialised profession dealing with a different profession - just because they don't know what you know, doesn't make them idiots. I'm thinking developers and product owners etc. I do think our industry, overall, has a problem with what I call the "alpha nerd" clash, where people who have, if they're like me, often prided themselves on their intelligence (comparative to their peers) in their schooling etc. and perhaps been ostracised for their intellect and/or its pursuits, still pursue that need to feel smarter than others, which can lead to self-congratulatory sneering. But it's never conducive to a high functioning team - and effective teams deliver effective products. And a team is nearly always a vertical slice of a company to some extent, so yeah, you might have a team of developers, but the testers, the product owners, the BAs, the sales people, they're all part of the team delivering that product, and while you have experience and knowledge that they don't have, they also have experience and knowledge that you don't have, so some empathy and humility are essential.

Alex3917 8y ago
> just because they don't know what you know, doesn't make them idiots If you're making a product, then it's your responsibility to do so in a way that doesn't put your users or the general public in danger. Not knowing security best practices when you get started doesn't make you an idiot, but releasing something without first putting in the work to learn and then implement the best practices kind of makes you a shitty person. I mean otherwise you might as well just say something like, "I just wanted to make a car, I don't care if it's safe or not because that's not the fun part."
- Lab3301 8y ago
  A big problem with security is that you don't know what you don't know. Want to allow users to upload image? * Make sure submitted files are actually images * Limit file size to prevent denial of service * Normalize the filename to prevent directory traversal * Add a randomized component to filenames to prevent users from overwriting each other's files * Serve file with the proper content type * HTML encode filename for display Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS. I don't think that's negligence, it's just not something you'd necessarily know until you saw it. And this doesn't even consider language quirks and gotchas that are even more esoteric.
  - Alex3917 8y ago
    > Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS. Right, but presumably you're using the standard techniques to mitigate XSS, e.g. sanitizing all other text input, using an X-XSS-Protection header, using a CSP that only allows scripts that have been whitelisted, etc. Even if you don't know that an SVG can contain js, that shouldn't put your users at risk if you're doing everything else correctly. And then when that gets caught in an audit or reported by a user or as part of a bug bounty, you can fix it. (Although if you're going to be serving up a certain UCG file type to users, I don't think it's unreasonable to expect people to Google for vulnerabilities associated with that file type.) Developers shouldn't be expected to have perfect security knowledge or to never make mistakes, but I think it is reasonable to expect them to not be grossly negligent. I don't want to live in a world where only people wealthy enough to afford full security audits before they get any traction should be allowed to launch products, but I also think developers should be held accountable if they're recklessly endangering people.
    - arvinsim 8y ago
      And while you are doing all that your manager is breathing down your neck to finish the damn thing and your competitor has already released a comparative feature that you are developing. In the ideal world, companies would give developers enough time to figure out security. But in practice, most companies/businesses just want you to ship ASAP.
- ChrisSD 8y ago
  If you don't know security best practices then learning them on the fly isn't particularly helpful, simply because you don't even know what you don't know. It's much better to accept your ignorance and defer to someone who does know security.
  - Alex3917 8y ago
    > It's much better to accept your ignorance and defer to someone who does know security. Society doesn't currently offer any mechanism to pay for that though. E.g. if you as a developer make a product, you can't force VCs to fund a security audit, nor can you force security folks to work for equity, nor is there any public money available to pay for this.
    - arvinsim 8y ago
      I disagree. It is the onus of companies and managers to give developer enough time to figure this out. If they don't include it in their estimates, don't expect developers to put in their personal time to implement proper security.
tzhenghao 8y ago
> I do think our industry, overall, has a problem with what I call the "alpha nerd" clash, where people who have, if they're like me, often prided themselves on their intelligence (comparative to their peers) in their schooling etc. and perhaps been ostracised for their intellect and/or its pursuits, still pursue that need to feel smarter than others, which can lead to self-congratulatory sneering. This, and I'm typing this out around a group of these people right now. This is just a local scope of problems that then manifest in more global and troubling issues like diversity problems and predatory behavior among employees in the workplace.

Alex3917 8y ago

> just because they don't know what you know, doesn't make them idiots If you're making a product, then it's your responsibility to do so in a way that doesn't put your users or the general public in danger. Not knowing security best practices when you get started doesn't make you an idiot, but releasing something without first putting in the work to learn and then implement the best practices kind of makes you a shitty person. I mean otherwise you might as well just say something like, "I just wanted to make a car, I don't care if it's safe or not because that's not the fun part."

Lab3301 8y ago
A big problem with security is that you don't know what you don't know. Want to allow users to upload image? * Make sure submitted files are actually images * Limit file size to prevent denial of service * Normalize the filename to prevent directory traversal * Add a randomized component to filenames to prevent users from overwriting each other's files * Serve file with the proper content type * HTML encode filename for display Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS. I don't think that's negligence, it's just not something you'd necessarily know until you saw it. And this doesn't even consider language quirks and gotchas that are even more esoteric.
- Alex3917 8y ago
  > Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS. Right, but presumably you're using the standard techniques to mitigate XSS, e.g. sanitizing all other text input, using an X-XSS-Protection header, using a CSP that only allows scripts that have been whitelisted, etc. Even if you don't know that an SVG can contain js, that shouldn't put your users at risk if you're doing everything else correctly. And then when that gets caught in an audit or reported by a user or as part of a bug bounty, you can fix it. (Although if you're going to be serving up a certain UCG file type to users, I don't think it's unreasonable to expect people to Google for vulnerabilities associated with that file type.) Developers shouldn't be expected to have perfect security knowledge or to never make mistakes, but I think it is reasonable to expect them to not be grossly negligent. I don't want to live in a world where only people wealthy enough to afford full security audits before they get any traction should be allowed to launch products, but I also think developers should be held accountable if they're recklessly endangering people.
  - arvinsim 8y ago
    And while you are doing all that your manager is breathing down your neck to finish the damn thing and your competitor has already released a comparative feature that you are developing. In the ideal world, companies would give developers enough time to figure out security. But in practice, most companies/businesses just want you to ship ASAP.
ChrisSD 8y ago
If you don't know security best practices then learning them on the fly isn't particularly helpful, simply because you don't even know what you don't know. It's much better to accept your ignorance and defer to someone who does know security.
- Alex3917 8y ago
  > It's much better to accept your ignorance and defer to someone who does know security. Society doesn't currently offer any mechanism to pay for that though. E.g. if you as a developer make a product, you can't force VCs to fund a security audit, nor can you force security folks to work for equity, nor is there any public money available to pay for this.
  - arvinsim 8y ago
    I disagree. It is the onus of companies and managers to give developer enough time to figure this out. If they don't include it in their estimates, don't expect developers to put in their personal time to implement proper security.

tzhenghao 8y ago

> I do think our industry, overall, has a problem with what I call the "alpha nerd" clash, where people who have, if they're like me, often prided themselves on their intelligence (comparative to their peers) in their schooling etc. and perhaps been ostracised for their intellect and/or its pursuits, still pursue that need to feel smarter than others, which can lead to self-congratulatory sneering. This, and I'm typing this out around a group of these people right now. This is just a local scope of problems that then manifest in more global and troubling issues like diversity problems and predatory behavior among employees in the workplace.