6 ms·
This is ridiculous. Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cas
by m00x 7y ago
This is ridiculous.
Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of-use for new software. Redis was part of this a while ago http://antirez.com/news/96 http://antirez.com/news/96.
Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL injections, insecure cryptography. Security is part of our job and matters we must know.
You don't blame a plane for a pilot mistake that was meant to be part of his training. Engineers in every other sector are responsible for their mistakes, we should be too.
Also, you don't sue the worker, you sue the company.
- miohtama 7y agoOnions. You need layers and defense in depth. Because even the best humans make mistakes and it is inhuman to assume perfectionism. Never rely on just one engineering feature.
- CydeWeys 7y ago"Software should be built in the best method of delivering maximum value to its users." Yes, and defaulting to insecure, thus repeatedly causing huge data breaches, is the exact opposite of delivering maximum value to users. It's delivering maximum liability.
- sailfast 7y agoI would argue that the single command to begin using the application and the ease of on boarding / querying data was a huge factor in expanding its usage. Elastic optimized for initial spin-up and getting things running fast. It works really well! Until you load it full of data on a public IP, that is.
- PeterisP 7y agoThat single command to spin up the application can easily generate and show a copyable random secret required to use it, so that you can use easily but there's no option to use it that insecurely.
- deleted 7y ago[deleted]
- bjornjaja 7y agoHonestly a lot of the problem is: people aren’t studying systems engineering OR security. Look at all the “learn to code in 21 days” BS and all the code academies. There’s so much emphasis on abstracting away the systems with cloud-this and elastic-that and developers don’t know much about general systems engineering. My recommendation to software developers: take the Network+ and Security+ exams at the bare minimum. Honestly as much as people complain about process getting in the way of things, there should be checks and balances at any business that deals with personal information. Finance institutions are heavily regulated—these fkers should be held accountable.
- lonelappde 7y ago> You don't blame a plane for a pilot mistake that was meant to be part of his training Did you miss that Boeing is right now risking bankruptcy for doing exactly this?
- lonelappde 7y agoIf security is so important, why should we accept database developers who don't understand that?
- kbr2000 7y agoBecause... they dance the devops dance with their devop hats on! Security problems can be swiftly danced around until they actually surface, and can then be handled in the next round of "continuous delivery". It's also smart to postpone solving most issues until after they occur, so sales can continue bragging about "continuous improvement".
- RidingPegasus 7y ago> "Engineers" Maybe the hint is right there in your comment. Nearly all the people deploying these nodes aren't engineers in the slightest despite having someone given them such a title.
- NicoJuicy 7y agoIt's not always engineers that use them. Sometimes software managers have the sudden need to show statistics and other things. Yeah, that was fun...