22 ms·

I'm not burned out, I'm pissed off

• imvetri 7y ago
  What you gonna do about it?
  • Fordec 7y ago
    You mean the last three paragraphs titled "So what am I going to do about it?"?
• ncmncm 7y ago
  As well he should be. So should we all.
• javajosh 7y ago
  This is the down-side of artificial scarcity for software. The upside is that sweet sweet green. If you could remain cynical a few years longer, scrimp and save like 10 years of a comfy mid 6 figure salary, you'd stop caring about the BS, and you'd might even learn to love it (or even contribute to it!) After all, nothing quite feels as good as being a well-paid expert in a complicated field, especially when it grows more complicated over time. It's offensive, and it's not how it should be, it's a "defect/defect" Nash equilibrium when we should be going for "cooperate/cooperate". So kudos to you for fighting the good fight - you deserve to win.
  • ailideex 7y ago
    > artificial scarcity for software Can you elaborate on this? Why would you say there is artificial scarcity for software?
    • deleted 7y ago
      [deleted]
    • prawn 7y ago
      I assume they're talking about the fact that software can be replicated at no cost but is constrained by pricepoints, encrypted code, licensing agreements, versioning flags, and so on. It's been artificially constrained in code.
      • javajosh 7y ago
        Correct. Although the constraints often involve code, they don't have to. Enterprise license agreements are ultimately enforced with threat of legal action, coin-op arcade games by a physical mechanism, for example.
    • javajosh 7y ago
      Software costs ~0 to copy and distribute absolutely perfect copies, world-wide. To drive the price up you create artificial scarcity, mostly rooted in IP law. Important note for HN readers: 'driving the price up' is a net benefit for programmers. Artificial scarcity is why you get paid big bucks. Interestingly, data is legitimately scarce. But that's a discussion for another time...
      • rumanator 7y ago
        Copy and distribution costs are just a part of the cost. Development and maintenance does require real flesh and blood people spending their days working on developing, building, and deployment. That part costs money.
        • javajosh 7y ago
          You tacitly assume that I am not aware that software products have an R&D cost, and you are (insultingly) wrong. Of course they do. And without artificial scarcity that R&D cost will not be recouped. The default state of software is an open source model, where the "developing, building, and deployment" doesn't cost money because there isn't any.
          • saberdancer 7y ago
            Copy and distribution costs for movies in a digital age are non existant. Are movies using artificial scarcity?
            • javajosh 7y ago
              Yes.
            • BlueTemplar 7y ago
              That movies are almost impossible to buy DRM-free should give you a hint ?
        • bayesian_horse 7y ago
  • thrownawayalrea 7y ago
    What about those of us who don't get crazy compensations, but instead work at a midsized company selling a "security" product? All of the complexity in my field comes from stupidity, either by certifiers, or legacy protocols that can't die or sales people playing "defect/defect" with oneanother so nobody fucking talks with each other. If the complexity at least came from software I would have a reason for my knowledge to feel valuable outside my specific domain.
    • javajosh 7y ago
      Well, it sounds like you need to be learning things outside your domain in the hopes of entering the job market. Sometimes you can't fix the game. BTW I'm quite wary of "security products" for enterprise; it reeks of antivirus software writ large. That said I can see some benefit to services like audits, or even things like honey pots or "dark net scans" for detecting leaks. But something tells me that's not what you're talking about...
      • thrownawayalrea 7y ago
        > BTW I'm quite wary of "security products" for enterprise; it reeks of antivirus software writ large. That said I can see some benefit to services like audits, or even things like honey pots or "dark net scans" for detecting leaks. But something tells me that's not what you're talking about... The product itself is quite reasonable on paper [1]. (And, yes, it would provide value even if all of the software industry would ramp up their security practices, so it's not a band aid like antivirus software.) The execution is the problem. Despise selling "nation state attacker secure" appliances, we are not internally focusing on producing a high security product but give priority to certifications and features. The disconnect between marketed identity and day-to-day developer experience is breathtakingly depressing... at least to those of us who have an interest in security. Management doesn't care of course. It sells (because of certification and little alternatives on the market), so all is well. [1] Sorry for being so vague. Given the set of statements I've given already, anything more would make me personally identifiable to my coworkers.
    • scarejunba 7y ago
• etaioinshrdlu 7y ago
  I think this person should seek happiness in ways that don't involve technology.
  • quaquaqua1 7y ago
    >I'm pissed off that my clients don't seem to take it seriously, and I'm pissed off that the vendors don't seem to want to help. Yes, I 100% agree with your assessment of this person's post. They are running into what I would call, "the horrible realities of business", which have nothing to do with putting in too many hard hours at work and everything to do with being forced to deal with unethical/deliberately lazy people in the day to day of being a worker
  • travbrack 7y ago
    They’re expecting greatness from everyone around them. That would drive me crazy as well. My mental health is too important to be idealistic anymore.
    • NetOpWibby 7y ago
      When I was in my early 20s I couldn’t understand why people were so jaded about anything. A decade later and, I understand. People don’t give a damn and it’s mind-boggling. All you can do is shake your head and continue with your day.
  • codingdave 7y ago
    I don't think they are unhappy. I think they see an opportunity, and this is a setup for an upcoming post where they announce the new product to fix the concerns.
• psilocipher 7y ago
  Any Wordpress site is essentially a hacker honeypot that will ultimately cost your organization far more than it might save you if you actually try to use it as a content management system. WP should come pre-configured with the very good "WP Cerber" security plugin, and force you to choose a random login URL. Otherwise it's only a matter of time before you are hacked. 5,000,000 lines of auto-updating PHP? Good luck securing that. I have been forced to support 2 WP websites for the last 2 years and they are attacked thousands of times a day simply because they report themselves to the world they are Wordpress sites. WP Cerber allows you to upload the original code for plugins and themes and can then scan them for unexpected changes. The effort required to maintain the security of Wordpress FAR exceeds any value you might extract from it being "Free".
• isodude 7y ago
  I asked my SO recently how she view the Internet, what it is and how it works. She was honest and told me that, "If I click this button, this websites loads. If that works I'm fine! If it doesn't I will call you. Don't stop working with IT please, if you get it, we need you badly!" I believe that is a good reason to be accepting towards the current state of affairs. People just don't care. They have more important issues to deal with, deadlines to meet, problems to face. If you are frustrated and pissed off, great. That means you get it, and that's great! Now, meditate -- the journey to a perfect secure world will take some time, like beyond your current life span. It's not until you accept that reality that you will make real change globally. Because it takes time, a lot of time. Thanks for your effort so far.
  • kissgyorgy 7y ago
    > the journey to a perfect secure world will take some time The author argues that it will never happen because we are WORSE today than we were before and I agree with that.
  • Iv 7y ago
    Thing is, it took me a long time to accept that people not caring was ok. Now I realize that my dad is frustrated I never learned something as simple as changing the oil on my car. My mom does not understand how I can't name more than two flowers and can't bake a pie. My legal-minded friends are astounded I do not take a day to work on my legal status to pay less taxes. Hell, my wife does the paperwork I am not even sure of the tax rate we are paying. And yet, I see myself as pretty curious, jack of all trade. I understand many things about CS, mechanics, electronics, manufacturing, politics, economics, ecology... We live in a complex world and we rely on each other to make it work. Love each other, we really depend on each other, it is easier if we don't consider others stupid for choosing different areas of skills.
    • isodude 7y ago
      Thanks, this summarizes my thoughts quite neatly. And most importantly, love yourself and don't let others disinterest get to your spirit of making good.
• didibus 7y ago
  Why would you need an InfoSec if security was a solved problem? By the way, I totally understand where they're coming from, but I've realized that as an engineer in enterprise, your job is to fix things that are falling apart. The more senior and talented you become, the more broken the things they want you to fix become. That's literally your job! They're not going to pay you to admire the beauty of something without issue that meets all requirements.
• known 7y ago
  Join a night college and acquire new skills;
• Simon321 7y ago
  If you work in security, this resonates so much. No one really cares about security except to check a box or pay lip service to it. That's why so called security products ship without logging and clients don't want to make the smallest effort to enable you to improve their security. It's why companies that sell security products invest more in marketing than the product. The industry is full of conmen and marketeers. Information security can be great though if you find someone that really cares.
  • raducu 7y ago
    I work as a contractor for a bank. A few months ago everybody was up in arms about a "major" security issue discovered by an auditor (you could see the settings of random users by changing an id in a url). I've just shown them you can credit money to your account, yet this is low priority and they provided a fix that I'm 100% percent sure didn't fix anything, unfortunately the functionality is down on all but the production environment. I'm tempted to just credit myself 1 monetary unit in production and just show them the statement.
    • winrid 7y ago
      Sometimes it matters who finds the issue more than what it is....
    • trymas 7y ago
      > I'm tempted to just credit myself 1 monetary unit in production and just show them the statement. I would be tempted too, though I could bet that this will be a termination of an employment, instead of the problem being fixed. I would like to be proven wrong on this speculation..
      • neuronic 7y ago
        Not just that, I would expect criminal charges to follow.
      • raducu 7y ago
        Yes, that's what I thought as well.I'll just have to suck it up until the test environments are up again and provide a proof of concept exploit. I'm just impatient because it's a really clever and somewhat complex hack that challenges some multi-threading and transactionability assumptions some people mande and I can't really talk about it(which I'd love to share with my peers).
• kakapumar 7y ago
  I like that at least you have a plan to do next lol
• gabrielblack 7y ago
  what if I tell you that a software banks (B-A-N-K-S) are using to transfer money has hardwired passwords inside, has to run as administrator and has some problems of command injection, etc, etc ... etc ? Sadly company think to security as a cost and to maximize the profit let people should never approach a keyboard to write programs, unsecure programs, because they cost less. Because also testing is expensive, same story. Did a big airplane manufacturer does the same ? The customers ? Who takes decision often doesn't care: they prefer to spend more money to purchase a scapegoat, a "silver bullet" appliance so that they can say "Hey, we had all the contromeasure, but hackers know black magic !". I don't want to burn-out. I prefer to give the correct information to the peoples want to listen and then I hope in a future in a better company.
  • nvrspyx 7y ago
    I assume English isn't your first language, so this is my attempt to correct. Please don't take this as a criticism, but rather as (hopefully) helpful feedback. Even with English as my native language, I'm sure there's some grammar mistake I've made as well. ____ What if I told you that the software banks are using to transfer money has passwords hardwired inside, has to be run as administrator, has some command injection problems, etc.? Sadly companies think of security as a cost and to maximize their profit, they let people who should never even approach a keyboard write insecure programs because they cost less. Because testing is also expensive, it's the same story. Did a big airplane manufacturer do the same? Their customers? Who makes the decision often doesn't care. They prefer to spend more money to purchase a scapegoat, or a "silver bullet" appliance, so that they can say, "Hey, we had all of the countermeasures, but hackers know black magic!". I don't want to burn out. I prefer to give the correct information to the people that want to listen and then hope for a better company in the future. ____
    • gabrielblack 7y ago
      Thank you ! Yes it isn't my first language and I wrote the post going at work, on a bus. So no time to review it.
• NetOpWibby 7y ago
  A buddy of mine works in security and I can see him writing this post, haha. Or did he? Anyhoo, I cannot imagine working in a technology field and not being allowed to do your damn job. Sounds frustrating af, I’d quit too.
• bayesian_horse 7y ago
  Basically everyone wants security, but nobody wants to pay for it. Maybe the market equilibrium means people don't get hurt enough yet.
  • dredmorbius 7y ago
    Everybody wanna be a bodybuilder. But ain't nobody wanna lift no heavy-ass weight. https://www.invidio.us/watch?v=4UlgXIL0-3g https://www.invidio.us/watch?v=4UlgXIL0-3g
    • Wheaties466 7y ago
      good ole ronnie coleman.
  • bayesian_horse 7y ago
    And in my opinion, having done some IT security work, it seems to be a relatively miserable field, even if the salaries are going up. Miserable in the sense that customers don't care, you have to be paranoid and brilliant at the same time, it can be weeks without an emotional payoff, yet everything is always urgent but rarely important. Having watched some conference videos on the topic, the bro-toxicity is still strong in that field, too.
• pif 7y ago
  You are not pissed off, you are burned out. When all the people around you are fine and you can't cope with the environment, it's time to look for professional help, for your sake.
  • thdrdt 7y ago
    I don't think he/she is burned out. When you are burned out you can't do anything anymore. Then you are way over 'being pissed off'. But! being pissed off at work is a very good way to get burned out. Most people who are burned out are having conflicts with their moral and what they do or how they live. So good for the author to make this clear to his boss and is taking action. Because in the end being mad will turn into being burned out.
  • dredmorbius 7y ago
    Por que no los dos? Burnout is complex and seems to have multiple causes. But chief elements are 1) being overwhelmed and 2) having no sense of agency or effectiveness. Being in a situation in which: 1) You have clear view of the problems. 2) Others around you deny they exist, and/or 3) Actively prevent you from addressing them, and/or 4) Fail to provide you the tools, time, staff, authority, or other resources to address the problem(s), and/or 5) Act, operate, or produce / deliver products in ways that are completely insufficient to the problem domain 6) Or other forms of denial, frustration, sabotage, etc., of an effective response ... ... I think that someone in such a situation would become both angry and burnt out. In fact, I could empathise quite strongly with such feelings.
• chahex 7y ago
  You are not pissed off of your work. You are pissed off of yourself. You are not complaining because the work is wrong, you are complaining because you are angry within, and you believe it is not your fault. You are not taking responsibility of your emotions as you are supposed to and as taught by all the masters of wisdoms. Go back home and rethink who you are. The world is not changing for you unless you change yourself. You are losses off because you are seeing an imperfect self everywhere .
  • slimed 7y ago
    This type of drum circle commentary is so unhelpful. Raising the bar for security in the software industry requires much more than just self reflection and elbow grease from individual engineers. The solution requires buy in from all stakeholders. Especially management.
    • chahex 7y ago
      We are not talking about the same problem. Yo are not seeing the fact that it is only you who are responsible for what’s happening inside you . And you are taking the wrong path fixing that by fixing everything else but you.
      • slimed 7y ago
        Agree to disagree. Anger is quite useful.
        • intc 7y ago
          Hmm. Anger is a byproduct of fear. Fear is a signal. Victory achieved with the power of anger will not last for long? My suggestion is to take distance towards things that keep us busy, stressed and angry. This usually reduces the stress levels so much that some of the healthy and objective thinking capacity is gained. Can take some time though. Weeks. Even months. There is time! In many cases we'll find that there indeed was something which is "side railed" within. And other things which are less than optimal with the outside world too. =) Both aspects are equally important from our individual perspective. What is inside we have better control for (though sometimes it really requires effort and patience to change even these things). What is outside we can possibly start to bend according to our vision. Before we start to bend outside, it would be good if we are clear within. All that being said - This indeed can be the moment from which things start to turn to much better direction in so many ways. So perhaps even anger has it's purpose. Not as a tool, but as a initiator. Godspeed!
• kodablah 7y ago
  > I'm pissed off at the state of information security [...] I'm pissed off that our tooling is falling behind. I'm pissed off that my clients don't seem to take it seriously Information security, like physical security, isn't something people want to have to care about or put effort in, and if they don't want to, they often won't. What you should be pissed about is that clients have to care and it isn't applied transparently. When being insecure is more difficult than being secure, then you'll find the mindset shift. In the meantime, you should be pissed off at those that make security difficult, not those that care less to endure those difficulties. I know some of the post addresses vendors, but the rest concerning your-company software and vendors is misplaced anger.
• zer00eyz 7y ago
  "A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." No one in management wants the expense or the overhead of actual security. They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand. Then something real happens, a leak of user data, or credit cards or internal memos... suddenly everyones job is security and no one knows what to do. The last problem gets solved, there is more "theater" and a few quickly forgotten changes that get worked around or just ignored in the long run. Furthermore your average engineer wouldn't eat a ham sandwich handed to them on the street by a stranger but will happily run code from 100's of other people on their servers with out even looking at it. Note: I too am guilty as charged. Sure you can vendor it, and miss out on future security patches (it was already broken). Or you could just pull it from whatever repo you got it from to begin with and pick up new flaws. Never mind the fact that pulling from random places assumes that all those other chains of trust remain un-compromised. Management and Engineers should be the ones most concerend and most thoughtful regarding security and both seem to ignore it for cost and convenience reasons till it is (far too late and) a REAL problem.
  • antihero 7y ago
    > Furthermore your average engineer wouldn't eat a ham sandwich handed to them on the street by a stranger We would however eat one provided by a café that our colleagues recommended.
    • CathedralBorrow 7y ago
      That's true, and a good point, but a big part of that trust comes from the knowledge that no one can run a café without some kind of oversight and inspection on food safety. I probably wouldn't eat a sandwich from a bootleg café.
• Cougher 7y ago
  This guy needs to understand his place in the workings of everyone around him, just like his product's place in the workings of the products around it. If you provide a product with a function that is transparent to the user unless it breaks, then they're going to place their priorities where the needs are most obvious and rewarding. The people who use his products have jobs with focuses are something other than his security product. Their priority will always be on what they have to do to earn their money. A corollary to earning money is saving money. As far as the product never arriving at its ideal function goes, the products that his security products serve will always evolve, so his product will always have to change with them. You can only let these things get to you so much. Source: I was responsible for the surgical equipment for a hospital. You want to see reality avoidance and cost-priorites get ugly?
• itsjustsomeguy 7y ago
  Sounds incredibly like LogRhythm to me :)
• mikorym 7y ago
  Don't you think that most of your clients being breached is immaterial in the greater scheme of things? You seem to be bothered by the "overall picture". I am also prone to this sentiment (not in infosec though) but I am actually consoled by the sort of nihilist nature of things. Maybe even optimistic for being so. I think the stuff that keeps us happy are minutiae. If you are super keen about APIs then maybe building really sensible APIs along the way will bring you the relief of having something stimulating to work on. At the moment I get a lot of satisfaction from tooling vim to be my super-IDE and everytime I use vim now I get a kind of wry happiness from not having to use all kinds of apps and what-not. I think APIs can be super interesting and useful. For example, I wanted to pull the Bitcoin purchasing history from a site and the answer was... you have to use Golang. I also get a sort of satisfaction from using Perl in this way. (I use Python too.) It's just that all kinds of wonderful gems were once written in Perl by people that were clearly bored with their lives (exiftool comes to mind).
• EnderMB 7y ago
  I don't explicitly work in security, but I've had a handful of arguments in the past where I've discovered a serious vulnerability, and been told either by my managers or by a client that it is low-priority. Sometimes, the vulnerability was then exploited, and what shocked me was that people were okay with this. I won't name names, but one marketing department I worked with was happier to suffer a customer data leak over having to spend budget during the end of the year to fix the issue. I later learned that the IT department got in trouble for allowing the error to happen, when the system was entirely managed by us and our sole point of contact was with someone in marketing that left their position because they didn't get on with IT. If there's one thing I learned, it's that the ultimate currency in business is risk, and that the software/IT industry lacks the power to really do anything when a company is found to be negligent. For many, the risk of "being caught" is worth not spending money on preventative issues, and ultimately there's absolutely nothing we can do about it outside of covering our asses when the finger is pointed our way. You only need to look at the Panera Bread security breach to see that all the badmouthing on Twitter did nothing to stop the company from painting its own narrative. Hell, the WordPress theme/plugin company Pipdig was caught ddosing its rivals with their software, and all they had to do was lay low on social media for a month and lie in a blog post. The worst part was that their non-techie customers were all too happy to back them up, meaning that the WordPress security community had zero clout to really do anything. I have the utmost respect for anyone that works in security, because you're fighting a battle that no one wants to win, and is often a battle where it feels your partners are silently rooting for the other side.
  • teekert 7y ago
    That's why EU laws to punish such negligence are a good thing. They increase the risk for companies, to something very specific.
    • EnderMB 7y ago
      I'm in the UK, so all of these companies are either primarily based in the EU, or do business here. GDPR has put some fear back in, but even today there are loads of companies that simply don't give a shit, and will happily risk it all so that they don't have to adapt their practices from years ago. In my experience, smaller companies are the worst offenders, because they know they are small fry. Pipdig are a UK company, and have been actively caught using malicious code with proof, yet they're still running without a care in the world. This all happened recently too, so it's not like it's a pre-GDPR or pre-ICO crackdown issue.
• gorgoiler 7y ago
  Thanks for the essay. I’ve often seen, and myself felt the frustration of the productivity mismatch of having to work with other teams, vendors, and third party products that drag their heels, are rigid, or inflexible. When your day-to-day involves writing code — putting together hundreds of moving parts in a code editor and shipping levels of complexity orders of magnitude greater than any previous era of the Industrial Age — it can be a real drag to get slowed down by things that aren’t code. We have to work as teams of course, and it’s enriching when you’re all on the same page. People scoff at mission and statements and company values, but once you start working with an external vendor you realize the importance of the literal meaning of company. When you’re forced to work with something inflexible it’s ok to hack around it. It’s our bread and butter to do so. But having to hack around things will build a sense of resentment especially when it happens over and over again, and in particular if you ever find yourself doing that to an internal product it can be a serious enough red flag to require some major org changes.
• commandersaki 7y ago
  It seems a lot of people here find information security to be of utmost importance. I would like you to consider a contrarian position. What if someone said cybersecurity (as in information security) is not very important? http://www.dtc.umn.edu/~odlyzko/doc/cyberinsecurity.pdf http://www.dtc.umn.edu/~odlyzko/doc/cyberinsecurity.pdf
  • lonelappde 7y ago
    Highlights from the article: * we can just stop using computers to avoid security problems. * Most criminals are dumb, so it doesn't matter that one smart one can control 80K people's computers around the world to mine Bitcoin. * Data deletion attacks that cripples hospitals and governments is not a problem because they should have backups. * Persecuting dissidents isn't a big deal?
  • dcx 7y ago
    I disagree. The contours of our world are shaped by the quality of our cybersecurity, to the point that it's the water we swim in and we just don't see it any more. Some examples: The last US election was won in large part through highly-targeted influence campaigns run based on stolen data. Not to mention the triggering of Brexit. The influence of the NSA / Russia / Five Eyes / etc on geopolitics hinges on poor cybersecurity. I think it would be silly to assume all of the recent leaks we see come from "inside the building". The entire economics and solution space of what is possible on the internet is shaped by our cybersecurity standards. What would the internet look like if payments and spam were easy instead of hard, or if DDOS was hard instead of easy? I might hazard a guess that this is one factor of many that drives the centralisation of tech into monopolies. A positive externality: The general failure of the tech industry to develop good content protection has enabled widespread software and media piracy. I might suspect this has allowed second and third world countries to uplift faster than otherwise possible (sci-hub anyone?) while also removing a tool of empire from the first world.
• alecco 7y ago
  Ah, syslog. Around 18 years ago I was part of an group developing the next syslog protocol with security in mind. My company (one of the top infosec firms at the time) had a product doing this already. The standards group was a mess. Some other company without any credible security credentials was just forcing their bad implementation (TCP (!) and yet another protocol layer). They were backed by Microsoft and some other corporation. Cisco member just idling there. I ended up leaving as it was a waste of time. Never even bothered checking what happened with those protocols. But I've never heard of them again. (tinfoil hat on) I think the Microsoft guys sabotaged it on purpose and succeeded.
  • parliament32 7y ago
    Don't know about what group you're talking about but it ended up well: no need for a new protocol, just wrap in TLS with mutual cert authentication. TLS/TCP is fast enough nowadays that the overhead doesn't matter, and it saves you from having yet another standard.
    • alecco 7y ago
      But they did create a protocol with even more layers. Also our solution did not need two way communication (as per TCP) but had encryption. This is key in a lot of infrastructure when you change environments (e.g. DMZ to some internal subnet). TCP and SSL were supported, too. Our software was used by one of the larges Unix installations and one of the largest telcos in the world. While theirs, not so much.
• makach 7y ago
  This post resonates very well with me. I am in the exact same position, possibly more frustrated because of our naïve attitude towards building security.
• jamisteven 7y ago
  Security companies exist simply to mark a check box on most industry's "Cover my ass" list. If you are pissed off maybe move out of this and into a sector that actually cares about security.
  • deleted 7y ago
    [deleted]
• deleted 7y ago
  [deleted]
• chrismmay 7y ago
  A bird doesn't sit confidently high up on a thin branch because it has confidence in the branch. It sits confidently because it has confidence in its wings.
• hexxiiiz 7y ago
  While a lot of what the author notes about the issues with security are reasonable complaints, it sounds like the real problem is that the author is burned out because of how all of these underlying issues are dumped onto him as his problems. The real problem is not all of these real world issues that end up effecting him, it is that his work relationships and responsibilities turn these technical issues into personal ones. His response is not to really level with his boss and negotiate a better work circumstance, but instead to vent about how it is the fault of the technical integrity of the entire industry that he has to deal with his boss, his clients, and his workloads. The real problem with the industry is that too few people in it manage interpersonal expectations and boundaries. Instead, it's all too common to hear people in this space to transform interpersonal issues into obnoxious technical gripes, and that only enables the interpersonal dimension to erode further.
  • TeMPOraL 7y ago
    I don't know... The opposite of doing what the author does would be what? Arrange his work so that it's not all his problems? Adopt the mindset of "code to spec, collect paycheck"? To me, the author comes across as caring. They care about the actual value of the work they're doing, beyond their salary. We desperately need more people like that in this industry, because a lot of problems essentially boil down to it being full of people who don't care in the slightest.
• lonelappde 7y ago
  This is what burnout means. It's learning that it's impossible to succeed at your task, sapping your motivation to work on it.
• Jemm 7y ago
  I think this is similar to the experience of almost any competent person when dealing with corporate lunacy.
• contingencies 7y ago
  The problem with the security mindset is that security goals are relative to other business goals within almost every organization. A breach can be OK. A rebuild can be OK. Some downtime can be OK. It depends on the system. To put it eloquently: I don't trust security people to do sane things. - Linus Torvalds (2017) ... via https://github.com/globalcitizen/taoup https://github.com/globalcitizen/taoup
  • tinus_hn 7y ago
    Also the defeatist ‘everything can be hacked if they try hard enough’ attitude, applied as a defense.
    • pdpi 7y ago
      I genuinely believe that’s a better starting point though. It is absolutely true that everything can be hacked if they try hard enough, so the question is — how hard do they need to try, and what resources do they need? As you reach an answer to that question, you either consider that level of investment a credible threat you need to worry about (in which case you invest in tightening things up) or you don’t (beers at 5?).
      • tinus_hn 7y ago
        That is not the defense of ‘I don’t need to improve security because nothing is secure anyway’ though. Or ‘It’s acceptable to keep making the same dumb mistakes over and over because nothing can be secure anyway’.
        • pdpi 7y ago
          Yup, agreed. My point is that I find it easier to talk a defeatist into a somewhat proactive security practitioner (everything is hackable but the point is to deter, delay, and mitigate, not outright stop all attacks), but it's a lot harder to talk a security absolutist into backing down because their initiatives are a net negative. Also, the nuanced posture can look like the defeatist attitude if you don't pay attention to the details —and, on the flip side, you need to pay attention to those same details to tell a proactive attitude from security theatre.
• deleted 7y ago
  [deleted]
• wayoutthere 7y ago
  I 100% agree as a consultant working in product development. I think what drives this is a lack of ability for anyone to understand the end-to-end product from a technical standpoint and make coordinated decisions about direction. Instead, you have 30 teams with their own architects and roadmaps (which often overlap functionality) so you build the same thing 5 times across the org, then 3 of them end up drawing meaningful adoption so you have to figure out how to support that on an ongoing basis. All of this leads to non-technical sales people becoming the de-facto source of product feedback. Which leads to non-technical middle managers making product decisions with a short-term mindset. It's impossible to do a good job under conditions like this, so folks just check out and clock their 40 per week. I think this is the cause of a lot of burnout. People get emotionally invested in their work, but the way tech is structured, quality doesn't matter as much as velocity. Individuals don't fully understand how much impact their work has, so it can seem like toiling away in obscurity for years on end. That doesn't feel good to anyone, but when the company is making 35% margins it's really easy for them to ignore the cash bonfire.
  • masonhensley 7y ago
    Huge problem in many orgs. Many product decisions are made on the fly by the wrong person in an attempt to check a box and get something out the door quick. Or if the right decision gets made upstream, teams downstream don’t align for a litany of reasons. Haven’t been able to put my finger on it exactly (definitely a multi dimensional issue), but I don’t think the issues you outlined will continue to fly if you want something of quality that’s not half baked. This excerpt from agile manifesto comes to mind as part of the problem that I’ve coming to disagree with (at least how I’ve seen it implemented in the past): > The best architectures, requirements, and designs emerge from self-organizing teams.
    • BlueTemplar 7y ago
      Do you have any counter-example in mind ?
      • Aeolun 7y ago
• vfc1 7y ago
  The bad news is that this will happen everywhere where you work for someone else, especially in large companies. And this cannot be avoided while working as an employee, it's part of the system. The good news is that there is one way to avoid this (the only way AFIK) is to start your own company, there you get to call all the shots for good or for bad. It doesn't have to be a big company though, it can be just you and a laptop for starters. Other than that, as an emotional coping mechanism and to preserve their mental sanity, people will simply become disengaged and cynical. Take longer breaks and try to have a laugh with your colleagues to blow some pressure and make friends. Also, because things work badly in those environments, there is a lot of blame deflection going on, which is one of the main causes of stress and burnout. Again, part of the system, not much that you can do about it other than learning to deflect responsibilities to others. Getting rid of the hot potato is a very important skill in these corporate settings. Usually on a team, it's always the same people getting the short end of the stick. Try not to be one of them if you can, but often that's easier said than done. Also, try to get promoted, you will get more responsibility and might even be able to fix some of these things, that's another positive attitude towards chaos that helps a lot of people cope with it.
  • BlueTemplar 7y ago
    Everything a new graduate could wish for ! /s
  • 0xffff2 7y ago
    I couldn't disagree more. I work for the government (in R&D) of all places (about as close as possible to the opposite of working for myself IMO) and I don't feel this at all. I have near-total control over my work environment. If I need something, all I have to do is articulate why I need it and I will get it or get a precise technical explanation of why I can't have it.
    • vfc1 7y ago
      That's a very special setting, most enterprises aren't like that. For example, for material, you get a crap old PC where you can hardly run your IDE, where you can't install anything. These days it's doable to at least get a second monitor. But for things such as an SSD drive? At least a couple of years ago it was nearly impossible. The reason why burnout is frequent, is because in general in most places work conditions are bad and stressful. In my view the problem is the system and not the people. Your professional setting seems like a good example of how it doesn't have to be like that.
• pinkfoot 7y ago
  The fundamental problem is IT is engineered at a price-point two to three orders of magnitude lower than what the complexity demands.
• Wheaties466 7y ago
  I also work for a security product vendor and this 100% reflects exactly how I feel. My god you'd think I wrote this. I'm still very upset that my employers product doesn't have particular features but what i've come to realize is that we don't have feature X because the competitor doesn't have feature X. If someone was to buck the trend and just try and be the best vendor possible because its what users deserve that would completely disrupt the industry. I completely understand this thinking but im tired of hearing that the dev team is developing feature Y that only 1 customer will use simply because they are a fortune 500 customer.
• finnthehuman 7y ago
  I'm a recovering security guy. When I listen to security people rant, I can see their points and it's a bit of fun, I like a good rant. But I get the impression that they're continuously discovering new and exciting ways that individual facets of individual pieces of software (and the processes around them) suck. All without ever accepting that the entirety of the software ecosystem sucks (and that they're rarely moving the needle on that front). All software and the internet combined is a giant ball of mud that just grows and grows as more people add onto it. There's no architecture more than the strict minimum to keep the whole thing from falling apart the moment someone breaths too heavily near it. And that's not even including when commercial interests keep trying to design their chunks of the mudball in unique ways that make themselves more money at the cost of everyone else's chunk getting more complex. Like everyone else adding mud, security wants to get in, hit their requirements, and get out. I just don't like the chip on their shoulder that nobody else is doing enough to fix the system throughout in a way that helps them achieve their goals with the least fuss.
  • platz 7y ago
    Not really security, but regarding software in general, Mud is one of the reasons I gravitated torwards pure FP languages. It doesn't solve everything, but the added guarantees help shift some of the cognitive burden away from having to dig into every method to have to see what's going on, and I can spend that mental budget elsewhere.
    • TheFiend7 7y ago
      Maybe FP forces some degree of added conformity to the code. But I find code maintenance and readability has more to do with the person writing it than the tool they used IMHO. FYI I am in fact an FP fan, and I use FP principles in a large amount of my code. But I've seen some seriously convoluted and confusing FP code just like I've seen behemoths of objects with twisted internal state manipulation balancing on blind assumptions and false guarantees of order.
    • FpUser 7y ago
      This reminds me that "but think of the children" mantra. From my observation programmers often tend to justify / promote their languages/tools/etc under pretense of solving security problems.
• x7k 7y ago
  Thanks OP for this
• luxuryballs 7y ago
  Sometimes the best way to solve a problem is to stop participating in it. Why do the security breaches matter so much in the first place? If the risk is so high and the security so bad, stop using the technology for things that demand more than provided protection. Otherwise it makes it sound as if we are being sold snake oil. (Hint it’s a stepped approach that starts with being disconnected to the internet.)
  • ehnto 7y ago
    I wonder if the idea of storing large amounts of sensitive data for use in internet connected systems is even something we should be doing. With how complex system are now, it's almost inevitable something or someone will cause a breach, knowingly or not. It probably doesn't work in many countries due to "Know Your Customer" style laws, but in my systems I throw away all but absolutely required data as I just don't want the liability. Sometimes that means I just keep a username and password hash.
• sabujp 7y ago
  beyondcorp : hardware keys and certificates for access to everything essentially
• deleted 7y ago
  [deleted]
• dogman144 7y ago
  1) Increasingly, if you want to be in infosec, you have to learn how to code on the level of a SWE. This is how to not lose your mind when constantly addressing sec issues that others (devs) are entirely responsible for fixing. 2) Department of No doesn't have to be a thing, it just takes some emotional intelligence and pragmatism. 'Always saying no' is as much the fault of the sec eng as it is the system. If you have the will power and general positive mindset, it's more than easy to go through a sec career without getting angry. It just requires not default No, and .... 3) Understand people want to do a good job. If you tell them they're doing a shitty job, they'll tell you to fuck off. If you (sarcasm font) admire what they're doing, and have some stuff that can get added to build an even better product, people are surprisingly amenable to working with you. It seems like 70% of sec folks think their job is to say No, and as a result never get there. 4) This was a huge lesson for me that made me understand the field: to be successful in sec, you must learn that your personal risk tolerance will not always equal the enterprise's risk tolerance. Making money, in a digital field, is an inherently risk-on undertaking. It's crucial to know what to not escalate beyond your team, what to not cause a fuss about, what is just a known risk that will continue to exist, and then have clear requirements for what risk you will escalate and shake cages about. It seems like all of these sec rants boil down to seeing the system and being unwilling to work within it, vs. seeing the system, accepting it, and figuring out how best to navigate it, and what tools and personal skill sets I'll really have to maximize to succeed in it.
  • authoritarian 7y ago
    >Increasingly, if you want to be in infosec, you have to learn how to code on the level of a SWE I think this depends on what kind of infosec work you plan to be doing. I have been a security engineer for the past 4ish years, and while I do have some programming/scripting skills it certainly isn't at the level of a SWE. Most of the projects I work on I end up doing pentesting, risk assessments, remediation for compliance, assisting with policies/procedures, and/or security focused devops work. It would definitely be useful if I could program at the level of an SWE, and I do plan to continue to develop my skills, but I wouldn't say that to be in infosec you have to learn to code at the level of an SWE. I agree with all your other points
• youdontknowtho 7y ago
  The main thing here is that a company that can't directly tie security to revenue will NEVER value it the way that security people think it should be valued. I can't count the number of times that some wanker used the words "I will sign off on the risk" when they didn't understand the risk that they were putting off on departments that they had no authority over. What they were really saying was, "I can tell you what to do". The truth of the thing is that business doesn't care about something being right if it can save a single penny by doing it wrong...the only way that changes is if the cost of doing it wrong becomes dramatically higher than the the savings gained from cutting corners. The operative word there is "dramatically". See the fines that companies pay to regulators when caught breaking the law as evidence.
• tabtab 7y ago
  Humans suck. They are mostly social creatures who follow social instincts to gain social credit. Logic and efficiency play a back seat to those goals. If you pretend or hope they'll become like Vulcans, you will be repeatedly disappointed.
• nathanvanfleet 7y ago
  I think it's kind of funny how burn out was previously described and how it really is. I think that if I had challenging interesting work, and my work reviews also matched my efforts, I could come into work every day and work really hard. But if either of those things are out of balance, it gets really hard to keep motivated and wake up in the morning.
• aidenn0 7y ago
  15 years ago, a classmate of mine went into security and had a similar state soon after. He decided that the entire industry was either snake-oil, or installing a 3rd deadbolt on the front door to a house with open windows. He quit the security field, became a DBA, and moved to be close to his family in the midwest, collecting a an annual paycheck roughly equal to the cost of a 4BR house there.
• StillBored 7y ago
  Well, the entire purpose of the infosec industry is to cover for the sh*t practices in the software development industry (and no it ain't engineering what most of these people practice). So you have to expect that if your vendor is CADT your security is going to be full of holes and undiscovered bugs, critical missing features/etc. Move fast and break things also means shed-loads of bugs, many of which could be exploited by an enterprising individual for gain.
• eric_b 7y ago
  We're creating more complexity every day. Kubernetes, microservices, microfrontends, "big data" lakes, etc etc. Now instead of securing a physical server, or even a VM, you have to somehow secure thousands of interconnected endpoints in PaaS products in a cloud you can't even debug appropriately. Is it a surprise our software is worse than ever these days? We've added complexity but we haven't increased our capabilities. What software can we make today that we couldn't 10 years ago? I'll even stipulate there could be a few examples, but 99% of the stuff we build today could have been built faster, cheaper and secured easier 10 years ago.
• sundbry 7y ago
  Does anyone care to explain what the big issue with syslog is? I've been using syslog-ng in production for years and it's performance has been flawless. Is there something I'm missing re: security? Is the issue the weakly-structured log formats?
• parliament32 7y ago
  >I'm mad that I sat on a call representing my company's (not cloud native) cloud offering listening to Cisco tell us that the only way to get logs from god damned IRONPORT in the cloud was to use syslog! OVER THE INTERNET. FOR SECURITY LOGS. Why is this an issue? This is how syslog works on literally every device ever, you set a destination and it streams it over UDP with optional authentication/encryption. If you want to do something hokey like consume logs over an api (what?) set up a syslog gateway and configure log retrieval how you like. You can't be mad at a vendor for not supporting your crazy log consumption scheme -- logs are push (generated), not a pull or sub or whatever you're trying to do. A normal setup would be to have a logging cluster (elasticsearch or similar). Feed logs into it via syslog or logstash or beats or whatever other bajillion plugins there are, then get logs out via the ES api (or even better, do your analysis straight in ES). The author just sounds mad he has to do actual work instead of attaching one product to another and collecting a paycheque for it.
  • tanseydavid 7y ago
    > logs are push (generated), not a pull or sub or whatever you're trying to do This is incorrect -- and myopic.
  • freehunter 7y ago
    Syslog is a plain text protocol. Sending that over the internet kinda defeats the purpose of security logging. The problem isn’t with syslog (although like the post says, syslog is still a problem for security). The problem is syslog over the internet.
• skittleson 7y ago
  I can relate to the author. Worked for now acquired payment gateway that was for PCI compliance level 1 (over 6 million transactions a year). Getting upset over outdated practices by either the company or the security company testing our software was regular.
• turk73 7y ago
  My elderly father has always viewed the Internet as a money-making scam. It doesn't occur to him that my entire career has been working with software and that I would not have had such a decent career without the Internet. I always viewed it as information being freed up, but maybe that's just a side effect? Lately, as I get older, I see the point he is trying to make in his own odd way. The way computers have always been a dismal disappointment to him, how they always seem defective or faulty and never quite "there." Why doesn't shit just work and stay working? Entropy? I currently work for a Fortune 10 and I'll bet $100 something major breaks this holiday weekend simply because the baby sitters are not there this week. It shouldn't be like that, but it is. It has been that way as long as I can remember, too. So is this all just a giant scam, then? Hell if I know. I've learned a dozen programming languages, half a dozen database products, when I first started out I was a sysadmin and had to know all the ins and outs of about five or six different UNIX products (before Linux arrived). At one point I did work with Struts, then .NET for a bit, then Spring. Every single time I had to listen to this or that recruiter tell me I wasn't qualified on that particular framework or whatever so they could wheedle me on pay. Now I work on "big data" which means Kafka, Cassandra, and Kubernetes; a bunch of beautiful, massively expensive hype. I'm currently wondering if our business will pull the plug on this project simply due to the storage costs involved compared to whatever they're getting out of it (hint: not much). Should have become an Optometrist, a Podiatrist, or just taught math...
• user132 7y ago
  I also work for a cybersecurity vendor and what I am witnessing at work looks a little similar to other comments here. Every feature and improvement goes through the same cycle: - Sales come with user stories/feedback - Boss distort the needs and comes up with a solution that's good for nobody - The engineering team tries to reason the boss into meeting the actual needs and fails 9 times out of 10 because he knows better - The feature is carefully designed to be as secure, user friendly and efficient as possible - Boss ruins the UX and security by inventing ridiculous constraints, sometime saying that we can improve on it later - Insecure and user hostile feature get released in the next software version Of course boss and sales advertise the product as the next generation of cyber security product, better than anything already out there. I've not been working here for a long time but I know I will get tired of this stuff very quickly.
• zelon88 7y ago
  I feel like a large part of the responsibility lies with the people implementing these networks to be able to document, compatramentalize, and organize these various systems in the least convoluted manner. The biggest problems I see achieving that are all the different ways of accomplishing the same goals. For example, many endpoints in a network will have 3 or 4 DRM agents on them for licensing certain products. What do they connect to? What are they sending? What infrastructure variables need to be in place to support those connections? How do I configure or troubleshoot this service/ connections? Most of these agents are critically ineffectual and simply add bloat. I've done pentests in my own environment and broken, cracked, or bypassed three. My point is, the company who hired you can't change their entire operation because of your requirements. That's why we go to work. Especially at small or medium size businesses with limited resources. "Stop using the ERP system with 12gb of data that you've had 30 people using for the past 15 years! We found a bug and the vendor won't fix it!" You can see how that's not viable. So you find a way to mitigate the bug yourself. "You need to get rid of XXX in engineering. They keep falling for phishing emails." No. You need to find some resources or setup training to combat phishing. Create rules or modify this person's environment to reduce surface area and increase visibility on that endpoint. And sometimes you can't solve it! But you can usually pick off some low hanging fruit and iterate to a more secure state than you started at.
  • naravara 7y ago
    > You need to find some resources or setup training to combat phishing. Honesty it’s so bad I think we’re best off just figuring out ways to do away with email as a primary communication mechanism altogether. When my company was smaller we had more technically savvy people, but as we’ve grown the average level of competence has sunk just to meet staffing needs and it’s impossible to keep up with training and expect people to actually really listen. So if I had my druthers it would be a blanket ban on email for all internal communication. Formal taskings get done through a PM tool, general requests for information done through Slack, and documents managed and shared by the GDrive. Email restricted only to communication with outside partners. All links and URLs are blocked. All attachments are stripped and send an email telling them to send it via an upload portal that pings the person on Slack that they have a [filename] waiting for them. Part of the problem is how much we’ve habituated people’s email habits to behave badly. We tell people over and over again not to blindly click URLs, and then by default Microsoft Teams is here emailing people every time they get mentioned in a chat with a big “view in Teams” button to click through. Users get mixed messages all the time so can we blame them for not knowing what to do? And the worst part is that the worst actors in this request are senior executives. The higher up the chain the less regard they have for following established processes.
• m0zg 7y ago
  No bud, you are burned out. You give too much shit about what is ultimately someone else's business and company. If you don't stop doing that, you will be burned out no matter where you go and what you do.
• pietrod 7y ago
  The lesson is so simple and it's all over the place: in the late term economic cycle, economical interest doesnt align with the ones of the individual. Economy have to growth, create artificial scarcity, complexity, jobs, etc, and after a while this gets so easy to spot that starts to annoy, normally from this phase you end up in a global war in fact, so at least wont last! XD