8 ms·

Here, here! Learning someething, and selling (for money, or otherwise) the not-acceptable-for-use side effect of your learning something as a 'finished' produc

by count 16y ago

Here, here! Learning someething, and selling (for money, or otherwise) the not-acceptable-for-use side effect of your learning something as a 'finished' product can be dangerous to the end customer. Not being able to skateboard well means you're going to fall and bust your knees or elbows or face. It's dangerous to you, and potentially comedic to your compatriots. Publishing a website full of XSS/SQLI problems and storing passwords and credit card numbers in plain text is dangerous to every person using your site, the business it's backing, and countless others in a 'could cost them real money and personal harm' fashion. It's also hilarious to some people (see HBGary / Valve / etc. hacks). Compare software engineering to physical engineering - you don't let the kid out of highschool who's good with Lego Kinnects build a bridge or skyscraper. He goes through years of formal training, and then years more of on the job training, working his way up from Bus Stop Shelters to Sheds to Houses, etc. before he gets to that point. THAT is the reason I'm highly critical of the efforts of people I know (or don't know in some instances). This shit ACTUALLY MATTERS beyond 'hey isn't that neat?'. If you're doing some project on your laptop to learn a technology - Awesome, can I help you with questions/guidance? If you've published something or sold something as a product and it's full of issues that could be serious problems to people down the line, What the fuck is your problem? Unlike real engineers, who have a formal body of governance and redress for customers of shitty engineers, software engineering is the wild wild west. Many people just blame the computer, without realizing there was a person unqualified for the job sitting behind the computer making it work improperly. Until that changes (if ever), then I think it's the DUTY of geeks and nerds to challenge each other as harshly as possible, in an effort to prevent certain disaster.

swix 16y ago
You probably have one of the most poisonous perspectives one can have in this type of thing, this is exactly why the world sucks. There _NEVER_ is a reason to give "harsh" feedback, go read some kevin pollak or study psychology, humans are not "dogs" giving harsh or stupid feedback wont change the broken product. Offer your help, "Holy shit dude you have a XSS/SQLI in there, lets fix that up before you get in trouble". You are probably one of those people that wouldn't help someone on the edge of a roof trying to commit suicide. Just sayin.
- jokermatt999 16y ago
  That last line is completely unnecessary, and rather ironic considering you were chastising someone for harsh feedback.
  - swix 16y ago
    It was by design, what do you expect if you are "One of those people", that you can be harsh to everyone and everyone is supposed to be polite and delightful towards you?
- count 16y ago
  I spend many, many hours helping people learn, and not by pushing them off the edges of buildings. Even google has had XSS style problems - that shit is HARD. One form field having filtering issues is one thing, a whole site of problems with absolutely no effort put in to mitigate what are, effectively, known issues, is an entirely different thing. If you're not worried about anything security related on a public website in 2011, you don't deserve to live on the public internet, and should jump.
danenania 16y ago
Not to diminish the importance of doing good work, but the reality is that knowledge and expertise are part of a continuum and even well-respected experts can easily make mistakes. If you're trying to make a living, you have to attempt to sell yourself at whatever level you're at, then work to keep improving. It's the customer's responsibility to do due diligence and discover potentially critical gaps in expertise, not the provider's to trumpet his/her own weaknesses. This is just the nature of a marketplace. The hacker who postures a bit in order to get a job he isn't truly suited for, but works hard to get up to speed and does his best, will be much better off in the long run than a hacker who declines the project, even if it leads to problems for the buyer later on. There's only so much you can learn without jumping in the deep end, but in order to get that chance, you often need to give the impression you've been swimming in the deep end for years. That's how the world works.
- count 16y ago
  I fully agree with you - everybody has to start somewhere, and nobody gets ahead just doing things they're 100% comfortable with. That said, if you're going to give the impression that you can swim in the deep end, you need to be fully prepared to suffer the blowback if it's discovered that you actually can't swim in the deep end. In response to the due diligence - this sort of goes down a rathole, but the industry as a whole is lacking serious professionalism and credibility standards (certifications don't count, in general). There is no professional liability (aside from personal name besmirching - hence the harsh criticism and feedback). If you get hired in 2011 to do a site for someone, and your database stores passwords in plaintext - in my mind, that's a fundamental enough error that you SHOULD be able to be held professionally and legally liable. I'll be the first to admit - the problem with this is the question of where do you draw the line? What SHOULD everybody know AT MINIMUM before they can commercially sell services like that? I hate the idea of licensing as much as anybody else, but our only recourse is 'self-policing' - hence the harsh criticism and attacks.
  - danenania 16y ago
    I agree that the issues you mention are important, but unless these requirements are spelled out in a contract, there is definitely no basis for legal liability, and any attempt to establish one is guaranteed to be a disaster. Caveat emptor! The alternatives are much worse.
agentultra 16y ago
This is exactly the kind of thing I'm talking about though. I believe a lot of this bad advice stems from thie belief that "other people write bad software." When you run into bugs day in and out, it's easy to reinforce this belief. Afterall, how can someone who claims to have all this experience and knowledge make such an obvious mistake? They're paid a salary and millions of people trust their software! I could do it better. The reality I believe is that these sorts of people are really compensating for the flaws they themselves are prone to making. When they catch these sorts of errors, they're just reinforcing patterns they themselves recognize as bad; likely because they themselves have made such a mistake in the past that someone else had pointed out to them. So when they call someone an "idiot," they're really calling themselves an "idiot," and bringing the other person down with them to bolster their sense of self worth. The truth is that we all are guilty of making mistakes. Operating systems that run the Internet, control nuclear reactors, and send really expensive robots into space all have bugs. They have security flaws. And they were written by individuals who've spent a significant amount of time paying their dues in the ivory tower and working their way up the career ladder. That a novice can also make the same mistake is not coincidence. It's human nature.
- count 16y ago
  I empathize with what you are saying, but I don't agree. I think it's crucial to recognize the difference between what I'm talking about, and what happens when people with experience make mistakes. Environment matters, tremendously. If you're an amateur hack, selling your 3rd rate skills to customers who don't know any better, and you're lack of capability is hurting people because your software is being exploited, the response SHOULD be swift, and harsh. If you are working within a framework of extensive testing, analysis, and basic rigor, and a mistake makes it through, and you add that case to your testing and learn from it, the response should be moderated significantly. Just because someone with 2 months of PHP experience CAN stand up a web service and take credit cards over the internet and become the next web success story, doesn't mean that they should. I believe this industry has gotten to the point where there needs to be minimum table stakes for entry - you can't just find somebody who'll design and sign off on a house for you for super cheap because they're new. There's a reason for that. Until IT moves out of the wild wild west, though, it needs to be policed like the wild wild west - shoot the idiots that threaten the town. Sorry that's kind of rambling, but I think it mostly gets my point across?
discreteevent 16y ago
I think you make a good point and I really don't mean to be critical but the pedant in me must point out that the correct phrase is "hear hear" ....or should I say: WTF man! English is your native tounge. What the hell are you doing writing if its clear that you don't even read??? How could "here here" make any sense as a phrase? And if it doesn't make any sense why don't you take the fing finger out and google it!!! Have you been this moronic all your life or have you just started recently?
- count 16y ago
  I just started recently. My initial impulse was 'THIS!' and nothing more, but I figured that'd get me nothing but downvotes, instead of furthering the conversation. I can take harsh criticism, as long as it's not ad hominem. You, for instance, are absolutely correct, and that is a pretty embarrassing mistake. Thank you for pointing it out. I'd fix it, but it's past the edit window. PS: Mr. Grammar Nazi, it's 'tongue' :)

by count 16y ago

swix 16y ago

You probably have one of the most poisonous perspectives one can have in this type of thing, this is exactly why the world sucks. There _NEVER_ is a reason to give "harsh" feedback, go read some kevin pollak or study psychology, humans are not "dogs" giving harsh or stupid feedback wont change the broken product. Offer your help, "Holy shit dude you have a XSS/SQLI in there, lets fix that up before you get in trouble". You are probably one of those people that wouldn't help someone on the edge of a roof trying to commit suicide. Just sayin.

jokermatt999 16y ago
That last line is completely unnecessary, and rather ironic considering you were chastising someone for harsh feedback.
- swix 16y ago
  It was by design, what do you expect if you are "One of those people", that you can be harsh to everyone and everyone is supposed to be polite and delightful towards you?
count 16y ago
I spend many, many hours helping people learn, and not by pushing them off the edges of buildings. Even google has had XSS style problems - that shit is HARD. One form field having filtering issues is one thing, a whole site of problems with absolutely no effort put in to mitigate what are, effectively, known issues, is an entirely different thing. If you're not worried about anything security related on a public website in 2011, you don't deserve to live on the public internet, and should jump.

danenania 16y ago

Not to diminish the importance of doing good work, but the reality is that knowledge and expertise are part of a continuum and even well-respected experts can easily make mistakes. If you're trying to make a living, you have to attempt to sell yourself at whatever level you're at, then work to keep improving. It's the customer's responsibility to do due diligence and discover potentially critical gaps in expertise, not the provider's to trumpet his/her own weaknesses. This is just the nature of a marketplace. The hacker who postures a bit in order to get a job he isn't truly suited for, but works hard to get up to speed and does his best, will be much better off in the long run than a hacker who declines the project, even if it leads to problems for the buyer later on. There's only so much you can learn without jumping in the deep end, but in order to get that chance, you often need to give the impression you've been swimming in the deep end for years. That's how the world works.

count 16y ago
I fully agree with you - everybody has to start somewhere, and nobody gets ahead just doing things they're 100% comfortable with. That said, if you're going to give the impression that you can swim in the deep end, you need to be fully prepared to suffer the blowback if it's discovered that you actually can't swim in the deep end. In response to the due diligence - this sort of goes down a rathole, but the industry as a whole is lacking serious professionalism and credibility standards (certifications don't count, in general). There is no professional liability (aside from personal name besmirching - hence the harsh criticism and feedback). If you get hired in 2011 to do a site for someone, and your database stores passwords in plaintext - in my mind, that's a fundamental enough error that you SHOULD be able to be held professionally and legally liable. I'll be the first to admit - the problem with this is the question of where do you draw the line? What SHOULD everybody know AT MINIMUM before they can commercially sell services like that? I hate the idea of licensing as much as anybody else, but our only recourse is 'self-policing' - hence the harsh criticism and attacks.
- danenania 16y ago
  I agree that the issues you mention are important, but unless these requirements are spelled out in a contract, there is definitely no basis for legal liability, and any attempt to establish one is guaranteed to be a disaster. Caveat emptor! The alternatives are much worse.

agentultra 16y ago

This is exactly the kind of thing I'm talking about though. I believe a lot of this bad advice stems from thie belief that "other people write bad software." When you run into bugs day in and out, it's easy to reinforce this belief. Afterall, how can someone who claims to have all this experience and knowledge make such an obvious mistake? They're paid a salary and millions of people trust their software! I could do it better. The reality I believe is that these sorts of people are really compensating for the flaws they themselves are prone to making. When they catch these sorts of errors, they're just reinforcing patterns they themselves recognize as bad; likely because they themselves have made such a mistake in the past that someone else had pointed out to them. So when they call someone an "idiot," they're really calling themselves an "idiot," and bringing the other person down with them to bolster their sense of self worth. The truth is that we all are guilty of making mistakes. Operating systems that run the Internet, control nuclear reactors, and send really expensive robots into space all have bugs. They have security flaws. And they were written by individuals who've spent a significant amount of time paying their dues in the ivory tower and working their way up the career ladder. That a novice can also make the same mistake is not coincidence. It's human nature.

count 16y ago
I empathize with what you are saying, but I don't agree. I think it's crucial to recognize the difference between what I'm talking about, and what happens when people with experience make mistakes. Environment matters, tremendously. If you're an amateur hack, selling your 3rd rate skills to customers who don't know any better, and you're lack of capability is hurting people because your software is being exploited, the response SHOULD be swift, and harsh. If you are working within a framework of extensive testing, analysis, and basic rigor, and a mistake makes it through, and you add that case to your testing and learn from it, the response should be moderated significantly. Just because someone with 2 months of PHP experience CAN stand up a web service and take credit cards over the internet and become the next web success story, doesn't mean that they should. I believe this industry has gotten to the point where there needs to be minimum table stakes for entry - you can't just find somebody who'll design and sign off on a house for you for super cheap because they're new. There's a reason for that. Until IT moves out of the wild wild west, though, it needs to be policed like the wild wild west - shoot the idiots that threaten the town. Sorry that's kind of rambling, but I think it mostly gets my point across?

discreteevent 16y ago

I think you make a good point and I really don't mean to be critical but the pedant in me must point out that the correct phrase is "hear hear" ....or should I say: WTF man! English is your native tounge. What the hell are you doing writing if its clear that you don't even read??? How could "here here" make any sense as a phrase? And if it doesn't make any sense why don't you take the fing finger out and google it!!! Have you been this moronic all your life or have you just started recently?

count 16y ago
I just started recently. My initial impulse was 'THIS!' and nothing more, but I figured that'd get me nothing but downvotes, instead of furthering the conversation. I can take harsh criticism, as long as it's not ad hominem. You, for instance, are absolutely correct, and that is a pretty embarrassing mistake. Thank you for pointing it out. I'd fix it, but it's past the edit window. PS: Mr. Grammar Nazi, it's 'tongue' :)