4 ms·

Indeed, if that timeline is to be believed—and I have no reason to doubt it—it’s pretty damning. GitHub just kept putting it off. When they asked to delay the d

Indeed, if that timeline is to be believed—and I have no reason to doubt it—it’s pretty damning. GitHub just kept putting it off. When they asked to delay the disclosure indefinitely at the very last second, of course they were told that would be unacceptable.

naikrovek 6y ago
I dunno. I've worked in many places that ABSOLUTELY had the desire, willingness, money, time, and ability to do something, and were still unable to make that thing happen, for reasons that can't be spoken about. While it is true that if an entire organization wants something done that it will happen, it is not true that inaction by an organization always signifies unwillingness or inability to act. It's easy to sit on the sidelines and throw tomatoes at the parties involved. It is another matter entirely when you are hamstrung by internal process or a specific power-tripping and ignorant person in management.
- nemetroid 6y ago
  > It is another matter entirely when you are hamstrung by internal process or a specific power-tripping and ignorant person in management. That still sounds like unwillingness or inability to me.
- saghm 6y ago
  If that were the case, I feel like Github should have responded on 10-28, when Project Zero reached out mentioning that the deadline was approaching. If they asked for another extension then rather than just not responding, maybe Project Zero would have considered being more accommodating?
- ikawe 6y ago
  Even if there exists some really well intentioned hamstrung individuals within the organization, I think it's desirable to highlight and potentially shame institution as a whole that aren't able to effectively mobilize. What's the viable alternative?
- izacus 6y ago
  >While it is true that if an entire organization wants something done that it will happen, it is not true that inaction by an organization always signifies unwillingness or inability. It's easy to sit on the sidelines and throw tomatoes at the parties involved. It is another matter entirely when you are hamstrung by internal process or a specific power-tripping and ignorant person in management. The thing is, major releases and public shaming is pretty much the only thing that has a (not guaranteed) chance of moving these processes or stubborn people. Before that they learn to just delay indefinately.
  - naikrovek 6y ago
    I agree. Just be careful when you assign motive to an entire organization when it could be just a single person inside being an ass. Repeated shaming of this nature should weed those people out, but it won't always have that effect.
    - ponker 6y ago
      When people ascribe a motive to an organization nobody thinks that every single person in the organization has that motive. Rather what it means is that the organization's structure and members cause the organization to act in accordance with that motive.
      - bbarnett 6y ago
        Indeed. And whether it's one person, a group of people, or a departmental "culture", is meaningless. The org allows it to happen, CEO downward, through all the ranks. It is entirely the corp/org's fault, and yes, that reputation can rub off on you.
    - izacus 6y ago
      > I agree. Just be careful when you assign motive to an entire organization when it could be just a single person inside being an ass. Preventing motivations of a single person inside an organization from tanking its products and direction is one of the main jobs for organizational management. Good companies are resistant to fiefdom building and having managers damage their reputation for personal gain.
- codeflo 6y ago
  I think you're right that this is often the case, and my heartfelt sympathies go to any engineer who struggles to do the right thing in that situation. But in what sense are these kinds of internal politics NOT "unwillingness or inability", at least at the organizational level? Organizations where managers are allowed to play political games at the expense of users' security are not to be trusted with any sensitive data, and need to be publicly called out and shamed if there's any hope to effect change.
  - naikrovek 6y ago
    > But in what sense are these kinds of internal politics NOT "unwillingness or inability", at least at the organizational level? An example from my past should demonstrate... A single manager in my past simultaneously: A) told higher management that something was not possible, and B) told the org under him that management didn't want that same thing done, and C) convinced his peers to let him manage this personal pet project alone. The only person that knew the truth at the time was the lone person who didn't want it done. Result: it didn't happen. This is extraordinarily common, in my experience, though only this particular person could do it this well. The entire organization wanted something done except one guy who convinced everyone to let him have the power to stop it without anyone understanding what they were letting him do. You may argue that this is an organization being unwilling to act via its own structure, and I would counter that this person was very skilled at this type of deception, and succeeded at this type of thing despite the organization above, below, and around him all being pretty much standard.
    - bbarnett 6y ago
      Upper management's job is to manage. Being "convinced" of something, means they did their job, made a judgement and management call, but got it wrong. That's their fault too. It's also the fault of other employees, who did not speak up. You're painting a picture of everyone being incapable of judging things on their own, because someone talked them out of what they knew to be correct. Who's fault is that?
    - wolco2 6y ago
      The org put this guy in charge. He decided to not fix something. He represents the org on this issue. Therefore the org doesn't want it.
- zobzu 6y ago
  an organization is not a human, despite what people say. A single human may be absolutely willing to act, but the organization won't - i.e. they will not be allowed to act by their bosses. Everything else is nitpicking and blame shifting. If someone's willing to do the job "but they have too many other things to do" then they're not willing to do the job. If someone's boss or with authority over them is unwilling to prioritize the work then they're unwilling to do the work as well.

naikrovek 6y ago

I dunno. I've worked in many places that ABSOLUTELY had the desire, willingness, money, time, and ability to do something, and were still unable to make that thing happen, for reasons that can't be spoken about. While it is true that if an entire organization wants something done that it will happen, it is not true that inaction by an organization always signifies unwillingness or inability to act. It's easy to sit on the sidelines and throw tomatoes at the parties involved. It is another matter entirely when you are hamstrung by internal process or a specific power-tripping and ignorant person in management.

nemetroid 6y ago
> It is another matter entirely when you are hamstrung by internal process or a specific power-tripping and ignorant person in management. That still sounds like unwillingness or inability to me.
saghm 6y ago
If that were the case, I feel like Github should have responded on 10-28, when Project Zero reached out mentioning that the deadline was approaching. If they asked for another extension then rather than just not responding, maybe Project Zero would have considered being more accommodating?
ikawe 6y ago
Even if there exists some really well intentioned hamstrung individuals within the organization, I think it's desirable to highlight and potentially shame institution as a whole that aren't able to effectively mobilize. What's the viable alternative?
izacus 6y ago
>While it is true that if an entire organization wants something done that it will happen, it is not true that inaction by an organization always signifies unwillingness or inability. It's easy to sit on the sidelines and throw tomatoes at the parties involved. It is another matter entirely when you are hamstrung by internal process or a specific power-tripping and ignorant person in management. The thing is, major releases and public shaming is pretty much the only thing that has a (not guaranteed) chance of moving these processes or stubborn people. Before that they learn to just delay indefinately.
- naikrovek 6y ago
  I agree. Just be careful when you assign motive to an entire organization when it could be just a single person inside being an ass. Repeated shaming of this nature should weed those people out, but it won't always have that effect.
  - ponker 6y ago
    When people ascribe a motive to an organization nobody thinks that every single person in the organization has that motive. Rather what it means is that the organization's structure and members cause the organization to act in accordance with that motive.
    - bbarnett 6y ago
      Indeed. And whether it's one person, a group of people, or a departmental "culture", is meaningless. The org allows it to happen, CEO downward, through all the ranks. It is entirely the corp/org's fault, and yes, that reputation can rub off on you.
  - izacus 6y ago
    > I agree. Just be careful when you assign motive to an entire organization when it could be just a single person inside being an ass. Preventing motivations of a single person inside an organization from tanking its products and direction is one of the main jobs for organizational management. Good companies are resistant to fiefdom building and having managers damage their reputation for personal gain.
codeflo 6y ago
I think you're right that this is often the case, and my heartfelt sympathies go to any engineer who struggles to do the right thing in that situation. But in what sense are these kinds of internal politics NOT "unwillingness or inability", at least at the organizational level? Organizations where managers are allowed to play political games at the expense of users' security are not to be trusted with any sensitive data, and need to be publicly called out and shamed if there's any hope to effect change.
- naikrovek 6y ago
  > But in what sense are these kinds of internal politics NOT "unwillingness or inability", at least at the organizational level? An example from my past should demonstrate... A single manager in my past simultaneously: A) told higher management that something was not possible, and B) told the org under him that management didn't want that same thing done, and C) convinced his peers to let him manage this personal pet project alone. The only person that knew the truth at the time was the lone person who didn't want it done. Result: it didn't happen. This is extraordinarily common, in my experience, though only this particular person could do it this well. The entire organization wanted something done except one guy who convinced everyone to let him have the power to stop it without anyone understanding what they were letting him do. You may argue that this is an organization being unwilling to act via its own structure, and I would counter that this person was very skilled at this type of deception, and succeeded at this type of thing despite the organization above, below, and around him all being pretty much standard.
  - bbarnett 6y ago
    Upper management's job is to manage. Being "convinced" of something, means they did their job, made a judgement and management call, but got it wrong. That's their fault too. It's also the fault of other employees, who did not speak up. You're painting a picture of everyone being incapable of judging things on their own, because someone talked them out of what they knew to be correct. Who's fault is that?
  - wolco2 6y ago
    The org put this guy in charge. He decided to not fix something. He represents the org on this issue. Therefore the org doesn't want it.
zobzu 6y ago
an organization is not a human, despite what people say. A single human may be absolutely willing to act, but the organization won't - i.e. they will not be allowed to act by their bosses. Everything else is nitpicking and blame shifting. If someone's willing to do the job "but they have too many other things to do" then they're not willing to do the job. If someone's boss or with authority over them is unwilling to prioritize the work then they're unwilling to do the work as well.