4 ms·

How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply ship

How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for.

nobody9999 6y ago
>How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for. Police are credited with making arrests, but are almost never credited with treating people with respect. By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. Doing the right thing for the right reasons is (or should be) a thing. That it isn't doesn't say much for those who ignore an important aspect of software design. I've always striven to meet the ideal that "if it's worth doing, it's worth doing properly." I suppose that I shouldn't hold others to the standards I set for myself, but sometimes I still do. Feel free to be offended, but I stand by my original statement: "4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration."
- dragonwriter 6y ago
  > Police are credited with making arrests, but are almost never credited with treating people with respect. > By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. No, by their argument, to the extent your first quoted sentence is true, police are (not “should be”) encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. Which seems pretty accurate.
  - nobody9999 6y ago
    >Which seems pretty accurate. Exactly. Which is why it was a good analogy WRT the lack of security baked into the design of most software.
- HexagonalKitten 6y ago
  > the most egregious offenders are software developers Blame always rises. Management knows that any product without extensive review is going to be bad. They push it out the door without that review because quality costs. Stockholders know. Software is bad because you can't sue the companies that made it.
  - nobody9999 6y ago
    >Blame always rises. Management knows that any product without extensive review is going to be bad. They push it out the door without that review because quality costs. Stockholders know. Software is bad because you can't sue the companies that made it. I get that a variety of pressures are put on developers to add features and ship quickly. But whether it's corporate development done internally (e.g., LOB applications), a web app or a SaaS offering, not designing security into the software is a disaster waiting to happen. So many times I've seen businesses have their crown jewels ripped off due to poorly implemented/weak or non-existent security practices in application design/development. Even when the infrastructure is reasonably well secured, with defense-in-depth, including strong authn/authz, separation of duties, as well as strong security processes and policies in place, software that lacks designed-in security can render all of it useless. Whether that's because the software doesn't/can't integrate with the security tools in use (often requiring applications to run with much higher privilege than they should) or because little or no thought was given to secure coding mechanisms or access controls. I absolutely understand that there are always security trade-offs, regardless of where in a multi-layered infrastructure/management/application environment. And it's always important not to expend resources beyond what's appropriate for the assets being secured. That said, application software is the most frequent culprit in enabling compromises (followed closely by poor security implementation in the infrastructure and a lack of policy/process in securing it -- usually through ignorance/incompetence). My argument is not that developers are stupid or ignorant, but that security isn't baked-in to their design decisions as a guiding principle. And that often leads to insecure software and/or sloppy/insecure integration of security after the fact. If more developers thought about security as a feature rather than an inconvenience to be given little thought or just lip service, that would make a big difference. Edit: Clarified verbiage and fixed typos.
- nautilus12 6y ago
  This is equivalent to me saying I blame security researchers because they don't develop software which forces all software paradigms to follow rules that implement perfectly secure software

nobody9999 6y ago

>How can you blame software engineers when they are given literally 0 credit for developing software with security in mind and 100 percent credit for simply shipping as quickly as possible. Developing with security in mind will take longer and is literally the opposite of what companies ask for. Police are credited with making arrests, but are almost never credited with treating people with respect. By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. Doing the right thing for the right reasons is (or should be) a thing. That it isn't doesn't say much for those who ignore an important aspect of software design. I've always striven to meet the ideal that "if it's worth doing, it's worth doing properly." I suppose that I shouldn't hold others to the standards I set for myself, but sometimes I still do. Feel free to be offended, but I stand by my original statement: "4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration."

dragonwriter 6y ago
> Police are credited with making arrests, but are almost never credited with treating people with respect. > By your logic, police should be encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. No, by their argument, to the extent your first quoted sentence is true, police are (not “should be”) encouraged to treat those they're supposed to protect and serve with disrespect and err on the side of locking people up, rather than trying to create a safer, more prosperous community. Which seems pretty accurate.
- nobody9999 6y ago
  >Which seems pretty accurate. Exactly. Which is why it was a good analogy WRT the lack of security baked into the design of most software.
HexagonalKitten 6y ago
> the most egregious offenders are software developers Blame always rises. Management knows that any product without extensive review is going to be bad. They push it out the door without that review because quality costs. Stockholders know. Software is bad because you can't sue the companies that made it.
- nobody9999 6y ago
  >Blame always rises. Management knows that any product without extensive review is going to be bad. They push it out the door without that review because quality costs. Stockholders know. Software is bad because you can't sue the companies that made it. I get that a variety of pressures are put on developers to add features and ship quickly. But whether it's corporate development done internally (e.g., LOB applications), a web app or a SaaS offering, not designing security into the software is a disaster waiting to happen. So many times I've seen businesses have their crown jewels ripped off due to poorly implemented/weak or non-existent security practices in application design/development. Even when the infrastructure is reasonably well secured, with defense-in-depth, including strong authn/authz, separation of duties, as well as strong security processes and policies in place, software that lacks designed-in security can render all of it useless. Whether that's because the software doesn't/can't integrate with the security tools in use (often requiring applications to run with much higher privilege than they should) or because little or no thought was given to secure coding mechanisms or access controls. I absolutely understand that there are always security trade-offs, regardless of where in a multi-layered infrastructure/management/application environment. And it's always important not to expend resources beyond what's appropriate for the assets being secured. That said, application software is the most frequent culprit in enabling compromises (followed closely by poor security implementation in the infrastructure and a lack of policy/process in securing it -- usually through ignorance/incompetence). My argument is not that developers are stupid or ignorant, but that security isn't baked-in to their design decisions as a guiding principle. And that often leads to insecure software and/or sloppy/insecure integration of security after the fact. If more developers thought about security as a feature rather than an inconvenience to be given little thought or just lip service, that would make a big difference. Edit: Clarified verbiage and fixed typos.
nautilus12 6y ago
This is equivalent to me saying I blame security researchers because they don't develop software which forces all software paradigms to follow rules that implement perfectly secure software