2 ms·
This is an epic mess in the making to be honest and no one takes it seriously. It’s really not important at all for anyone I have spoken to. Most of our stacks
by uncledave 6y ago
This is an epic mess in the making to be honest and no one takes it seriously. It’s really not important at all for anyone I have spoken to. Most of our stacks are magical fucking unicorns to the marketing and decision makers and the majority of the developers these days. The level of response I get is akin to “but it’s got electrolytes” while blindly downloading god knows what into production kubernetes clusters. Hell even kubernetes does it. I’m waiting for something to waltz in and do some damage. Even worse is some of the scanning software which itself ships with CVE ridden dependencies. I mentioned this to one of the larger supply chain scanning vendors and they didn’t even know.
99% of our tech is like smoking to look cool and being in with the crowd. But someone’s going to get cancer one day.
- marcus_holmes 6y agoI take it seriously, and I'm considered a crusty old lunatic sitting in the corner ranting about imaginary security problems. I built my own version of WebPack because I couldn't trust the huge number of maintainers in the dependency chain for that project. Docker/Kube gives me the screaming heebie-jeebies. The only time anyone will take it seriously is when they're hacked. And then their defence will be "but this is what everyone does! It's industry-standard". I've come to accept it's a fact of life in the industry at the moment. Hopefully it'll change, but the only way I can see it changing is if the level of hacking increases to become intolerable. Yet there appears to be a high tolerance for hacking incidencts - it's accepted folklore that hackers are very smart people that can't be stopped no matter how good your system is.