4 ms·

Or maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels. There are numerous exam

Or maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels. There are numerous examples of start ups and even mature companies making basic mistakes. This is easily explainable without resorting to conspiracy theories.

btmcnellis 6y ago
"solarwinds123" comes to mind.
- ratsmack 6y ago
  This comment is highly underrated.
eternalban 6y ago
> maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels. "Free Speech platform Gab has announced Fosco Marotto as the company’s new Chief Technical Officer (CTO). According to a blog post from the company, Marotto was formerly a software engineer, production engineer, and developer advocate during a seven-year career at Facebook. Marotto reportedly brings 23 years of industry experience to the platform along with extensive knowledge in backend infrastructure and insight that will help Gab scale as it becomes increasingly popular." CTO: https://github.com/gfosco https://github.com/gfosco Parse Server: https://github.com/parse-community/parse-server https://github.com/parse-community/parse-server Parse Server API doc snippet: "If your app is compromised, it’s not only you as the developer who suffers, but potentially the users of your app as well. Continue reading for our suggestions for sensible defaults and precautions to take before releasing your app into the wild." https://docs.parseplatform.org/rest/guide/#security https://docs.parseplatform.org/rest/guide/#security Per Ars, he removed security code.
- rsynnott 6y ago
  I mean, "worked at Facebook for a while" isn't a guarantee of competence. And some security boilerplate text isn't a guarantee of being good at security.
  - eternalban 6y ago
    You want guarantees in software resources? Have you heard about the famous interview torture for jobs? Your OP wanted to paint a picture of inexperienced development team. Both items in my post show that both the team (who initially had it right) and the CTO (who inexplicably removed the two lines) are definitely experienced. That Parse Server looks like a substantial piece of code and there is a community around it, so let's be fair and grant the CTO a measure of competence, shall we?
    - rsynnott 6y ago
      I mean, given a choice between "an incompetent programmer with seven years work experience exists", and "Gab as a whole is some sort of weird honeypot", Occam's razor probably suggests the incompetent programmer.
      - eternalban 6y ago
        23 years of experience + Existing codebase demonstrating care for matter such as filtering input == experienced. Certainly not clueless. I said absolutely nothing about a honey pot. Review my posts. Occam's razor strongly suggests to not make un-necessary assumptions. My post challenges your assertion of incompetence. You need to remove that assumption from your analysis.
        rsynnott 6y ago
        The thread was about the claim that it _must_ be a honeypot because it's so incompetent. What's your theory for how this happened, if neither incompetence nor deliberate?
        6y ago
- GVIrish 6y ago
  So there are a couple of things here: *A strong engineering team should've had vulnerability scans at some point in their build process. That SQL injection vulnerability would've been easy to spot *That SQL injection probably should've been picked up in a code review *They should have been using parameterized queries in the first place. The fact he removed input sanitization methods is besides the point, that they shouldn't have been relying on those in the first place. *A senior engineer or CTO should've known better. But I've seen very senior people make bad mistakes before. These mistakes are much more likely with immature processes and safeguards. *Sometimes someone can get to a 'senior' level without necessarily knowing how to do some aspects of software engineering well. A strong engineering team is about the performance and practices of the whole group. You can have individuals who are experienced at particular skills but have big gaps in the skills and experience needed to build a strong team.
  - eternalban 6y ago
    I couldn’t reply earlier (“posting too fast”). These are all solid points modulo the optics of memory holing commits.

btmcnellis 6y ago

"solarwinds123" comes to mind.

ratsmack 6y ago
This comment is highly underrated.

eternalban 6y ago

> maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels. "Free Speech platform Gab has announced Fosco Marotto as the company’s new Chief Technical Officer (CTO). According to a blog post from the company, Marotto was formerly a software engineer, production engineer, and developer advocate during a seven-year career at Facebook. Marotto reportedly brings 23 years of industry experience to the platform along with extensive knowledge in backend infrastructure and insight that will help Gab scale as it becomes increasingly popular." CTO: https://github.com/gfosco https://github.com/gfosco Parse Server: https://github.com/parse-community/parse-server https://github.com/parse-community/parse-server Parse Server API doc snippet: "If your app is compromised, it’s not only you as the developer who suffers, but potentially the users of your app as well. Continue reading for our suggestions for sensible defaults and precautions to take before releasing your app into the wild." https://docs.parseplatform.org/rest/guide/#security https://docs.parseplatform.org/rest/guide/#security Per Ars, he removed security code.

rsynnott 6y ago
I mean, "worked at Facebook for a while" isn't a guarantee of competence. And some security boilerplate text isn't a guarantee of being good at security.
- eternalban 6y ago
  You want guarantees in software resources? Have you heard about the famous interview torture for jobs? Your OP wanted to paint a picture of inexperienced development team. Both items in my post show that both the team (who initially had it right) and the CTO (who inexplicably removed the two lines) are definitely experienced. That Parse Server looks like a substantial piece of code and there is a community around it, so let's be fair and grant the CTO a measure of competence, shall we?
  - rsynnott 6y ago
    I mean, given a choice between "an incompetent programmer with seven years work experience exists", and "Gab as a whole is some sort of weird honeypot", Occam's razor probably suggests the incompetent programmer.
    - eternalban 6y ago
      23 years of experience + Existing codebase demonstrating care for matter such as filtering input == experienced. Certainly not clueless. I said absolutely nothing about a honey pot. Review my posts. Occam's razor strongly suggests to not make un-necessary assumptions. My post challenges your assertion of incompetence. You need to remove that assumption from your analysis.
      - rsynnott 6y ago
        The thread was about the claim that it _must_ be a honeypot because it's so incompetent. What's your theory for how this happened, if neither incompetence nor deliberate?
        6y ago
GVIrish 6y ago
So there are a couple of things here: *A strong engineering team should've had vulnerability scans at some point in their build process. That SQL injection vulnerability would've been easy to spot *That SQL injection probably should've been picked up in a code review *They should have been using parameterized queries in the first place. The fact he removed input sanitization methods is besides the point, that they shouldn't have been relying on those in the first place. *A senior engineer or CTO should've known better. But I've seen very senior people make bad mistakes before. These mistakes are much more likely with immature processes and safeguards. *Sometimes someone can get to a 'senior' level without necessarily knowing how to do some aspects of software engineering well. A strong engineering team is about the performance and practices of the whole group. You can have individuals who are experienced at particular skills but have big gaps in the skills and experience needed to build a strong team.
- eternalban 6y ago
  I couldn’t reply earlier (“posting too fast”). These are all solid points modulo the optics of memory holing commits.