3 ms·

I was of the same opinion as you before reading the article.. but really? Genuinely just putting user input in SQL queries? I mean, everybody starts somewhere..

I was of the same opinion as you before reading the article.. but really? Genuinely just putting user input in SQL queries? I mean, everybody starts somewhere.. but how the hell do you get to be CTO of anything when nothing goes off in your brain when you're interpolating raw user input into SQL queries? WHAT? How? Everyone slips up, concatenates strings when they shouldn't, whatever.. but this genuinely looks like he didn't know that SQL injections are a thing. That is unacceptable for a technical leader.

a012 6y ago
In my book, any C levels shouldn't have direct access to production, and espectially when you become a CTO you stop coding.
- carmen_sandiego 6y ago
  Well, that surely also depends how big the company is.
- exclusiv 6y ago
  This mistake looks like he just started coding.
  - im3w1l 6y ago
    The only thing experience will do is decrease the frequency of errors. I mean this is why there is a movement to prepared statements and safer language. None of us is smart enough to sanitize correctly or avoid buffer overflows.
    - exclusiv 6y ago
      > None of us is smart enough to sanitize correctly It's just something that isn't and shouldn't be a concern of most engineers. I don't care about these things in terms of solving them. You entrust the collective wisdom in each area like security for these types of things. Which is exactly why it's hard to believe a former Facebook, veteran CTO would commit some code like this. No legitimate electrical engineer would do the equivalent.
blabitty 6y ago
Maybe it wasn't a mistake
millzlane 6y ago
I barely know much about programming. I have finished LPTHW years ago but I'm not a coder by any stretch. Even I know to google how to sanitize user inputs before putting something into production.
pillefitz 6y ago
Managing people for the most part, helping out because staff got sick, writing parts of the code between meetings, being interrupted by your child.
user-the-name 6y ago
Suffice to say, if you are remotely competent, you don't go work for far-right assholes. So you get to be the CTO but actually being an awful enough person to put up with the company.

a012 6y ago

In my book, any C levels shouldn't have direct access to production, and espectially when you become a CTO you stop coding.

carmen_sandiego 6y ago
Well, that surely also depends how big the company is.
exclusiv 6y ago
This mistake looks like he just started coding.
- im3w1l 6y ago
  The only thing experience will do is decrease the frequency of errors. I mean this is why there is a movement to prepared statements and safer language. None of us is smart enough to sanitize correctly or avoid buffer overflows.
  - exclusiv 6y ago
    > None of us is smart enough to sanitize correctly It's just something that isn't and shouldn't be a concern of most engineers. I don't care about these things in terms of solving them. You entrust the collective wisdom in each area like security for these types of things. Which is exactly why it's hard to believe a former Facebook, veteran CTO would commit some code like this. No legitimate electrical engineer would do the equivalent.

blabitty 6y ago

Maybe it wasn't a mistake

millzlane 6y ago

I barely know much about programming. I have finished LPTHW years ago but I'm not a coder by any stretch. Even I know to google how to sanitize user inputs before putting something into production.

pillefitz 6y ago

Managing people for the most part, helping out because staff got sick, writing parts of the code between meetings, being interrupted by your child.

user-the-name 6y ago

Suffice to say, if you are remotely competent, you don't go work for far-right assholes. So you get to be the CTO but actually being an awful enough person to put up with the company.