5 ms·

This, in my experience, is overwhelmingly to blame: >“If an organisation needs an application to be released to make a specific deadline regarding market oppor

This, in my experience, is overwhelmingly to blame: >“If an organisation needs an application to be released to make a specific deadline regarding market opportunity or new features, developers are often caught between hitting that no matter what or potentially delaying the fix of critical or high-risk vulnerabilities.” [said Simon Roe, Product Manager at Outpost24] And: >... dev teams are often measured by feature output, and security isn’t usually seen as a feature. “Unless security is viewed as a feature, it will be viewed as a tax,” according to Tim Mackey, Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre).

junon 5y ago
What's worse, in several jurisdictions (some places in the US included, IIRC), if a company is found to have caused damages based on this sort of "negligence", the developers are legally to blame - not management.
- lhnz 5y ago
  You'd presumably be fired or PIPed if you often held back releases for security reasons so the liability seems poorly placed.
- aliasEli 5y ago
  In most jurisdictions I know, the developer would be safe if he could show that he warned management about the security problem. In situation like this always write an e-mail to your manager and keep a copy in a safe place.
- matheusmoreira 5y ago
  The company and its developers should be liable. Developers know it is wrong and yet they do it anyway. The fact management told them to do it doesn't matter. Real engineers don't sign off on a project if they think the building is going to fall apart. If a company starts ignoring security for the sake of profit, developers should react by literally walking out and refusing to have anything to do with the project. Anything else means they share the blame.
  - chousuke 5y ago
    The problem is, what power allows the developer to refuse? If they do, a manager can find someone who won't, and developers who stand by their principles will lose to competition. A building engineer could probably drop a hint somewhere and have all kinds of inspectors come knocking, but there's no "building code" for software except in very specific cases; it's perfectly legal to develop insecure software otherwise, and to keep that insecurity a secret from users.
    - josephg 5y ago
      > The problem is, what power allows the developer to refuse? One power we all have is how valuable we are in the jobs market. If you’re a decent engineer in today’s climate, you could get a new software job in days. And it’ll take your company weeks to replace you if they’re lucky, and months to bring your replacement up to speed on what you were working on. The idea that you’re stuck simply working at the whims of management is a self defeating illusion. It is only as true as you believe it to be.
      - username90 5y ago
        There are tons of engineers out there who aren't decent, what would you say they do in this scenario?
      - bsenftner 5y ago
        ...but that is an illusion power, because all we'd be doing is shifting from one poorly managed code dump to another, just shifting the faces on the pointy haired bosses. Finding a technology developing organization that is not a shit show of unmanaged personalities and a teetering tower of technical debt is extremely difficult.
      - wonderwonder 5y ago
        I find most employees over estimate their importance. Everyone is replaceable especially a software developer, there are hundreds of just as good developers waiting to take your place if the salary is right. In addition if they fire you on the spot, you are the one that has to deal with that. If the developer does not have a very good emergency fund that further compounds the stress to do as you are told. Not everyone in software makes a US FAANG, SF, NYC salary.
- pc86 5y ago
  Do you have a citation to show that, in any US jurisdiction, a developer can be personally liable for the release of software with a security flaw while management at the same company can't be?
- wonderwonder 5y ago
  I don't think this is accurate. You can sue the company, you cannot sue the developers. This applies to other companies as well. You can sue McDonalds if you get burned by their coffee, but you cant sue any of the employees that are responsible for selecting to keep the coffee at that temperature. https://www.caoc.org/?pg=facts https://www.caoc.org/?pg=facts
  - nrmitchi 5y ago
    > you cant sue the worker that made the shake and gave it to you. I mean let's be real, in the US you definitely could. Pretty much anyone can sue anyone for anything. But between suing McDonalds, and suing the close-to-minimum-wage-employee working at McDonalds, which group do you think you would be most likely to collect from in the event you won? Not to mention the public perception of suing an individual McDonalds employee.
    - theevilsharpie 5y ago
      > I mean let's be real, in the US you definitely could. Pretty much anyone can sue anyone for anything. No, for this particular example, it would almost certainly not be possible. In the US, employees are shielded from personal liability under the doctrine of respondeat superior.
      - mr_coleman 5y ago
        You can sue them, you just won't win if it goes to trial. But most lawsuits don't end in a courtroom. It's sometimes cheaper to pay off a lawsuit you'd win in court than to go through the process.
- theevilsharpie 5y ago
  > What's worse, in several jurisdictions (some places in the US included, IIRC), if a company is found to have caused damages based on this sort of "negligence", the developers are legally to blame - not management. [citation needed] Company employees in the US (including software developers) are shielded from personal liability by their companies, unless that liability was created by breaking the law or gross negligence (with the latter being extremely difficult to prove). The company can fire the developer for being incompetent or negligent, but the company would still be on the hook for any damages. The same is true when outsourcing development to a third-party development house. The client company may be able to sue the development company, but the individual developers would be shielded from personal liability by whoever they worked for. The only situation I can think of where a developer would be personally liable for buggy or insecure software is if they signed and sealed source code as a professional engineer (this is practically non-existent), or if they were freelancing and contracting with companies directly. In both cases, they would be eligible--and often required by their clients--to purchase insurance against errors and omissions.
- mikestew 5y ago
  That calls for a big ol' [citation needed]. I've been doing this for over 30 years, and I've never heard of a single instance of this happening. I'm not omniscient, but one would think I'd at least get a whiff of such if it is occurring.
ElViajero 5y ago
> security isn’t usually seen as a feature. I have seen this changing since the introduction of GDPR in Europe. There is a direct cash incentive to avoid data-leaks. Being mandatory to inform of any data-leak and the possibility of fines makes it more clear that security is a business concern not just a technical one.

junon 5y ago

What's worse, in several jurisdictions (some places in the US included, IIRC), if a company is found to have caused damages based on this sort of "negligence", the developers are legally to blame - not management.

lhnz 5y ago
You'd presumably be fired or PIPed if you often held back releases for security reasons so the liability seems poorly placed.
aliasEli 5y ago
In most jurisdictions I know, the developer would be safe if he could show that he warned management about the security problem. In situation like this always write an e-mail to your manager and keep a copy in a safe place.
matheusmoreira 5y ago
The company and its developers should be liable. Developers know it is wrong and yet they do it anyway. The fact management told them to do it doesn't matter. Real engineers don't sign off on a project if they think the building is going to fall apart. If a company starts ignoring security for the sake of profit, developers should react by literally walking out and refusing to have anything to do with the project. Anything else means they share the blame.
- chousuke 5y ago
  The problem is, what power allows the developer to refuse? If they do, a manager can find someone who won't, and developers who stand by their principles will lose to competition. A building engineer could probably drop a hint somewhere and have all kinds of inspectors come knocking, but there's no "building code" for software except in very specific cases; it's perfectly legal to develop insecure software otherwise, and to keep that insecurity a secret from users.
  - josephg 5y ago
    > The problem is, what power allows the developer to refuse? One power we all have is how valuable we are in the jobs market. If you’re a decent engineer in today’s climate, you could get a new software job in days. And it’ll take your company weeks to replace you if they’re lucky, and months to bring your replacement up to speed on what you were working on. The idea that you’re stuck simply working at the whims of management is a self defeating illusion. It is only as true as you believe it to be.
    - username90 5y ago
      There are tons of engineers out there who aren't decent, what would you say they do in this scenario?
    - bsenftner 5y ago
      ...but that is an illusion power, because all we'd be doing is shifting from one poorly managed code dump to another, just shifting the faces on the pointy haired bosses. Finding a technology developing organization that is not a shit show of unmanaged personalities and a teetering tower of technical debt is extremely difficult.
    - wonderwonder 5y ago
      I find most employees over estimate their importance. Everyone is replaceable especially a software developer, there are hundreds of just as good developers waiting to take your place if the salary is right. In addition if they fire you on the spot, you are the one that has to deal with that. If the developer does not have a very good emergency fund that further compounds the stress to do as you are told. Not everyone in software makes a US FAANG, SF, NYC salary.
pc86 5y ago
Do you have a citation to show that, in any US jurisdiction, a developer can be personally liable for the release of software with a security flaw while management at the same company can't be?
wonderwonder 5y ago
I don't think this is accurate. You can sue the company, you cannot sue the developers. This applies to other companies as well. You can sue McDonalds if you get burned by their coffee, but you cant sue any of the employees that are responsible for selecting to keep the coffee at that temperature. https://www.caoc.org/?pg=facts https://www.caoc.org/?pg=facts
- nrmitchi 5y ago
  > you cant sue the worker that made the shake and gave it to you. I mean let's be real, in the US you definitely could. Pretty much anyone can sue anyone for anything. But between suing McDonalds, and suing the close-to-minimum-wage-employee working at McDonalds, which group do you think you would be most likely to collect from in the event you won? Not to mention the public perception of suing an individual McDonalds employee.
  - theevilsharpie 5y ago
    > I mean let's be real, in the US you definitely could. Pretty much anyone can sue anyone for anything. No, for this particular example, it would almost certainly not be possible. In the US, employees are shielded from personal liability under the doctrine of respondeat superior.
    - mr_coleman 5y ago
      You can sue them, you just won't win if it goes to trial. But most lawsuits don't end in a courtroom. It's sometimes cheaper to pay off a lawsuit you'd win in court than to go through the process.
theevilsharpie 5y ago
> What's worse, in several jurisdictions (some places in the US included, IIRC), if a company is found to have caused damages based on this sort of "negligence", the developers are legally to blame - not management. [citation needed] Company employees in the US (including software developers) are shielded from personal liability by their companies, unless that liability was created by breaking the law or gross negligence (with the latter being extremely difficult to prove). The company can fire the developer for being incompetent or negligent, but the company would still be on the hook for any damages. The same is true when outsourcing development to a third-party development house. The client company may be able to sue the development company, but the individual developers would be shielded from personal liability by whoever they worked for. The only situation I can think of where a developer would be personally liable for buggy or insecure software is if they signed and sealed source code as a professional engineer (this is practically non-existent), or if they were freelancing and contracting with companies directly. In both cases, they would be eligible--and often required by their clients--to purchase insurance against errors and omissions.
mikestew 5y ago
That calls for a big ol' [citation needed]. I've been doing this for over 30 years, and I've never heard of a single instance of this happening. I'm not omniscient, but one would think I'd at least get a whiff of such if it is occurring.

ElViajero 5y ago

> security isn’t usually seen as a feature. I have seen this changing since the introduction of GDPR in Europe. There is a direct cash incentive to avoid data-leaks. Being mandatory to inform of any data-leak and the possibility of fines makes it more clear that security is a business concern not just a technical one.