7 ms·

I say this quite often, or we get better as a profession or we are going to get related to death. No society will tolerate failures in major businesses includin

I say this quite often, or we get better as a profession or we are going to get related to death. No society will tolerate failures in major businesses including food providers to happen continuously. Or we do better, or the next generation of developers is going to have regulated programming languages, architectures, and tech stack. Or we show that we can deliver safely and resist business pressure to deliver fast and cut costs, or the government is going to do it for us.

rapind 5y ago
Who is “we” though. I think a lot of deva cut corners, a lot of managers insist on cutting corners (preferably without a paper trail pointing at them), and a lot of businesses hire inexperienced devs that wouldn’t even know where to start, because cheaper. I don’t know how you coordinate this without regulation and something like P.Eng type certification (which comes with it’s own problems).
- nine_k 5y ago
  I think you should certify systems in place, not engineers. People without credentials but with experience and care can produce a reasonably secure system. People with credentials but under time pressure and contradictory requirements, and willingness to cut corners, can produce an unsafe system. It's the system that fails. It can be inspected the way buildings are inspected.
  - MrQuimico 5y ago
    I totally agree.
  - rapind 5y ago
    Ideally I agree, but I’m not sure it will be effective. There needs to be concrete consequences, and there’s a lot of room to hide. If we required something like a P.Eng, which (at least theoretically) means you are responsible with real consequences (for say bad building design) then certified employees will be far more reluctant to attach their name to shoddy practices. This bubbles up to the employer. If a client requires you to have certified P.Eng sign off then there’s some reassurance it’s not just going to fall a part. I don’t think you need this for everything in a stack, but security wise it might be a good idea.
    - mcguire 5y ago
      "I don’t think you need this for everything in a stack..." The problem there is that everything on the stack is a potential hole. The chain is only as strong as its weakest link.
  - mcguire 5y ago
    Certification of people is cheaper than certification of systems built by random people. For fun: Try to get a commercial building built that doesn't have an architect and structural engineer (both of which are certified professionals) somewhere in its background.
    - rapind 5y ago
      This is a really good point. Because the stakes are so high it makes sense. No one would want to live in a building that's yolo designed. Certifying and insuring it after the fact though would be really hard because a lot of critical decisions are hidden away. We accept that possibility in SaaS though... for now. Most successful SaaS applications probably weigh in at 250k LOC or more (I know LOC isn't a great metric, but it serves as an idea of an application's complexity) and will use many libraries that themselves could be questionable. Seems like it would be pretty complicated to certify.
lisper 5y ago
Just FYI, the "or ... or ..." construct you are using here sounds odd to a native English speaker. The correct idiom is "either ... or ...", e.g. "Either we get better as a profession, or we are going to get related to death." (And I'm also guessing you meant "regulated" rather than "related".)
- jerf 5y ago
  If "related" was a typo, it was a happy one. The root problem is that we're getting more and more connected, but those connections have low security. It's too easy for bad stuff to flow across those connections. We're getting related to death. Much as developers in the past couple of years have really started to grapple with the fact that as wonderful as software libraries are, dependencies have non-zero costs that come with their benefits, connections need to be seen as being having non-zero costs as well. I work in a similar situation myself and I know my philosophy over the past 10 years has very much gone from a permissive "well maybe I'll need this later" open-ended protocol design to a super-strict "this connection moves exactly this set of strongly-typed, verified messages over it and if anybody tries any funny business we slam it shut and scream bloody murder on the monitoring" philosophy. Especially challenging with the Web's support for messaging, which is great for being a web page but is flabby and bloated for a messaging solution, what with all these headers that do magical things in the web servers or anything in between. As our systems get more and more complicated, biological metaphors seems to be ever more useful, and I think we need to look to nature's highly defensive "programming" a bit more for inspiration. Chemistry has some different characteristics from our programming environment, some to nature's advantage and some to its disadvantage, so we can't blindly copy it, but living things take 'message security' very seriously. You don't last long if you just blindly trust everything out there.
user3939382 5y ago
We have self regulation available via NIST 800-53, NIST 800-30, SOC2, mandatory in some contexts like FISMA, etc. What is now guidance can become mandatory audits with the stroke of a congressional pen. I sound like a broken record but it bears repeating: Most of these attacks are successful because companies neglect best practices. Whitelisting, security awareness training, UEBA, etc go a long way. I would hope the free market would prune companies without proper cybersecurity but regulatory capture means it probably won’t. Equifax and its executives are doing just fine.
- cosmodisk 5y ago
  That's the problem that free market prefers companies that have 100 bigger budgets for marketing than security teams. Unless this changes, nothing will change.
  - afrodc_ 5y ago
    The markets aren't always rational but a slew of security flaws increasing the drain of revenue by having to pay out ransomware or losing all of your data will be a driving force behind improving security.
    - mcguire 5y ago
      The true skill of choosing ransoms is to make sure that it's high enough to compensate you for the risk you take, but low enough to the other options are unappealing to the victim. Large businesses can trivially set aside a few million dollars per year for ransoms. Small businesses don't have the ability to change the system.
      - afrodc_ 5y ago
        That's a very good point. In that same vein, I do wonder if the hostage takers are that aware of the implications of their actions without letting greed guide them, not being a cohesive organization themselves.
- 5y ago
hindsightbias 5y ago
If software engineering were physical, it would be like a non-stop series of Surfside condos and 737 Max crashes. People just don’t take virtual things as seriously, unless they involve conspiracies. *edit: when I say "people", I mean the end-users who would otherwise demand change.,
- ErikVandeWater 5y ago
  Except software is behind the ~40 million successful flights around the world each year.
  - sidlls 5y ago
    The vast majority of software is more like hipster react web dev garbage than serious engineering.
    - bluGill 5y ago
      The vast majority of software doesn't need serious engineering either. If Google breaks that isn't a big deal, even though almost everyone in the world will be annoyed.
      - mcguire 5y ago
        Which systems do not need serious engineering? How much money or damage is "no big deal"? https://en.wikipedia.org/wiki/Equifax https://en.wikipedia.org/wiki/Equifax https://en.wikipedia.org/wiki/List_of_data_breaches https://en.wikipedia.org/wiki/List_of_data_breaches https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&search_type=all&isCpeNameSearch=false&hyperlink_types=US-CERT+Vulnerability+Notes https://nvd.nist.gov/vuln/search/results?form_type=Basic&res...
        bluGill 5y ago
        Data breaches don't kill people in general. Medical devices can. Your point is well taken, even though things are not as bad they are still bad.
nyghtly 5y ago
Doing the right thing is bad for short term profits. Thus, government regulation in our industries is inevitable. In fact, I would argue that it's the only way to ensure consistent reliability. There's a reason why Facebook is pushing for regulation. They know that it can't be stopped, and in that case they would prefer to be the one's writing the regulations.
- nine_k 5y ago
  But government regulation very often is preferring short-term profits to doing the right thing. Just the profits are political. Think of all the security theater in airports, for instance. Think of all the to and fro in many policies as different officials get elected every few years.
cartoonworld 5y ago
It's the CYA thats preferred over CIA that causes execs, share holders and customers to accept this dangerous malfeasance. It's far less the programmers than the business plans that demand minimal investment. These are classic externalities that serve to damage society at large.

rapind 5y ago

Who is “we” though. I think a lot of deva cut corners, a lot of managers insist on cutting corners (preferably without a paper trail pointing at them), and a lot of businesses hire inexperienced devs that wouldn’t even know where to start, because cheaper. I don’t know how you coordinate this without regulation and something like P.Eng type certification (which comes with it’s own problems).

nine_k 5y ago
I think you should certify systems in place, not engineers. People without credentials but with experience and care can produce a reasonably secure system. People with credentials but under time pressure and contradictory requirements, and willingness to cut corners, can produce an unsafe system. It's the system that fails. It can be inspected the way buildings are inspected.
- MrQuimico 5y ago
  I totally agree.
- rapind 5y ago
  Ideally I agree, but I’m not sure it will be effective. There needs to be concrete consequences, and there’s a lot of room to hide. If we required something like a P.Eng, which (at least theoretically) means you are responsible with real consequences (for say bad building design) then certified employees will be far more reluctant to attach their name to shoddy practices. This bubbles up to the employer. If a client requires you to have certified P.Eng sign off then there’s some reassurance it’s not just going to fall a part. I don’t think you need this for everything in a stack, but security wise it might be a good idea.
  - mcguire 5y ago
    "I don’t think you need this for everything in a stack..." The problem there is that everything on the stack is a potential hole. The chain is only as strong as its weakest link.
- mcguire 5y ago
  Certification of people is cheaper than certification of systems built by random people. For fun: Try to get a commercial building built that doesn't have an architect and structural engineer (both of which are certified professionals) somewhere in its background.
  - rapind 5y ago
    This is a really good point. Because the stakes are so high it makes sense. No one would want to live in a building that's yolo designed. Certifying and insuring it after the fact though would be really hard because a lot of critical decisions are hidden away. We accept that possibility in SaaS though... for now. Most successful SaaS applications probably weigh in at 250k LOC or more (I know LOC isn't a great metric, but it serves as an idea of an application's complexity) and will use many libraries that themselves could be questionable. Seems like it would be pretty complicated to certify.

lisper 5y ago

Just FYI, the "or ... or ..." construct you are using here sounds odd to a native English speaker. The correct idiom is "either ... or ...", e.g. "Either we get better as a profession, or we are going to get related to death." (And I'm also guessing you meant "regulated" rather than "related".)

jerf 5y ago
If "related" was a typo, it was a happy one. The root problem is that we're getting more and more connected, but those connections have low security. It's too easy for bad stuff to flow across those connections. We're getting related to death. Much as developers in the past couple of years have really started to grapple with the fact that as wonderful as software libraries are, dependencies have non-zero costs that come with their benefits, connections need to be seen as being having non-zero costs as well. I work in a similar situation myself and I know my philosophy over the past 10 years has very much gone from a permissive "well maybe I'll need this later" open-ended protocol design to a super-strict "this connection moves exactly this set of strongly-typed, verified messages over it and if anybody tries any funny business we slam it shut and scream bloody murder on the monitoring" philosophy. Especially challenging with the Web's support for messaging, which is great for being a web page but is flabby and bloated for a messaging solution, what with all these headers that do magical things in the web servers or anything in between. As our systems get more and more complicated, biological metaphors seems to be ever more useful, and I think we need to look to nature's highly defensive "programming" a bit more for inspiration. Chemistry has some different characteristics from our programming environment, some to nature's advantage and some to its disadvantage, so we can't blindly copy it, but living things take 'message security' very seriously. You don't last long if you just blindly trust everything out there.

user3939382 5y ago

We have self regulation available via NIST 800-53, NIST 800-30, SOC2, mandatory in some contexts like FISMA, etc. What is now guidance can become mandatory audits with the stroke of a congressional pen. I sound like a broken record but it bears repeating: Most of these attacks are successful because companies neglect best practices. Whitelisting, security awareness training, UEBA, etc go a long way. I would hope the free market would prune companies without proper cybersecurity but regulatory capture means it probably won’t. Equifax and its executives are doing just fine.

cosmodisk 5y ago
That's the problem that free market prefers companies that have 100 bigger budgets for marketing than security teams. Unless this changes, nothing will change.
- afrodc_ 5y ago
  The markets aren't always rational but a slew of security flaws increasing the drain of revenue by having to pay out ransomware or losing all of your data will be a driving force behind improving security.
  - mcguire 5y ago
    The true skill of choosing ransoms is to make sure that it's high enough to compensate you for the risk you take, but low enough to the other options are unappealing to the victim. Large businesses can trivially set aside a few million dollars per year for ransoms. Small businesses don't have the ability to change the system.
    - afrodc_ 5y ago
      That's a very good point. In that same vein, I do wonder if the hostage takers are that aware of the implications of their actions without letting greed guide them, not being a cohesive organization themselves.
5y ago

hindsightbias 5y ago

If software engineering were physical, it would be like a non-stop series of Surfside condos and 737 Max crashes. People just don’t take virtual things as seriously, unless they involve conspiracies. *edit: when I say "people", I mean the end-users who would otherwise demand change.,

ErikVandeWater 5y ago
Except software is behind the ~40 million successful flights around the world each year.
- sidlls 5y ago
  The vast majority of software is more like hipster react web dev garbage than serious engineering.
  - bluGill 5y ago
    The vast majority of software doesn't need serious engineering either. If Google breaks that isn't a big deal, even though almost everyone in the world will be annoyed.
    - mcguire 5y ago
      Which systems do not need serious engineering? How much money or damage is "no big deal"? https://en.wikipedia.org/wiki/Equifax https://en.wikipedia.org/wiki/Equifax https://en.wikipedia.org/wiki/List_of_data_breaches https://en.wikipedia.org/wiki/List_of_data_breaches https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&search_type=all&isCpeNameSearch=false&hyperlink_types=US-CERT+Vulnerability+Notes https://nvd.nist.gov/vuln/search/results?form_type=Basic&res...
      - bluGill 5y ago
        Data breaches don't kill people in general. Medical devices can. Your point is well taken, even though things are not as bad they are still bad.

nyghtly 5y ago

Doing the right thing is bad for short term profits. Thus, government regulation in our industries is inevitable. In fact, I would argue that it's the only way to ensure consistent reliability. There's a reason why Facebook is pushing for regulation. They know that it can't be stopped, and in that case they would prefer to be the one's writing the regulations.

nine_k 5y ago
But government regulation very often is preferring short-term profits to doing the right thing. Just the profits are political. Think of all the security theater in airports, for instance. Think of all the to and fro in many policies as different officials get elected every few years.

cartoonworld 5y ago

It's the CYA thats preferred over CIA that causes execs, share holders and customers to accept this dangerous malfeasance. It's far less the programmers than the business plans that demand minimal investment. These are classic externalities that serve to damage society at large.