4 ms·

I really hate "incompetence" as an explanation for anything, but especially something as complex as software and security in particular. Obviously, it's easy to

I really hate "incompetence" as an explanation for anything, but especially something as complex as software and security in particular. Obviously, it's easy to blame a single person as incompetent, but the reality is that their work was certainly part of a team effort. Are all those people incompetent? They were using Azure, which presumably didn't warn them well enough, so are the Azure team incompetent for deploying a dangerous application? Clearly the technical authors who wrote and reviewed and published the Azure docs did a bad job of explaining CosmosDB's security model. If these Fortune500 companies employed a security team to test and audit their cloud apps then they missed the problem too. Or maybe they didn't, but some manager or product owner didn't read the report properly, so that security team were incompetent for failing to report the problem well. This is how everything works in pretty much every industry. There are layers upon layers of complexity in everything, and no one has enough oversight to take full responsibility for some mistake that occurred somewhere down the rabbit hole. Somewhere, somehow you could probably call someone's mistake incompetence, but doing that relieves everyone else of their little part in developing a chain of tools and applications that enabled that incompetence. If we heap all the blame on a single individual then no one else has any reason to improve it. We can just say "OMG, Chris was terrible! I'm so glad he's been fired now everything will be perfect!" until the whole sorry mess happens again. Instead if we accept that mistakes are inevitable, and we accept that anyone can make one, then we're driven to build systems and processes that include guards against mistakes. Applications that check and validate things automatically, even if it's hard and expensive. That's how you get to robust software that doesn't fail like the thing in the article. Blaming individuals will never get you to that point.

howaboutnope 5y ago
> Applications that check and validate things automatically, even if it's hard and expensive. Then you still need to be competent enough to to assess that this is the case. You can't judge code doing something correctly automatically if you don't even know what that thing is and can't do it yourself.
scns 5y ago
My guess would be, based on The Gervais Principle and on my predjudice that dissenting opinions aren't viewed favourably and may be detrimental <edit>to your</edit> career, that we have a "The emperors' new clothes" situation here. The people authorized to make decisions may be clueless (GP) and the people pointing out possible problems have been gotten rid of. There is a turkish proverb: "The fish starts stinking at the head". The Peter Principle from 1969! might apply too. https://en.wikipedia.org/wiki/Peter_principle https://en.wikipedia.org/wiki/Peter_principle
rawgabbit 5y ago
Strong disagree. Incompetence is the reason. It starts with incompetent management who push unrealistic deadlines and hire people who promise the world to pad their resumes and leave in-flight. Incompetence is the reason why the messengers of realistic/bad news are punished and why snake oil salesmen are promoted.
- onion2k 5y ago
  This is exactly the sort of problem though - it's very rare to be able to attribute a mistake to any one person like that. Was it the manager's error for giving an unrealistic deadline, or the team lead for not pushing back on the deadline hard enough, or the developer for not working hard enough to meet the deadline, or the QA for not picking up the error, or devops for not checking what they're deploying, and so on maybe with dozens of people and teams involved.
- cutemonster 5y ago
  Not speaking about this particular security problem, but instead, more in general: Such management and snake oil people need not be incompetent -- they might just have different goals, for example, their personal career and making lots of money -- and building very secure software can be off topic? Someone might seem incompetent, when the underlying problem is different goals? The principal–agent problem

howaboutnope 5y ago

> Applications that check and validate things automatically, even if it's hard and expensive. Then you still need to be competent enough to to assess that this is the case. You can't judge code doing something correctly automatically if you don't even know what that thing is and can't do it yourself.

scns 5y ago

My guess would be, based on The Gervais Principle and on my predjudice that dissenting opinions aren't viewed favourably and may be detrimental <edit>to your</edit> career, that we have a "The emperors' new clothes" situation here. The people authorized to make decisions may be clueless (GP) and the people pointing out possible problems have been gotten rid of. There is a turkish proverb: "The fish starts stinking at the head". The Peter Principle from 1969! might apply too. https://en.wikipedia.org/wiki/Peter_principle https://en.wikipedia.org/wiki/Peter_principle

rawgabbit 5y ago

Strong disagree. Incompetence is the reason. It starts with incompetent management who push unrealistic deadlines and hire people who promise the world to pad their resumes and leave in-flight. Incompetence is the reason why the messengers of realistic/bad news are punished and why snake oil salesmen are promoted.

onion2k 5y ago
This is exactly the sort of problem though - it's very rare to be able to attribute a mistake to any one person like that. Was it the manager's error for giving an unrealistic deadline, or the team lead for not pushing back on the deadline hard enough, or the developer for not working hard enough to meet the deadline, or the QA for not picking up the error, or devops for not checking what they're deploying, and so on maybe with dozens of people and teams involved.
cutemonster 5y ago
Not speaking about this particular security problem, but instead, more in general: Such management and snake oil people need not be incompetent -- they might just have different goals, for example, their personal career and making lots of money -- and building very secure software can be off topic? Someone might seem incompetent, when the underlying problem is different goals? The principal–agent problem