3 ms·

It's not that we don't know how to build things securely, it's just that we routinely ignore even basic principles of security 'cause it's easier. Virtually eve

It's not that we don't know how to build things securely, it's just that we routinely ignore even basic principles of security 'cause it's easier. Virtually every webapp violates complete mediation and so it's just unreasonable to expect security. Similarly, most developers don't care for security and even less about principles and system design. Again, it's unreasonable to expect secure outcomes from that.

pdimitar 5y ago
It's probably more charitable to say "most devs are not given time and effort bandwidth to care about security". Trust me I'd love to plug more holes before first production deployment but management (and my CTO) would never approve a time/energy budget for it.
- guiriduro 5y ago
  In the current market, I hope it won't sound too disingenuous to suggest you look to work with management that does. You'll be happier, and the market signal of enough people doing it will improve conditions for everyone.
  - pdimitar 5y ago
    I don't disagree in principle but there are many other factors that increase my job happiness: - We have deadlines but they are not strict and very rarely somebody is going to even ping you outside work hours. People there want some discipline but they don't micromanage. - The atmosphere is 95% of the time super chill. - There are no egos flying around (not more than usual anyway; I scheduled a meeting to explain some coding style practices that should be painfully obvious but hey, trying not to judge here). - Technical excellence is appreciated by a very technical and careful CTO -- but is indeed often sidelined in favor of deadlines and business-enabling work. However, I have already successfully fought him and the CEO off on 2-3 technical excellence tasks by demonstrating they'll reduce future slowdowns. Doable but requires some brawling in meetings. - Pay is one of the biggest in EU (although it's like 1.5x - 2.0x less the than the US one). --- > and the market signal of enough people doing it will improve conditions for everyone. I keep hearing this and I want it to be true but for 20 years of career I've never seen it, not once. Nowadays I no longer believe it. Everywhere I worked (I am mostly a contractor so it has been a very colorful career) the business will stick to their idea of "we can always hire somebody else" with persistence that you'd be jealous of -- I don't know if it's an illusion or not but trust me, it's VERY persistent. That alone weakens the point you brought up because employers simply don't believe it and often times go out of their way to look for those other mythical people -- and I've been told in several occasions that the business closed doors before they managed to repair their clusterf_ck of an app. That's how persistent they are in their thinking process that everyone is expendable.

pdimitar 5y ago

It's probably more charitable to say "most devs are not given time and effort bandwidth to care about security". Trust me I'd love to plug more holes before first production deployment but management (and my CTO) would never approve a time/energy budget for it.

guiriduro 5y ago
In the current market, I hope it won't sound too disingenuous to suggest you look to work with management that does. You'll be happier, and the market signal of enough people doing it will improve conditions for everyone.
- pdimitar 5y ago
  I don't disagree in principle but there are many other factors that increase my job happiness: - We have deadlines but they are not strict and very rarely somebody is going to even ping you outside work hours. People there want some discipline but they don't micromanage. - The atmosphere is 95% of the time super chill. - There are no egos flying around (not more than usual anyway; I scheduled a meeting to explain some coding style practices that should be painfully obvious but hey, trying not to judge here). - Technical excellence is appreciated by a very technical and careful CTO -- but is indeed often sidelined in favor of deadlines and business-enabling work. However, I have already successfully fought him and the CEO off on 2-3 technical excellence tasks by demonstrating they'll reduce future slowdowns. Doable but requires some brawling in meetings. - Pay is one of the biggest in EU (although it's like 1.5x - 2.0x less the than the US one). --- > and the market signal of enough people doing it will improve conditions for everyone. I keep hearing this and I want it to be true but for 20 years of career I've never seen it, not once. Nowadays I no longer believe it. Everywhere I worked (I am mostly a contractor so it has been a very colorful career) the business will stick to their idea of "we can always hire somebody else" with persistence that you'd be jealous of -- I don't know if it's an illusion or not but trust me, it's VERY persistent. That alone weakens the point you brought up because employers simply don't believe it and often times go out of their way to look for those other mythical people -- and I've been told in several occasions that the business closed doors before they managed to repair their clusterf_ck of an app. That's how persistent they are in their thinking process that everyone is expendable.