6 ms·

What is the solution? More security education for general SWEs? It seems like whatever team worked on this feature never considered any security perspectives.

iso1631 5y ago
Make all software which isn't released as open source liable for the cost of security breaches?
- baq 5y ago
  great way to not have any software released ever
  - emerongi 5y ago
    Somehow we still have medicine (they do a lot of testing before they release anything!) and doctors (they have insurance!). It would increase the barrier to releasing software massively (possibly killing the startup scene altogether), but it doesn't mean software development would end.
    - ssdspoimdsjvv 5y ago
      If we applied the same rigorous testing and verification processes in medicine to software, software development as we know it would definitely end. It would probably take years to convert a straight-forward requirement into a working piece of software. Something like Teams or VS Code that get new features added all the time would not be possible anymore and would cost tons of money. And while security issues should not be taken lightly, I don't consider leaking my user agent to be as big of a problem as getting permanent damage from low-quality medical care.
      - LaGrange 5y ago
        > If we applied the same rigorous testing and verification processes in medicine to software, software development as we know it would definitely end. Good.
      - simion314 5y ago
        >Something like Teams or VS Code that get new features added all the time would not be possible anymore and would cost tons of money. And while security issues should not be taken lightly, I don't consider leaking my user agent to be as big of a problem as getting permanent damage from low-quality medical care. It won't take years. We will have to train developers and create better tools. Then you will libraries and apps sandboxed, like we would not allow an IDE full access to the internet, or to the entire hard drive without permissions. Say you get the task to build an RSS reader, you will have to choose: 1 use a language+standard library that is safe and the vendor offers some warranty 2 use an unsafe language or some unsafe libraries but you will have to take the risks and do the work to review and evaluate 3 in case you prefer open source you find a language and ecosystem where there is some foundation that even if it can't offer some warranty it accepts donations and contributions that are directly targeted on security, so you would have packages that would have a checkmark that was reviewed by a team. So I would use a safe language(a GC one) with a trusted standard library, so now I can do the network requests to grab the XML files , parse them with the secure XML library and render the content in the safe Web View provided. This means that the guys that give or sell me the XML library and the Web View will take the risk, but they can charge for their work. We would probably get smart developers using some extremely safe languages like math safe not Rust(safer then C safe) and this guys can write a maybe slower but 100% web view (maybe with less shiny animations). Capitalism would be forced to invest in this safer tools and in training the developers, Microsoft ,Apple, Google will have to secure their unsafe OS and libraries but for sure it would not take 1 guy years to build an RSS reader that would not take over your data and send it to some hacker somewhere.
    - citrin_ru 5y ago
      > Somehow we still have medicine (they do a lot of testing before they release anything!) and doctors (they have insurance!). The fact that doctors are relatively frequently sued in the US is one of the reasons why US has very expensive healthcare. If you are rich that's fine, but almost everybody else would prefer more available (cheaper) healthcare with doctors who don't need to spend money on liability insurance.
    - thrower123 5y ago
      Softeare companies generally take out large (and increasingly expensive) liability insurance policies for exactly this reason.
  - nopeYouAreWrong 5y ago
    I'm in favor of this.
    - chickenchaser 5y ago
      ...?
  - southerntofu 5y ago
    Parent suggested free software would be the exception to this rule. Personally, i don't understand why it's even legal to publish binary code without the corresponding source, but at least their point made sense: volunteer-run projects need to be exempted from such regulation, and there's exactly zero reason a volunteer-run project should not be free-software.
- vegai_ 5y ago
  Not sure why you were downmodded, this would be a great idea.
- billpg 5y ago
  "We want to make use of the open-source exception, but we don't want to actually release our source code." "I'll have some Beware-of-the-Leopard signs printed up."
- IiydAbITMvJkqKf 5y ago
  Why should open source software be exempt? If your data gets leaked/abused the license of the software used does not matter in the slightest. If anything, freeware (whether open source or proprietary) should be exempt from costs. You get what you pay for, after all.
  - vegai_ 5y ago
    Make everyone culpable but make the maximum amount of damages never be higher than what income the software generated.
- josefx 5y ago
  open source did not stop Heartbleed. How about force commercial software companies to have 1 in 10 devs. dedicated to security with even a single feature ticket getting fixed by one of them resulting in a fine of ~5% of the yearly revenue.
brnt 5y ago
There is a reason that in construction, the architect and the structural engineer are separate roles. From what I've seen in software dev, it cannot be considered engineering until a similar division is normalized, mandated and legally required. It's easy to shove things into production, too easy.
- mschuster91 5y ago
  Software engineering does have the profession of "software architects" in theory, the problem is that the only thing they get taught in academia is building useless object models for Java. (Side rant, the fact that academic computer science is so far away from real life is yet another can of worms)
mschuster91 5y ago
> It seems like whatever team worked on this feature never considered any security perspectives. The solution is simple: similar in thought to GDPR, make vendors of proprietary products above a certain size (e.g. market share, net worth, # of employees) liable for security issues even if they do not result in privacy breaches. Vendors will then either have to release their software as open source or need to carry insurance for security issues, and the insurance companies will only provide insurance if company processes are following industry standards - e.g. code reviews, security audits during concept and development, appropriate staffing of developer teams or requiring certifications/training for developers.
pid-1 5y ago
I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need). I have no security education, but I care about stuff because I will be held responsible if we get pwned at some point. IMO the biggest issue is that SWEs very rarely have long term skin in the game in the projects they are committing to. Many have strong incentives to not care about security, day 2 ops, etc... When shit hits the fan bonuses were already paid and said professionals often moved on. I think that tends to be lessened by having small projects with clear owners that don't jump around all the time. Companies with smaller turnover win big here.
- iso1631 5y ago
  > I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need). I find it helpful to have standard low cost (certainly no monetary cost, but also little in the way of bureaucratical cost) solutions which remove the need. E.G. "I need to access this device's webpage from everywhere" "Fine, go via this proxy which has oidc integration with our corporate identity, Here's the URL, let me know if there's any problems" Doesn't always work, but it certainly reduces the fights.
citrin_ru 5y ago
Education alone would not help if SWE in many (most?) large companies have no incentives to make software more secure. Even worse - caring about security can make their performance look bad. Companies try to improve security by inflating dedicated security teams which in many cases don't care about an actual product, its code (and infrastructure) but can annoy engineers by arbitrary rules/checklists/policies e. t. c. which IMHO rarely improve product security. How to create this incentive is an open question but more laws and regulation doesn't look like a good answer to me.
markus_zhang 5y ago
Removing micro updates, slow down and actually let engineers fix bugs. I think ultimately PM takes care of which fix/feature to be worked on?

iso1631 5y ago

Make all software which isn't released as open source liable for the cost of security breaches?

baq 5y ago
great way to not have any software released ever
- emerongi 5y ago
  Somehow we still have medicine (they do a lot of testing before they release anything!) and doctors (they have insurance!). It would increase the barrier to releasing software massively (possibly killing the startup scene altogether), but it doesn't mean software development would end.
  - ssdspoimdsjvv 5y ago
    If we applied the same rigorous testing and verification processes in medicine to software, software development as we know it would definitely end. It would probably take years to convert a straight-forward requirement into a working piece of software. Something like Teams or VS Code that get new features added all the time would not be possible anymore and would cost tons of money. And while security issues should not be taken lightly, I don't consider leaking my user agent to be as big of a problem as getting permanent damage from low-quality medical care.
    - LaGrange 5y ago
      > If we applied the same rigorous testing and verification processes in medicine to software, software development as we know it would definitely end. Good.
    - simion314 5y ago
      >Something like Teams or VS Code that get new features added all the time would not be possible anymore and would cost tons of money. And while security issues should not be taken lightly, I don't consider leaking my user agent to be as big of a problem as getting permanent damage from low-quality medical care. It won't take years. We will have to train developers and create better tools. Then you will libraries and apps sandboxed, like we would not allow an IDE full access to the internet, or to the entire hard drive without permissions. Say you get the task to build an RSS reader, you will have to choose: 1 use a language+standard library that is safe and the vendor offers some warranty 2 use an unsafe language or some unsafe libraries but you will have to take the risks and do the work to review and evaluate 3 in case you prefer open source you find a language and ecosystem where there is some foundation that even if it can't offer some warranty it accepts donations and contributions that are directly targeted on security, so you would have packages that would have a checkmark that was reviewed by a team. So I would use a safe language(a GC one) with a trusted standard library, so now I can do the network requests to grab the XML files , parse them with the secure XML library and render the content in the safe Web View provided. This means that the guys that give or sell me the XML library and the Web View will take the risk, but they can charge for their work. We would probably get smart developers using some extremely safe languages like math safe not Rust(safer then C safe) and this guys can write a maybe slower but 100% web view (maybe with less shiny animations). Capitalism would be forced to invest in this safer tools and in training the developers, Microsoft ,Apple, Google will have to secure their unsafe OS and libraries but for sure it would not take 1 guy years to build an RSS reader that would not take over your data and send it to some hacker somewhere.
  - citrin_ru 5y ago
    > Somehow we still have medicine (they do a lot of testing before they release anything!) and doctors (they have insurance!). The fact that doctors are relatively frequently sued in the US is one of the reasons why US has very expensive healthcare. If you are rich that's fine, but almost everybody else would prefer more available (cheaper) healthcare with doctors who don't need to spend money on liability insurance.
  - thrower123 5y ago
    Softeare companies generally take out large (and increasingly expensive) liability insurance policies for exactly this reason.
- nopeYouAreWrong 5y ago
  I'm in favor of this.
  - chickenchaser 5y ago
    ...?
- southerntofu 5y ago
  Parent suggested free software would be the exception to this rule. Personally, i don't understand why it's even legal to publish binary code without the corresponding source, but at least their point made sense: volunteer-run projects need to be exempted from such regulation, and there's exactly zero reason a volunteer-run project should not be free-software.
vegai_ 5y ago
Not sure why you were downmodded, this would be a great idea.
billpg 5y ago
"We want to make use of the open-source exception, but we don't want to actually release our source code." "I'll have some Beware-of-the-Leopard signs printed up."
IiydAbITMvJkqKf 5y ago
Why should open source software be exempt? If your data gets leaked/abused the license of the software used does not matter in the slightest. If anything, freeware (whether open source or proprietary) should be exempt from costs. You get what you pay for, after all.
- vegai_ 5y ago
  Make everyone culpable but make the maximum amount of damages never be higher than what income the software generated.
josefx 5y ago
open source did not stop Heartbleed. How about force commercial software companies to have 1 in 10 devs. dedicated to security with even a single feature ticket getting fixed by one of them resulting in a fine of ~5% of the yearly revenue.

brnt 5y ago

There is a reason that in construction, the architect and the structural engineer are separate roles. From what I've seen in software dev, it cannot be considered engineering until a similar division is normalized, mandated and legally required. It's easy to shove things into production, too easy.

mschuster91 5y ago
Software engineering does have the profession of "software architects" in theory, the problem is that the only thing they get taught in academia is building useless object models for Java. (Side rant, the fact that academic computer science is so far away from real life is yet another can of worms)

mschuster91 5y ago

> It seems like whatever team worked on this feature never considered any security perspectives. The solution is simple: similar in thought to GDPR, make vendors of proprietary products above a certain size (e.g. market share, net worth, # of employees) liable for security issues even if they do not result in privacy breaches. Vendors will then either have to release their software as open source or need to carry insurance for security issues, and the insurance companies will only provide insurance if company processes are following industry standards - e.g. code reviews, security audits during concept and development, appropriate staffing of developer teams or requiring certifications/training for developers.

pid-1 5y ago

I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need). I have no security education, but I care about stuff because I will be held responsible if we get pwned at some point. IMO the biggest issue is that SWEs very rarely have long term skin in the game in the projects they are committing to. Many have strong incentives to not care about security, day 2 ops, etc... When shit hits the fan bonuses were already paid and said professionals often moved on. I think that tends to be lessened by having small projects with clear owners that don't jump around all the time. Companies with smaller turnover win big here.

iso1631 5y ago
> I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need). I find it helpful to have standard low cost (certainly no monetary cost, but also little in the way of bureaucratical cost) solutions which remove the need. E.G. "I need to access this device's webpage from everywhere" "Fine, go via this proxy which has oidc integration with our corporate identity, Here's the URL, let me know if there's any problems" Doesn't always work, but it certainly reduces the fights.

citrin_ru 5y ago

Education alone would not help if SWE in many (most?) large companies have no incentives to make software more secure. Even worse - caring about security can make their performance look bad. Companies try to improve security by inflating dedicated security teams which in many cases don't care about an actual product, its code (and infrastructure) but can annoy engineers by arbitrary rules/checklists/policies e. t. c. which IMHO rarely improve product security. How to create this incentive is an open question but more laws and regulation doesn't look like a good answer to me.

markus_zhang 5y ago

Removing micro updates, slow down and actually let engineers fix bugs. I think ultimately PM takes care of which fix/feature to be worked on?