4 ms·
I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need). I h
by pid-1 5y ago
I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need).
I have no security education, but I care about stuff because I will be held responsible if we get pwned at some point.
IMO the biggest issue is that SWEs very rarely have long term skin in the game in the projects they are committing to.
Many have strong incentives to not care about security, day 2 ops, etc... When shit hits the fan bonuses were already paid and said professionals often moved on.
I think that tends to be lessened by having small projects with clear owners that don't jump around all the time. Companies with smaller turnover win big here.
- iso1631 5y ago> I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need). I find it helpful to have standard low cost (certainly no monetary cost, but also little in the way of bureaucratical cost) solutions which remove the need. E.G. "I need to access this device's webpage from everywhere" "Fine, go via this proxy which has oidc integration with our corporate identity, Here's the URL, let me know if there's any problems" Doesn't always work, but it certainly reduces the fights.