5 ms·

What in God's name would any execs from those or any other company realistically be able to share about software security?

dekhn 5y ago
Given that the first two represent an enormous amount of the overall compute use (mac computers, aws cloud machines) and their surface areas are directly related to our national defense, I think they'd be able to share a fair amount.
- NoSorryCannot 5y ago
  No argument that they have the experience and knowledge within their organizations. I think OP was expressing doubt that "execs" will be informed enough to deliver actionable insights.
  - dekhn 5y ago
    OP would be wrong, then. The execs those companies send will be a combination of politically brilliant and technically knowledgeable. I've worked with a wide range of execs across several fields now and many of them are truly exceptional people with deeper understanding of their business's low level details than you'd expect.
    - NoSorryCannot 5y ago
      OP may be wrong or may not be. It is certainly not a rule that all executives are as you describe and there is no shortage of anecdotes to oppose yours.
- adhesive_wombat 5y ago
  I think the point was that executives won't have enough technical knowledge to be able to say much about it except in extremely vague terms like "we take security seriously". In fact, actually having too much of a clue is a probably more of a liability when you're summoned to a meeting at the White House, as you might say something they'll hold you to.
  - mikeyouse 5y ago
    This is such a cynical view unfortunately shared by a lot of people in the thread. For two examples, the VP Security of ASF is there, here's his resume: > https://www.linkedin.com/in/mark-j-cox/ https://www.linkedin.com/in/mark-j-cox/ Brian Behlendorf is there from the newly formed Open Source Security Foundation, here's his resume, in the form of a Wikipedia entry because he was one of the OG developers for Apache Web Server: https://en.wikipedia.org/wiki/Brian_Behlendorf https://en.wikipedia.org/wiki/Brian_Behlendorf Executives from tech companies aren't usually just random MBAs -- they're often deeply technical people who ran engineering teams with huge impact. Besides, they're not having a pair-coding session to ship a release to fix Log4J -- they're talking about a coordinated effort to prevent future vulns. Obviously engineering knowledge is necessary but the coordination aspect involves org-wide and industry-wide changes.
basch 5y ago
Part of their job should be to convey upward feedback. If employees and teams write them good scripts, they should be able to deliver.

dekhn 5y ago

Given that the first two represent an enormous amount of the overall compute use (mac computers, aws cloud machines) and their surface areas are directly related to our national defense, I think they'd be able to share a fair amount.

NoSorryCannot 5y ago
No argument that they have the experience and knowledge within their organizations. I think OP was expressing doubt that "execs" will be informed enough to deliver actionable insights.
- dekhn 5y ago
  OP would be wrong, then. The execs those companies send will be a combination of politically brilliant and technically knowledgeable. I've worked with a wide range of execs across several fields now and many of them are truly exceptional people with deeper understanding of their business's low level details than you'd expect.
  - NoSorryCannot 5y ago
    OP may be wrong or may not be. It is certainly not a rule that all executives are as you describe and there is no shortage of anecdotes to oppose yours.
adhesive_wombat 5y ago
I think the point was that executives won't have enough technical knowledge to be able to say much about it except in extremely vague terms like "we take security seriously". In fact, actually having too much of a clue is a probably more of a liability when you're summoned to a meeting at the White House, as you might say something they'll hold you to.
- mikeyouse 5y ago
  This is such a cynical view unfortunately shared by a lot of people in the thread. For two examples, the VP Security of ASF is there, here's his resume: > https://www.linkedin.com/in/mark-j-cox/ https://www.linkedin.com/in/mark-j-cox/ Brian Behlendorf is there from the newly formed Open Source Security Foundation, here's his resume, in the form of a Wikipedia entry because he was one of the OG developers for Apache Web Server: https://en.wikipedia.org/wiki/Brian_Behlendorf https://en.wikipedia.org/wiki/Brian_Behlendorf Executives from tech companies aren't usually just random MBAs -- they're often deeply technical people who ran engineering teams with huge impact. Besides, they're not having a pair-coding session to ship a release to fix Log4J -- they're talking about a coordinated effort to prevent future vulns. Obviously engineering knowledge is necessary but the coordination aspect involves org-wide and industry-wide changes.

basch 5y ago

Part of their job should be to convey upward feedback. If employees and teams write them good scripts, they should be able to deliver.