4 ms·

A particular case where I would disagree with you is security. There has to be someone who is responsible and liable for large data breaches, and the way things

A particular case where I would disagree with you is security. There has to be someone who is responsible and liable for large data breaches, and the way things work more often than not at the moment is that no particular person feels responsible at any company, and everyone basically just hopes it will all work out. This is the exact equivalent of a licensed electrician needing to sign off on any electrical work. An absence of ensured quality standards in the profession also doesn't mean that there is an absence of tests, these are moved to the individual company level instead, and, in our profession, often take weird turns like ritualized coding interviews. On the point that no serious developer would think that this improves outcomes, I have to disappoint you, there are major companies like SAP with a culture of requiring masters degrees for almost all promotions.

TheAceOfHearts 5y ago
My first response is that the CEO or CTO should be responsible for data breaches. Leadership should be sure to give engineering enough time and resources to secure their systems. If a system is insecure it's usually a management failure. But in practice, I don't think that works either. We're building immensely complex systems across numerous layers each of which is the result of thousands of engineering hours. The costs to properly harden and secure most systems is not worth it. And even if you spend the effort to harden the system, it could still fall to a carefully crafted attack. If you get attacked by a 0-day exploit from a malicious nation-state there's a level at which most companies would fail. Security isn't some binary thing, it's an onion. And there's no meaningful conversation to be had about security without first taking your risk profile into consideration.
- Apocryphon 5y ago
  Security certainly is difficult, but the Equifax hack wasn't particularly complex, was it?
  - native_samples 5y ago
    You can't define complex in a way clear enough to be useful. Maybe in your eyes it wasn't a "complex" hack, but what specifically distinguishes Equifax from nVidia or the other tech firms getting hacked right now? That you could write down, formalize, test in a court of law and which would last more than 6 months as an accepted definition? What about the China/Google hack in 2010? That was widely regarded as a groundbreaking attack by a nation state, but it started with an employee clicking a phishing link.
SamReidHughes 5y ago
Suppose you did have somebody who was responsible, and liable, with veto power. Nothing would get done.
- dataflow 5y ago
  I would've thought said person should be also given the power to implement better processes, not just veto existing ones.
  - SamReidHughes 5y ago
    The CEO is in charge.

TheAceOfHearts 5y ago

My first response is that the CEO or CTO should be responsible for data breaches. Leadership should be sure to give engineering enough time and resources to secure their systems. If a system is insecure it's usually a management failure. But in practice, I don't think that works either. We're building immensely complex systems across numerous layers each of which is the result of thousands of engineering hours. The costs to properly harden and secure most systems is not worth it. And even if you spend the effort to harden the system, it could still fall to a carefully crafted attack. If you get attacked by a 0-day exploit from a malicious nation-state there's a level at which most companies would fail. Security isn't some binary thing, it's an onion. And there's no meaningful conversation to be had about security without first taking your risk profile into consideration.

Apocryphon 5y ago
Security certainly is difficult, but the Equifax hack wasn't particularly complex, was it?
- native_samples 5y ago
  You can't define complex in a way clear enough to be useful. Maybe in your eyes it wasn't a "complex" hack, but what specifically distinguishes Equifax from nVidia or the other tech firms getting hacked right now? That you could write down, formalize, test in a court of law and which would last more than 6 months as an accepted definition? What about the China/Google hack in 2010? That was widely regarded as a groundbreaking attack by a nation state, but it started with an employee clicking a phishing link.

SamReidHughes 5y ago

Suppose you did have somebody who was responsible, and liable, with veto power. Nothing would get done.

dataflow 5y ago
I would've thought said person should be also given the power to implement better processes, not just veto existing ones.
- SamReidHughes 5y ago
  The CEO is in charge.