5 ms·

> it is your responsibility to know how the components you choose work and how much you can rely on them Unfortunately that is not always your choice and argui

by consp 5y ago

> it is your responsibility to know how the components you choose work and how much you can rely on them Unfortunately that is not always your choice and arguing against it most commonly costs you more than you like. My experience is quite often timelines get underestimated massively with software so you end up doing what you can with the resources given. If you pull this into the bridge metafore the bridge still stands but can collapse any time and as long as it doesn't collapse during rush hour and can be rebuilt before the next morning it's all fine.

brightball 5y ago
Yep, this is accurate. People making decisions often value “works”/“ships” more than “secure” and the time allocations reflect it. I wish it wasn’t the case, but it is.
- caymanjim 5y ago
  It's pragmatism. If something doesn't work, it doesn't matter how secure it is.
  - paledot 5y ago
    If something isn't secure, it doesn't work. At that point, you would've been better off shipping a wireframe.
    - caymanjim 5y ago
      A door with a broken lock still provides value. An online PDF converter on a website without SSL still provides value. I'm not saying security doesn't matter or that it shouldn't be a priority, but things don't need to be perfect to be useful. It makes sense to focus more on functionality than security in many areas. I host a bunch of web apps behind a firewall that aren't secure enough to expose to the public Internet. Even commercial ones.
      - paledot 5y ago
        Unfortunately, that's exactly the problem. If it didn't provide value, no one would use it and its lack of security would be a moot point. The PDF converter is a great example. It's functional, people use it - to transfer potentially highly sensitive documents over an insecure connection. At that point, it provides value in the same way that a Nigerian prince provides banking services.
    - throwaway889900 5y ago
      For you, no risk seems acceptable when it comes to security. That is generally not the case for most people, who will accept some level of risk (ie an insecure program) if it provides value to them. That's the whole point of risk management.
      - paledot 5y ago
        Pardon me for being pithy. We've all heard the adage about perfect security being a logical impossibility. I will say instead that if a tool doesn't have security proportionate to its risk factor integrated in its design, it doesn't work.
- freeopinion 5y ago
  There are lots of decision points. Some people are deciding what to sell; others are deciding what to purchase. An organization that de-prioritizes security in what they produce could be punished by organizations that prioritize security in what they consume. In this way, decisions are shared to some extent. Consumers might be misled over the short-term, but at some point they become complicit. If a datacenter continues to purchase a model of generator after five high-profile failures of that model, they can argue all they want that it is the only model on the market that meets their needs. But clearly uptime is not their biggest consideration.

by consp 5y ago

brightball 5y ago

Yep, this is accurate. People making decisions often value “works”/“ships” more than “secure” and the time allocations reflect it. I wish it wasn’t the case, but it is.

caymanjim 5y ago
It's pragmatism. If something doesn't work, it doesn't matter how secure it is.
- paledot 5y ago
  If something isn't secure, it doesn't work. At that point, you would've been better off shipping a wireframe.
  - caymanjim 5y ago
    A door with a broken lock still provides value. An online PDF converter on a website without SSL still provides value. I'm not saying security doesn't matter or that it shouldn't be a priority, but things don't need to be perfect to be useful. It makes sense to focus more on functionality than security in many areas. I host a bunch of web apps behind a firewall that aren't secure enough to expose to the public Internet. Even commercial ones.
    - paledot 5y ago
      Unfortunately, that's exactly the problem. If it didn't provide value, no one would use it and its lack of security would be a moot point. The PDF converter is a great example. It's functional, people use it - to transfer potentially highly sensitive documents over an insecure connection. At that point, it provides value in the same way that a Nigerian prince provides banking services.
  - throwaway889900 5y ago
    For you, no risk seems acceptable when it comes to security. That is generally not the case for most people, who will accept some level of risk (ie an insecure program) if it provides value to them. That's the whole point of risk management.
    - paledot 5y ago
      Pardon me for being pithy. We've all heard the adage about perfect security being a logical impossibility. I will say instead that if a tool doesn't have security proportionate to its risk factor integrated in its design, it doesn't work.
freeopinion 5y ago
There are lots of decision points. Some people are deciding what to sell; others are deciding what to purchase. An organization that de-prioritizes security in what they produce could be punished by organizations that prioritize security in what they consume. In this way, decisions are shared to some extent. Consumers might be misled over the short-term, but at some point they become complicit. If a datacenter continues to purchase a model of generator after five high-profile failures of that model, they can argue all they want that it is the only model on the market that meets their needs. But clearly uptime is not their biggest consideration.