3 ms·
How is this his fault? Your service had poor validation or design and was used in ways it was intended to. You knew this but still didn't patch it?
by wreath 4y ago
How is this his fault? Your service had poor validation or design and was used in ways it was intended to. You knew this but still didn't patch it?
- drexlspivey 4y agoIt’s an internal service, you don’t treat your co-workers as hostile actors.
- solveit 4y agoAt a large enough company you kind of have to... as this situation shows.
- noizejoy 4y agoReminds me of what they say about Formula 1 racing: The most important thing for a driver is to beat the other driver on their own team (there are 2 drivers per team). And arguably this principle holds for most team members in any organization - since it’s only very few at the very top that actually get held accountable for overall team success.
- cpeterso 4y agoI read a tongue-in-cheek blog post, maybe ten years ago, about “blame-oriented software development”: how to deflect blame from your code. The framing was amusing but the advice was good: extensive validation of input parameters and data, lots out logging, etc. Unfortunately, the blog post seems to have disappeared.
- mertd 4y agoInternal systems always have large gaping holes like that because if someone is misusing it, you can simply ask them to stop it. Most adults comply.
- mabbo 4y agoI won't downvote you. When this terrible thing was done, we immediately realized we needed to add validation. We had thought that by limiting who could call through access controls, we'd never have a malicious user. So naive. Sadly, at that point we couldn't add it because his awful project was running in production.
- civilized 4y agoNo, this person was selfish and inconsiderate of their fellow employee. Employees are supposed to cooperate, not exploit one another for their own personal gain. It's weird to have to say this, and some people probably think it's naive, but I stand by it.
- sidewndr46 4y agoYou can pretty trivially break into my house with some cheap tools off ebay and a YouTube video showing you how to pick the lock. No one suggests I am at fault if you break into my house and steal my stuff.