3 ms·

Out of interest, why haven't you fixed it?

lovelearning 4y ago
> When it's brought up people are like "ooh yeah that's like really really bad, but what about [tiny useless feature than one user asked about]?we don't have the time to fix that!"
- danielmarkbruce 4y ago
  For important things you have to take the initiative. Take a couple hours every day for however long. Just get it done.
  - lovelearning 4y ago
    Unfortunately, if a company's culture is bad, initiative won't help. In some companies, product managers and tech leads actively discourage initiative. Time just becomes a convenient excuse to discourage. I suspect this is the case in OP's company, given how systematic the negligence is.
    - danielmarkbruce 4y ago
      I don't know how big the change is but assuming it's not crazy big, if you make a pull request with the relevant changes and send it to another eng who isn't a dick, you are going to get it in. If someone asks why you spent time on it, you say it took 45 mins.
      - ipaddr 4y ago
        Then the unauthorized fix is blamed for unrelated issues and believed because no one is really technical in leadership.
        danielmarkbruce 4y ago
        Who said unauthorized? There is a ticket. You create a pull request, another engineer approves the request.
    - danwee 4y ago
      > Unfortunately, if a company's culture is bad, initiative won't help That's the chicken and egg problem. If you perceive that the company's culture is bad, you won't have initiative. If you (anyone) don't have initiative, then company's culture is kept the same.
raffraffraff 4y ago
Not OP, but sometimes a problem isn't in a person's domain. Like, if you had a conversation with an engineer who knows "a little about databases" and they tell you that the hardware isn't up to the task, so they've had to enable disk write buffering even though they don't have battery backed caches, and they don't backup WAL logs, and the replicas are still falling behind the primaries during peak usage. Would you get stuck in yourself? Where would you start? You'd have to petition management for hardware upgrades or maybe shard the databases. This is why critical issues sometimes hang around for months or years until (if you're lucky) you have a "near miss", where a database dies, the secondary is hours behind and your untested backups didn't work for the last 2 weeks, and there's no point in time recovery anyway because there are no WAL logs. And after a 1 hour outage and major panic, someone reboots the dead primary database and or magically comes back to life. (Of course, you then have to worry about transactions that might have been lost when the system for rebooted, since the disk buffers could have had unwritten data...)
- danielmarkbruce 4y ago
  Not sure it's a good analogy. Poster found the vulnerability in 1. 2 is plaintext passwords. 3 it's unclear exactly what is going on. This person seems to find security issues, and cares about them. It appears to be in his/her domain.
technion 4y ago
A single person can patch an issue or two, but security can be cultural and unless you're in leadership you probably can't change that. And depending on how the business operates, spending too much time on bugs you weren't assigned can be considered by a PM as a performance issue.
- danielmarkbruce 4y ago
  It's a startup. Why can't this person be the one who creates a stronger security culture? Great way to start - fix the plaintext passwords, write a quick memo on why you don't want to do that and what you do to change it.

> When it's brought up people are like "ooh yeah that's like really really bad, but what about [tiny useless feature than one user asked about]?we don't have the time to fix that!"

danielmarkbruce 4y ago
For important things you have to take the initiative. Take a couple hours every day for however long. Just get it done.
- lovelearning 4y ago
  Unfortunately, if a company's culture is bad, initiative won't help. In some companies, product managers and tech leads actively discourage initiative. Time just becomes a convenient excuse to discourage. I suspect this is the case in OP's company, given how systematic the negligence is.
  - danielmarkbruce 4y ago
    I don't know how big the change is but assuming it's not crazy big, if you make a pull request with the relevant changes and send it to another eng who isn't a dick, you are going to get it in. If someone asks why you spent time on it, you say it took 45 mins.
    - ipaddr 4y ago
      Then the unauthorized fix is blamed for unrelated issues and believed because no one is really technical in leadership.
      - danielmarkbruce 4y ago
        Who said unauthorized? There is a ticket. You create a pull request, another engineer approves the request.
  - danwee 4y ago
    > Unfortunately, if a company's culture is bad, initiative won't help That's the chicken and egg problem. If you perceive that the company's culture is bad, you won't have initiative. If you (anyone) don't have initiative, then company's culture is kept the same.

raffraffraff 4y ago

Not OP, but sometimes a problem isn't in a person's domain. Like, if you had a conversation with an engineer who knows "a little about databases" and they tell you that the hardware isn't up to the task, so they've had to enable disk write buffering even though they don't have battery backed caches, and they don't backup WAL logs, and the replicas are still falling behind the primaries during peak usage. Would you get stuck in yourself? Where would you start? You'd have to petition management for hardware upgrades or maybe shard the databases. This is why critical issues sometimes hang around for months or years until (if you're lucky) you have a "near miss", where a database dies, the secondary is hours behind and your untested backups didn't work for the last 2 weeks, and there's no point in time recovery anyway because there are no WAL logs. And after a 1 hour outage and major panic, someone reboots the dead primary database and or magically comes back to life. (Of course, you then have to worry about transactions that might have been lost when the system for rebooted, since the disk buffers could have had unwritten data...)

danielmarkbruce 4y ago
Not sure it's a good analogy. Poster found the vulnerability in 1. 2 is plaintext passwords. 3 it's unclear exactly what is going on. This person seems to find security issues, and cares about them. It appears to be in his/her domain.

technion 4y ago

A single person can patch an issue or two, but security can be cultural and unless you're in leadership you probably can't change that. And depending on how the business operates, spending too much time on bugs you weren't assigned can be considered by a PM as a performance issue.

danielmarkbruce 4y ago
It's a startup. Why can't this person be the one who creates a stronger security culture? Great way to start - fix the plaintext passwords, write a quick memo on why you don't want to do that and what you do to change it.