4 ms·

If we are in the consolidation phase, I wonder if people now understand the risks that software can create and will therefore push for much more professionalism

If we are in the consolidation phase, I wonder if people now understand the risks that software can create and will therefore push for much more professionalism in the industry. Currently, in most countries, literally anybody can write code for something and sell it without restriction. Most people don't like regulation but we can't keep on producing insecure junk without Governments starting to require some kind of formal certification. It is never perfect as anyone in a regulated industry knows, but it has to be better than nothing. For example, how many companies use applications written 30 years with no concern for security and are never forced to retire it (or prove that it is secure)? How many companies don't even have visibility of the 1000s of web servers that have been accumulated over the years of merges and divisions etc?

pooper 4y ago
> professionalism One short story about how I got a rude email one morning at work saying we need to change all our connection strings in production (internal applications) because machinename1234.corporation.lan doesn't work anymore so they moved it to a new machine machinename1235.corporation.lan I still don't know how someone at one of the top five Internet providers in the nation thought it was acceptable to do that instead of renaming the new machine to the old one. It isn't like we were pinning certificates or something fancy. I am pretty sure the certificates were self signed, which is ok for on prem. > How many companies don't even have visibility of the 1000s of web servers that have been accumulated over the years of merges and divisions etc? I wish we had thousands of web servers. At one place I worked at it was the same set of few windows server boxes for everyone and everyone keeps tripping on one another's toes leading people to say well QA and preproduction are broken it will be fine once we are on production.
acdha 4y ago
Forget 30 years ago, how many companies are running apps which are still being written that way? I think about this a lot in the context of open source. We’ve had a ton of great things happen from everyone being able to share code but there is a valid concern about vulnerabilities in code which has been orphaned or was written by someone who wasn’t familiar with secure coding practices. For example, businesses have seen billions of dollars in benefit from WordPress based on the cost vs. functionality / productivity of commercial CMS applications but WP plugins are a famous source of exploits and many of them are written by people who don’t even have the time or skills to secure them if they did. It feels like there should be some way to change that but it’s not clear whether any of the efforts to fund open source will get enough traction.

pooper 4y ago

> professionalism One short story about how I got a rude email one morning at work saying we need to change all our connection strings in production (internal applications) because machinename1234.corporation.lan doesn't work anymore so they moved it to a new machine machinename1235.corporation.lan I still don't know how someone at one of the top five Internet providers in the nation thought it was acceptable to do that instead of renaming the new machine to the old one. It isn't like we were pinning certificates or something fancy. I am pretty sure the certificates were self signed, which is ok for on prem. > How many companies don't even have visibility of the 1000s of web servers that have been accumulated over the years of merges and divisions etc? I wish we had thousands of web servers. At one place I worked at it was the same set of few windows server boxes for everyone and everyone keeps tripping on one another's toes leading people to say well QA and preproduction are broken it will be fine once we are on production.

acdha 4y ago

Forget 30 years ago, how many companies are running apps which are still being written that way? I think about this a lot in the context of open source. We’ve had a ton of great things happen from everyone being able to share code but there is a valid concern about vulnerabilities in code which has been orphaned or was written by someone who wasn’t familiar with secure coding practices. For example, businesses have seen billions of dollars in benefit from WordPress based on the cost vs. functionality / productivity of commercial CMS applications but WP plugins are a famous source of exploits and many of them are written by people who don’t even have the time or skills to secure them if they did. It feels like there should be some way to change that but it’s not clear whether any of the efforts to fund open source will get enough traction.