4 ms·

This is a problem traditionally solved by the professional engineering licensing system. Most engineering curriculum in the USA involve an Engineering Ethics co

by davemp 3y ago

This is a problem traditionally solved by the professional engineering licensing system. Most engineering curriculum in the USA involve an Engineering Ethics course that goes over such issues. We're quite far from implementing such a system for software "engineers".

comboy 3y ago
Just hire pentesters along with the development team. Make sure they are not affiliates. You can put in contract that as long as security issues are present they need to fix them before getting paid, which seems like a reasonable expectation. Even the best make mistakes, so let's at least leave those which are not trivial. We don't trust building ethics, independent inspector comes and checks if everything is as it should be before it can be used by the public.
- otherme123 3y ago
  This can't happen more often than not, because the client has no idea what a pentest is. They don't even know what a is XSS means, or even API. These things are negotiated by people that only can see the frontend, and if it looks great, _snappy_, _flashy_, with random animations and following current trends it's OK. The contractors know and can easily detect this, so they focus on frontend and don't waste their time in behind-the-scenes polish. You don't polish the security or find a costly query that could bring the site to their knees, but you add a scroll-spy that brings some images from nowhere.
  - comboy 3y ago
    Investors have no idea what thickness the wall should be in their building either. Clients not being experts at the job they are getting somebody else to do is not a new pattern. So while some trust is required, it's best if you can get somebody else to verify. I've seen a few smart clients over the years which when faced with some excuses from a software house hired another one to give them opinion about the codebase and capabilities. It seems pretty intuitive. It seems like a money well spent.
    - JohnFen 3y ago
      > Clients not being experts at the job they are getting somebody else to do is not a new pattern In fact, a whole lot of the time, the entire reason someone hires a professional is precisely because they themselves aren't experts.
robocat 3y ago
> solved by the professional engineering licensing system Good narrative: but certification and guilds do not solve the problem.
- davemp 3y ago
  No, but actual liability does.
  - robocat 3y ago
    If that were true, then there would be zero disasters in high liability countries. liability doesn’t prevent disasters from happening. For example: UK Grenfall towers. https://www.bbc.com/news/uk-61724373 https://www.bbc.com/news/uk-61724373 It is a wrong to assume that only engineers can cause deadly mistakes. Also we have penal liabilities that don’t need licensing: The [UK] Health and Safety at Work Act 1974 is designed to stop employers putting the public at risk, not just employees in the workplace. Individuals can be prosecuted and a serious breach could attract a two-year prison sentence. And sometimes some pretty big exceptions: the [UK] government can't be prosecuted for corporate manslaughter Locally to me in Christchurch, New Zealand, there have been no prosecution for the CTV tower collapse: https://www.nzherald.co.nz/nz/fatal-ctv-building-collapse-police-complete-criminal-investigation/ASPACLQEHJD3KCGVA36MHKNHNM/ https://www.nzherald.co.nz/nz/fatal-ctv-building-collapse-po... https://www.nzherald.co.nz/business/govt-considering-introducing-corporate-manslaughter-law-to-enable-ctv-prosecution/JGZXZODGTUGUEMW3YYOVHT4NDY/ https://www.nzherald.co.nz/business/govt-considering-introdu... The second link is interesting because it looks at changing the law to add liability (not engineers licensing changes ) In both cases, there are multiple layers of failure, and many causes could be asssigned. Especially the CTV building with inspections before collapse and warnings from people working there ignored.
    - davemp 3y ago
      If you're looking for a perfect solution to pretty much any problem involving humans, I have bad news for you.

by davemp 3y ago

comboy 3y ago

Just hire pentesters along with the development team. Make sure they are not affiliates. You can put in contract that as long as security issues are present they need to fix them before getting paid, which seems like a reasonable expectation. Even the best make mistakes, so let's at least leave those which are not trivial. We don't trust building ethics, independent inspector comes and checks if everything is as it should be before it can be used by the public.

otherme123 3y ago
This can't happen more often than not, because the client has no idea what a pentest is. They don't even know what a is XSS means, or even API. These things are negotiated by people that only can see the frontend, and if it looks great, _snappy_, _flashy_, with random animations and following current trends it's OK. The contractors know and can easily detect this, so they focus on frontend and don't waste their time in behind-the-scenes polish. You don't polish the security or find a costly query that could bring the site to their knees, but you add a scroll-spy that brings some images from nowhere.
- comboy 3y ago
  Investors have no idea what thickness the wall should be in their building either. Clients not being experts at the job they are getting somebody else to do is not a new pattern. So while some trust is required, it's best if you can get somebody else to verify. I've seen a few smart clients over the years which when faced with some excuses from a software house hired another one to give them opinion about the codebase and capabilities. It seems pretty intuitive. It seems like a money well spent.
  - JohnFen 3y ago
    > Clients not being experts at the job they are getting somebody else to do is not a new pattern In fact, a whole lot of the time, the entire reason someone hires a professional is precisely because they themselves aren't experts.

robocat 3y ago

> solved by the professional engineering licensing system Good narrative: but certification and guilds do not solve the problem.

davemp 3y ago
No, but actual liability does.
- robocat 3y ago
  If that were true, then there would be zero disasters in high liability countries. liability doesn’t prevent disasters from happening. For example: UK Grenfall towers. https://www.bbc.com/news/uk-61724373 https://www.bbc.com/news/uk-61724373 It is a wrong to assume that only engineers can cause deadly mistakes. Also we have penal liabilities that don’t need licensing: The [UK] Health and Safety at Work Act 1974 is designed to stop employers putting the public at risk, not just employees in the workplace. Individuals can be prosecuted and a serious breach could attract a two-year prison sentence. And sometimes some pretty big exceptions: the [UK] government can't be prosecuted for corporate manslaughter Locally to me in Christchurch, New Zealand, there have been no prosecution for the CTV tower collapse: https://www.nzherald.co.nz/nz/fatal-ctv-building-collapse-police-complete-criminal-investigation/ASPACLQEHJD3KCGVA36MHKNHNM/ https://www.nzherald.co.nz/nz/fatal-ctv-building-collapse-po... https://www.nzherald.co.nz/business/govt-considering-introducing-corporate-manslaughter-law-to-enable-ctv-prosecution/JGZXZODGTUGUEMW3YYOVHT4NDY/ https://www.nzherald.co.nz/business/govt-considering-introdu... The second link is interesting because it looks at changing the law to add liability (not engineers licensing changes ) In both cases, there are multiple layers of failure, and many causes could be asssigned. Especially the CTV building with inspections before collapse and warnings from people working there ignored.
  - davemp 3y ago
    If you're looking for a perfect solution to pretty much any problem involving humans, I have bad news for you.