3 ms·

I have an email in my inbox just this morning from a developer with the magic phrase “I just want to…” in it. I mentally auto complete the suffix as: “disregar

I have an email in my inbox just this morning from a developer with the magic phrase “I just want to…” in it. I mentally auto complete the suffix as: “disregard security requirements, ignore best practices, cut corners, do the needful at someone else’s expense, etc…” There is no scenario where the rest of the sentence is “…do the right thing.” I get an email like this weekly at a minimum. This one is asking to punch an unauthorised, unauthenticated, unaudited path from the Internet to legacy servers on the network that will go end-of-life in a month. Exposing the gooey vulnerable insides of a huge network to direct attack. I’ll politely refuse. He’ll just go to someone else, who won’t refuse. You can assume the same scenario plays out every few seconds world-wide. It might be code review, or using a hard-coded credential “just for now”, or whatever. This is the typical reality of software development. From what I’ve heard, embedded and industrial control software is worse still.

midoridensha 3y ago
>From what I’ve heard, embedded and industrial control software is worse still. Avionics software is not like this at all. There's a reason you never hear about software failures in airplanes. (Before some wise-ass says something about the Boeing MCAS in the 737MAX, that wasn't a software failure. The software worked perfectly, flying the planes into the ground exactly was it was designed to do by the systems engineers and corporate executives who conceived of MCAS and thought it'd be a great idea to take input from a single sensor.) Industrial control software is pretty bad though.
rbreaves 3y ago
You sound like a bundle of joy. To me it all depends on the situation - but I’ve dealt w/ network engineers that really had no business being over it or any real understanding of Linux, ssh, tunnels, etc. He was constantly ignoring my work related requests that absolutely needed resolution in 4-48hrs so I just stopped communicating w/ him. The moment I gained access to a staging server that wasn’t locked down to hell & back I forwarded whatever ports & level of access that I needed. It’d have served the company better to give me the permissions to open up ports & access as I needed in the first place, devs need access to what they’re dev’ing or running against but given the level of quality people I was dealing w/ I just gave up & granted myself access in other ways vs opening up support tickets all the time. I did recently gain access to an employee that was on it though & used common sense - sadly they’ve resigned & I don’t know why but I do know it’s a HUGE loss. They had some amazing side projects going on too - the guy was valuable imo & an effort to keep him should have been made if it hadn’t.
- jiggawatts 3y ago
  The request came from a team that regularly deploys plain-text HTTP anonymous (unauthenticated) APIs for setting user passwords via an injection-vulnerable query. Don’t worry though, they “encrypt” the password.

midoridensha 3y ago

>From what I’ve heard, embedded and industrial control software is worse still. Avionics software is not like this at all. There's a reason you never hear about software failures in airplanes. (Before some wise-ass says something about the Boeing MCAS in the 737MAX, that wasn't a software failure. The software worked perfectly, flying the planes into the ground exactly was it was designed to do by the systems engineers and corporate executives who conceived of MCAS and thought it'd be a great idea to take input from a single sensor.) Industrial control software is pretty bad though.

rbreaves 3y ago

You sound like a bundle of joy. To me it all depends on the situation - but I’ve dealt w/ network engineers that really had no business being over it or any real understanding of Linux, ssh, tunnels, etc. He was constantly ignoring my work related requests that absolutely needed resolution in 4-48hrs so I just stopped communicating w/ him. The moment I gained access to a staging server that wasn’t locked down to hell & back I forwarded whatever ports & level of access that I needed. It’d have served the company better to give me the permissions to open up ports & access as I needed in the first place, devs need access to what they’re dev’ing or running against but given the level of quality people I was dealing w/ I just gave up & granted myself access in other ways vs opening up support tickets all the time. I did recently gain access to an employee that was on it though & used common sense - sadly they’ve resigned & I don’t know why but I do know it’s a HUGE loss. They had some amazing side projects going on too - the guy was valuable imo & an effort to keep him should have been made if it hadn’t.

jiggawatts 3y ago
The request came from a team that regularly deploys plain-text HTTP anonymous (unauthenticated) APIs for setting user passwords via an injection-vulnerable query. Don’t worry though, they “encrypt” the password.