4 ms·

I get what your saying, but boy do I not want to live in society created by this worldview. In my opinion, this approach is antisocial. It forces everyone to wr

I get what your saying, but boy do I not want to live in society created by this worldview. In my opinion, this approach is antisocial. It forces everyone to write massive contracts and build bureaucratic mega processes to validate and specify every single definition in that contract because you can't ever trust your counterparty to abide by the spirit of your request.

blurker 3y ago
This comment really nicely captures how I feel about this. There's something to be said about good faith and knowing what the spirit of the agreement is. There are some comments here saying stuff like "these compliance forms are ridiculous and are often just bureaucratic nonsense" and you see comments advocating for playing dumb and answering in bad faith and there you go. I see there being a bit of an attitude of "everyone is doing it" to justify also doing it just to compete because you're at a disadvantage if you don't. And that's not entirely wrong but it sucks and I personally will avoid competing in that way. Probably that means not much sales in my career. Or science, but that's another topic...
jabradoodle 3y ago
To be fair, if you really care, there should be a specification that you are referring to and an independent organisation carrying out the test. Living in a world where the security of critical software is based on a good faith "trust me bro" doesn't sound ideal.
- delusional 3y ago
  I worry that this is how we all end up doing meaningless administrative work, while we outsource all the useful "actual" work to poorer nations, where all of our administrative specifications can be overlooked or ignored.
  - jabradoodle 3y ago
    To each their own, I don't want to be the victim of identify theft because sales pushed engineering into releasing shit code with a simple buffer overflow that noone ever tested for.
    - delusional 3y ago
      Why does my worry about bureaucracy have to mean I want to be the victim of identity theft? I understand and agree with the value of good security practices. I just worry that assuming all software is insecure unless some very complicated and "iron clad" contracts exists and are independently validated. It's a recipe for a very inefficient society. I actually worry that this mindset of adversarial relationships make it MORE likely for your identity to be stolen.
      - jabradoodle 3y ago
        I don't think there is too much software a government agency will buy that I wouldn't like to see pen tested. By it's nature government is often dealing with sensitive data. I'm not sure why having standards that should be met around software testing would make my data less secure. Weve seen leak after leak and so frequently it's some basic issue caused by massive incompetence, or more often, by decision makers cutting corners to make a quick profit.

blurker 3y ago

This comment really nicely captures how I feel about this. There's something to be said about good faith and knowing what the spirit of the agreement is. There are some comments here saying stuff like "these compliance forms are ridiculous and are often just bureaucratic nonsense" and you see comments advocating for playing dumb and answering in bad faith and there you go. I see there being a bit of an attitude of "everyone is doing it" to justify also doing it just to compete because you're at a disadvantage if you don't. And that's not entirely wrong but it sucks and I personally will avoid competing in that way. Probably that means not much sales in my career. Or science, but that's another topic...

jabradoodle 3y ago

To be fair, if you really care, there should be a specification that you are referring to and an independent organisation carrying out the test. Living in a world where the security of critical software is based on a good faith "trust me bro" doesn't sound ideal.

delusional 3y ago
I worry that this is how we all end up doing meaningless administrative work, while we outsource all the useful "actual" work to poorer nations, where all of our administrative specifications can be overlooked or ignored.
- jabradoodle 3y ago
  To each their own, I don't want to be the victim of identify theft because sales pushed engineering into releasing shit code with a simple buffer overflow that noone ever tested for.
  - delusional 3y ago
    Why does my worry about bureaucracy have to mean I want to be the victim of identity theft? I understand and agree with the value of good security practices. I just worry that assuming all software is insecure unless some very complicated and "iron clad" contracts exists and are independently validated. It's a recipe for a very inefficient society. I actually worry that this mindset of adversarial relationships make it MORE likely for your identity to be stolen.
    - jabradoodle 3y ago
      I don't think there is too much software a government agency will buy that I wouldn't like to see pen tested. By it's nature government is often dealing with sensitive data. I'm not sure why having standards that should be met around software testing would make my data less secure. Weve seen leak after leak and so frequently it's some basic issue caused by massive incompetence, or more often, by decision makers cutting corners to make a quick profit.