5 ms·

> Which product manager in his/her right mind, thought this was passable when you're building and marketing your product as an iMessage alternative and every si

> Which product manager in his/her right mind, thought this was passable when you're building and marketing your product as an iMessage alternative and every single early access reviewer raised these exact security concerns in public? Why are we blaming PMs, here? Plenty of engineers out there make really stupid decisions every day. (To be clear: I'm an engineer, not a PM.)

FirmwareBurner 3y ago
>Why are we blaming PMs, here? Plenty of engineers out there make really stupid decisions every day. EXACTLY! Because it's a known fact all devs make mistakes, and as such, as a product manager/owner you're responsible for the bigger picture of the product and ensuring the right requirements, checks and bound are put in palce and validated for a successful product release. It's not the job of the lowly SW engineers who have little visibility in the product as a whole and who just sprint to punch out Jira tickets handed to them from above, to check your product works as intended, it's your job as a PM/PO to ensure the work of all the devs integrates nicely into a cohesive product as per the requirements/vision. Kind of like that famous story of that intern who got fired for deleting the production DB by mistake on his first day. Was it the intern's fault for the mistake or the fault of all the seniors and managers who should have placed the proper checks and bounds in place so that nobody can so easily delete the production DB? So the buck for the product success/fail stops with those at the top who orchestrate the band, not with the individual SW engineers at the bottom.
- mcny 3y ago
  Just yesterday I was protesting unnecessary complexity in my story until my lead had a sidebar chat about an upcoming project. How was I supposed to know that?
- sgarland 3y ago
  I hope this is facetious. Security is everyone’s job, and unencrypted customer data, outside of a locked-down DB, should give one pause.
  - soulofmischief 3y ago
    Everyone here is to blame. Not just the PM, not just the engineers. I'd also blame the hiring manager.
    - kergonath 3y ago
      All the way to the CEOs. I find it hard to believe that someone at this position in a tech company did not see any red flags, particularly as all the tech forums I have seen pointed out the potential issues within minutes of the announcement.
  - FirmwareBurner 3y ago
    >I hope this is facetious. Nope, not at all. >Security is everyone’s job In theory at well run tech companies ideally yes, but when you're overworked and underpaid and crunching like in a sweatshop to meet some arbitrary deadline coming from above that you did not agree with, then work becomes a chore doing the bare minimum just to get home before dinner, and every other potential issue outside my allotted tickets that's not part of my KPIs becomes "not my job" and "someone else's problem" because "fuck it, I'm already overworked and I won't get any extra recognition for doing even more overtime on security topics nobody seems to care about". In short, as a dev, you don't care about the outcome of the product because you're not paid or empowered enough to care. Shit rolls uphill. If you want devs to actually give a fuck about the product as a whole instead of just mindlessly punching Jira tickets, then you need to empower them, pay them well and respect them and their WLB, which the vast majority of companies worldwide do not (HNers are a priviledged bubble that's the exception). Otherwise you get what you se before you, a shitshow, because most tech companies are run like crap.
  - kergonath 3y ago
    Well, managers are happy to take responsibility for their project/product when everything goes well. It’s actually the argument for their salaries and bonuses compared to lowly engineers. So why should they not take responsibility when it goes sideways? Particularly when failure affects the whole product like the Sunbird app. You cannot say that the project works because of you, and then turn around and pretend you have nothing to do with its failures.
JCharante 3y ago
Are engineers really setting up sentry without it being on the roadmap? PMs direct the engineers.
- tfsh 3y ago
  Depends what the culture is at Sunbird. Potentially it's very bottom-up and eng is making all the technical decisions and PM just steers the overall vision. However I'd hope this is a case of an overworked team and over zealous management, because the alternative suggests a dangerously incompetent dev team.
  - FirmwareBurner 3y ago
    >PM just steers the overall vision So, they're useless? Product managers should ideally be the technical voice of reason between the tech illiterate visionaries and the engineers in the trenches, steering the visionaries on what's technically feasible within the available resources.
- tuetuopay 3y ago
  Observability is a good engineering practice. Sentry is invaluable to get app crashes in prod, and I wouldn't want any PM deciding whether we set up sentry or not. The real issue is the lack of control of what is logged and what logs go to sentry
- mrweasel 3y ago
  Yes... Why would a PM put Sentry on the roadmap, unless that PM has some reasonable level of technical understanding, but at that point the same PM should have been aware of many of the security implications of the overall project. A not unreasonable guess would be that Sunbird doesn't have a great number of senior engineers on staff, either do to cost, or because very few wanted to take on such a project. So it cobbled together by inexperienced engineering that know enough to understand the Sentry is useful, but not experienced enough avoid logging credentials. Basically all the errors listed in the article just reads like what happens when you set a bunch of inexperience developers and SREs to build a platform that doesn't want to exist. Which leads me to: How the does this even work? I'd assume a massive number of virtualized macOS installation, anything more advanced would sort of negate the incompetence on the security front. Sort of a side note: I questioned the point of the Nothing Phone and Nothing Phone 2 when they where both released, they are nothing more than Android phones with a few gimmick but everyone was loosing their minds over those things and now ArsTechnica writes: "Nothing has always seemed like an Android manufacturer that was more hype than substance" (and apparently also did for back when the Nothing Phone release. I'm getting so very tied of the hype and how easily any criticism can be reject as me being old and "not getting it".
rapnie 3y ago
They may have had a "Nothing to see here" culture.
wkat4242 3y ago
Because it's the PM's job to oversee the whole project end to end.
- grumple 3y ago
  Does your PM know the difference between HTTP and HTTPS? Mine doesn't. They manage tickets and expenses, not technical details.
  - wkat4242 3y ago
    Usually they would buy they have the tech audit teams to check these things anyway.

FirmwareBurner 3y ago

>Why are we blaming PMs, here? Plenty of engineers out there make really stupid decisions every day. EXACTLY! Because it's a known fact all devs make mistakes, and as such, as a product manager/owner you're responsible for the bigger picture of the product and ensuring the right requirements, checks and bound are put in palce and validated for a successful product release. It's not the job of the lowly SW engineers who have little visibility in the product as a whole and who just sprint to punch out Jira tickets handed to them from above, to check your product works as intended, it's your job as a PM/PO to ensure the work of all the devs integrates nicely into a cohesive product as per the requirements/vision. Kind of like that famous story of that intern who got fired for deleting the production DB by mistake on his first day. Was it the intern's fault for the mistake or the fault of all the seniors and managers who should have placed the proper checks and bounds in place so that nobody can so easily delete the production DB? So the buck for the product success/fail stops with those at the top who orchestrate the band, not with the individual SW engineers at the bottom.

mcny 3y ago
Just yesterday I was protesting unnecessary complexity in my story until my lead had a sidebar chat about an upcoming project. How was I supposed to know that?
sgarland 3y ago
I hope this is facetious. Security is everyone’s job, and unencrypted customer data, outside of a locked-down DB, should give one pause.
- soulofmischief 3y ago
  Everyone here is to blame. Not just the PM, not just the engineers. I'd also blame the hiring manager.
  - kergonath 3y ago
    All the way to the CEOs. I find it hard to believe that someone at this position in a tech company did not see any red flags, particularly as all the tech forums I have seen pointed out the potential issues within minutes of the announcement.
- FirmwareBurner 3y ago
  >I hope this is facetious. Nope, not at all. >Security is everyone’s job In theory at well run tech companies ideally yes, but when you're overworked and underpaid and crunching like in a sweatshop to meet some arbitrary deadline coming from above that you did not agree with, then work becomes a chore doing the bare minimum just to get home before dinner, and every other potential issue outside my allotted tickets that's not part of my KPIs becomes "not my job" and "someone else's problem" because "fuck it, I'm already overworked and I won't get any extra recognition for doing even more overtime on security topics nobody seems to care about". In short, as a dev, you don't care about the outcome of the product because you're not paid or empowered enough to care. Shit rolls uphill. If you want devs to actually give a fuck about the product as a whole instead of just mindlessly punching Jira tickets, then you need to empower them, pay them well and respect them and their WLB, which the vast majority of companies worldwide do not (HNers are a priviledged bubble that's the exception). Otherwise you get what you se before you, a shitshow, because most tech companies are run like crap.
- kergonath 3y ago
  Well, managers are happy to take responsibility for their project/product when everything goes well. It’s actually the argument for their salaries and bonuses compared to lowly engineers. So why should they not take responsibility when it goes sideways? Particularly when failure affects the whole product like the Sunbird app. You cannot say that the project works because of you, and then turn around and pretend you have nothing to do with its failures.

JCharante 3y ago

Are engineers really setting up sentry without it being on the roadmap? PMs direct the engineers.

tfsh 3y ago
Depends what the culture is at Sunbird. Potentially it's very bottom-up and eng is making all the technical decisions and PM just steers the overall vision. However I'd hope this is a case of an overworked team and over zealous management, because the alternative suggests a dangerously incompetent dev team.
- FirmwareBurner 3y ago
  >PM just steers the overall vision So, they're useless? Product managers should ideally be the technical voice of reason between the tech illiterate visionaries and the engineers in the trenches, steering the visionaries on what's technically feasible within the available resources.
tuetuopay 3y ago
Observability is a good engineering practice. Sentry is invaluable to get app crashes in prod, and I wouldn't want any PM deciding whether we set up sentry or not. The real issue is the lack of control of what is logged and what logs go to sentry
mrweasel 3y ago
Yes... Why would a PM put Sentry on the roadmap, unless that PM has some reasonable level of technical understanding, but at that point the same PM should have been aware of many of the security implications of the overall project. A not unreasonable guess would be that Sunbird doesn't have a great number of senior engineers on staff, either do to cost, or because very few wanted to take on such a project. So it cobbled together by inexperienced engineering that know enough to understand the Sentry is useful, but not experienced enough avoid logging credentials. Basically all the errors listed in the article just reads like what happens when you set a bunch of inexperience developers and SREs to build a platform that doesn't want to exist. Which leads me to: How the does this even work? I'd assume a massive number of virtualized macOS installation, anything more advanced would sort of negate the incompetence on the security front. Sort of a side note: I questioned the point of the Nothing Phone and Nothing Phone 2 when they where both released, they are nothing more than Android phones with a few gimmick but everyone was loosing their minds over those things and now ArsTechnica writes: "Nothing has always seemed like an Android manufacturer that was more hype than substance" (and apparently also did for back when the Nothing Phone release. I'm getting so very tied of the hype and how easily any criticism can be reject as me being old and "not getting it".

rapnie 3y ago

They may have had a "Nothing to see here" culture.

wkat4242 3y ago

Because it's the PM's job to oversee the whole project end to end.

grumple 3y ago
Does your PM know the difference between HTTP and HTTPS? Mine doesn't. They manage tickets and expenses, not technical details.
- wkat4242 3y ago
  Usually they would buy they have the tech audit teams to check these things anyway.