3 ms·

I hope this is facetious. Security is everyone’s job, and unencrypted customer data, outside of a locked-down DB, should give one pause.

soulofmischief 3y ago
Everyone here is to blame. Not just the PM, not just the engineers. I'd also blame the hiring manager.
- kergonath 3y ago
  All the way to the CEOs. I find it hard to believe that someone at this position in a tech company did not see any red flags, particularly as all the tech forums I have seen pointed out the potential issues within minutes of the announcement.
FirmwareBurner 3y ago
>I hope this is facetious. Nope, not at all. >Security is everyone’s job In theory at well run tech companies ideally yes, but when you're overworked and underpaid and crunching like in a sweatshop to meet some arbitrary deadline coming from above that you did not agree with, then work becomes a chore doing the bare minimum just to get home before dinner, and every other potential issue outside my allotted tickets that's not part of my KPIs becomes "not my job" and "someone else's problem" because "fuck it, I'm already overworked and I won't get any extra recognition for doing even more overtime on security topics nobody seems to care about". In short, as a dev, you don't care about the outcome of the product because you're not paid or empowered enough to care. Shit rolls uphill. If you want devs to actually give a fuck about the product as a whole instead of just mindlessly punching Jira tickets, then you need to empower them, pay them well and respect them and their WLB, which the vast majority of companies worldwide do not (HNers are a priviledged bubble that's the exception). Otherwise you get what you se before you, a shitshow, because most tech companies are run like crap.
kergonath 3y ago
Well, managers are happy to take responsibility for their project/product when everything goes well. It’s actually the argument for their salaries and bonuses compared to lowly engineers. So why should they not take responsibility when it goes sideways? Particularly when failure affects the whole product like the Sunbird app. You cannot say that the project works because of you, and then turn around and pretend you have nothing to do with its failures.
- FirmwareBurner 3y ago
  >You cannot say that the project works because of you, and then turn around and pretend you have nothing to do with its failures. You'd be surprised. I've been in at least 2 companies where that was the case and had to be the scapegoat for projects going sideways due to poor management. Humans are shit and would much rather push the blame on someone if the company culture is not blameless.
  - kergonath 3y ago
    Fair enough! I should have written “you cannot in good faith”.
RHSman2 3y ago
Their definition of done clearly didn’t align with reality. Product Managers fault although I am sure there is more to the story (aka no Product Manager)
Kalium 3y ago
One of the counterintuitive things I've learned is that "security is everyone's job" is one of the worst possible scenarios. First, the vast majority of people are not equipped to find or address major security issues well. Unless you have specialists integrated in the right places this means everyone's likely to be bad at the security part of their job and ill-equipped to notice. Second, this means conflicts of interest everywhere. When you have a dedicated security org, you have people whose job it is to catch issues, hold things up, and generally make sure things get fixed. Without that, you have a bunch of people who have to choose between the possibility of a security event they don't understand and the certainty of blowing a deadline. Third, security being everyone's job almost certainly means accountability is broken. Consequences will likely fall on some junior employee who might be directly accountable for an issue, but the huge org around them that did not enable them to succeed go unaffected. You need specialists, an org to enable them, and an enterprise-wide apparatus to support a strong security process.

soulofmischief 3y ago

Everyone here is to blame. Not just the PM, not just the engineers. I'd also blame the hiring manager.

kergonath 3y ago
All the way to the CEOs. I find it hard to believe that someone at this position in a tech company did not see any red flags, particularly as all the tech forums I have seen pointed out the potential issues within minutes of the announcement.

FirmwareBurner 3y ago

>I hope this is facetious. Nope, not at all. >Security is everyone’s job In theory at well run tech companies ideally yes, but when you're overworked and underpaid and crunching like in a sweatshop to meet some arbitrary deadline coming from above that you did not agree with, then work becomes a chore doing the bare minimum just to get home before dinner, and every other potential issue outside my allotted tickets that's not part of my KPIs becomes "not my job" and "someone else's problem" because "fuck it, I'm already overworked and I won't get any extra recognition for doing even more overtime on security topics nobody seems to care about". In short, as a dev, you don't care about the outcome of the product because you're not paid or empowered enough to care. Shit rolls uphill. If you want devs to actually give a fuck about the product as a whole instead of just mindlessly punching Jira tickets, then you need to empower them, pay them well and respect them and their WLB, which the vast majority of companies worldwide do not (HNers are a priviledged bubble that's the exception). Otherwise you get what you se before you, a shitshow, because most tech companies are run like crap.

kergonath 3y ago

Well, managers are happy to take responsibility for their project/product when everything goes well. It’s actually the argument for their salaries and bonuses compared to lowly engineers. So why should they not take responsibility when it goes sideways? Particularly when failure affects the whole product like the Sunbird app. You cannot say that the project works because of you, and then turn around and pretend you have nothing to do with its failures.

FirmwareBurner 3y ago
>You cannot say that the project works because of you, and then turn around and pretend you have nothing to do with its failures. You'd be surprised. I've been in at least 2 companies where that was the case and had to be the scapegoat for projects going sideways due to poor management. Humans are shit and would much rather push the blame on someone if the company culture is not blameless.
- kergonath 3y ago
  Fair enough! I should have written “you cannot in good faith”.

RHSman2 3y ago

Their definition of done clearly didn’t align with reality. Product Managers fault although I am sure there is more to the story (aka no Product Manager)

Kalium 3y ago

One of the counterintuitive things I've learned is that "security is everyone's job" is one of the worst possible scenarios. First, the vast majority of people are not equipped to find or address major security issues well. Unless you have specialists integrated in the right places this means everyone's likely to be bad at the security part of their job and ill-equipped to notice. Second, this means conflicts of interest everywhere. When you have a dedicated security org, you have people whose job it is to catch issues, hold things up, and generally make sure things get fixed. Without that, you have a bunch of people who have to choose between the possibility of a security event they don't understand and the certainty of blowing a deadline. Third, security being everyone's job almost certainly means accountability is broken. Consequences will likely fall on some junior employee who might be directly accountable for an issue, but the huge org around them that did not enable them to succeed go unaffected. You need specialists, an org to enable them, and an enterprise-wide apparatus to support a strong security process.