5 ms·

>As a project manager, that's the last thing you want. First, it'll show what you didn't manage well. Secondly, it costs money. Finally, negative findings will

>As a project manager, that's the last thing you want. First, it'll show what you didn't manage well. Secondly, it costs money. Finally, negative findings will delay delivery and means you failed to deliver on time, which is your only priority. And yet FAANGMAULs and other tech-first companies like Mozilla, seem to be doing quite well on security with relatively very few oversights, caused by dev gross negligence. So it's definetly possible to deliver airtight products if that's your goal and part of your dev culture, instead of just "ship it by Christmas at any cost".

Schiendelman 3y ago
Sure, they have product managers.
ziddoap 3y ago
It's too early to play guess the acronym for me. What is the MAUL part of your FAANGMAUL acronym.
- james-skemp 3y ago
  Microsoft, Uber, Lyft, and AirBnB is what I eventually found. FAANGMULA in the above case.
  - hbn 3y ago
    Why are Uber, Lyft, and AirBnB being added only now, after their infinite-VC-money heyday is drying up, and when the general public is starting to hate them and are returning to taxis and hotels?
- trantrungtin 3y ago
  Microsoft, Airbnb, Uber, Lyft. When will we stop adding companies' acronyms?
  - karmakaze 3y ago
    I'll stick with the ~1T market cap software/service ones: Facebook, Apple, Amazon, Microsoft, Google/Alphabet: FAAMG; But in discussions I'll include any company that has similar tech/business requirements or behavior.
    - _jcrossley 3y ago
      I think I’ve heard MAGMA for this :)
      - karmakaze 3y ago
        If we're using (M)eta for FB, shouldn't we use (A)lphabet rather than G? MAAMA
    - camgunz 3y ago
      (and gamma)
  - wkat4242 3y ago
    I just keep using the term Big Tech. FAANG was nice but it's too annoying to keep acronyms up to date.
  - xxr 3y ago
    When all the thoughtlord talent is finally and permanently collected into an enumerable initialism, so no thoughtlord feels any insecurity at being excluded from FAANGMAULTALONRIP.
kasey_junk 3y ago
Those companies spend a bananas amount of money on security and pay a huge price in delivery times. They can afford to. New enterprises can’t. And if you go back to those companies growth phases you’ll see security decisions that seem bananas now.
pas 3y ago
What? Mozilla basically abandoned Servo, because of costs. And spent some money on CEO pay and on ridiculous preach-to-the-choir outreach campaigns and whatnot. And they regularly say no to security features. (eg. TLSA/DANE support https://bugzilla.mozilla.org/show_bug.cgi?id=672600 https://bugzilla.mozilla.org/show_bug.cgi?id=672600 )
figassis 3y ago
At some point their engineers are just better. I've been part of teams where every one was highly skilled, maybe a few juniors. And teams where everyone was junior and because they were very skilled on one specific thing, they assumed they were senior. The difference in those teams are that skilled engineers: - Code review holistically bc they understand that part of the codebase, and other parts it interacts with, and they ask thoughtful questions. So things like logging sensitive info in plain text are not even a question. - They understand how multiple components of a system work, like the tcp/ip stack, http, and other parts. Specifically not just how they eg. send messages, but how connections are setup/managed/torn down. Often that's where the security issues are (like which parts of a connection are insecure and when/how the upgrade happens). - They have this deep understanding because they put effort and time to diagnose issues that happen do them and enjoy sharing. Unskilled devs just say "it's not working, someone else fix it please". I had a mobile dev once lose his mind because he was unable to upload a file to the api. Turned out his app was using a library that was messing up the multipart upload boundaries and content length headers (tracked it to a bug with multiple gh issues). He was unable to use this info to proceed. - Participate in the hiring process, for they're a good filter for the company - They abstract away a lot of the implementation details from product managers and eat a lot of the complexity to the point that the product manager only sees 60% or less of the actual work in Jira. - A security autidor would need to really be worth his pay to find vulnerabilities, scanning for OWASP top 10 is not enough. Note, these engineers do not need to be 10x, they just need to...be engineers. Companies like Sunbird would not know how to tell one from the other, and product managers don't know what a secure app looks like. They could actually add that as a requirement and not know how to verify it. Often it's the developers that tell QA how to verify something. If your engineers are crap, you end up with apps like Nothing Chat. They aren't to blame, the company had no standards to begin with.

Schiendelman 3y ago

Sure, they have product managers.

ziddoap 3y ago

It's too early to play guess the acronym for me. What is the MAUL part of your FAANGMAUL acronym.

james-skemp 3y ago
Microsoft, Uber, Lyft, and AirBnB is what I eventually found. FAANGMULA in the above case.
- hbn 3y ago
  Why are Uber, Lyft, and AirBnB being added only now, after their infinite-VC-money heyday is drying up, and when the general public is starting to hate them and are returning to taxis and hotels?
trantrungtin 3y ago
Microsoft, Airbnb, Uber, Lyft. When will we stop adding companies' acronyms?
- karmakaze 3y ago
  I'll stick with the ~1T market cap software/service ones: Facebook, Apple, Amazon, Microsoft, Google/Alphabet: FAAMG; But in discussions I'll include any company that has similar tech/business requirements or behavior.
  - _jcrossley 3y ago
    I think I’ve heard MAGMA for this :)
    - karmakaze 3y ago
      If we're using (M)eta for FB, shouldn't we use (A)lphabet rather than G? MAAMA
  - camgunz 3y ago
    (and gamma)
- wkat4242 3y ago
  I just keep using the term Big Tech. FAANG was nice but it's too annoying to keep acronyms up to date.
- xxr 3y ago
  When all the thoughtlord talent is finally and permanently collected into an enumerable initialism, so no thoughtlord feels any insecurity at being excluded from FAANGMAULTALONRIP.

kasey_junk 3y ago

Those companies spend a bananas amount of money on security and pay a huge price in delivery times. They can afford to. New enterprises can’t. And if you go back to those companies growth phases you’ll see security decisions that seem bananas now.

pas 3y ago

What? Mozilla basically abandoned Servo, because of costs. And spent some money on CEO pay and on ridiculous preach-to-the-choir outreach campaigns and whatnot. And they regularly say no to security features. (eg. TLSA/DANE support https://bugzilla.mozilla.org/show_bug.cgi?id=672600 https://bugzilla.mozilla.org/show_bug.cgi?id=672600 )

figassis 3y ago

At some point their engineers are just better. I've been part of teams where every one was highly skilled, maybe a few juniors. And teams where everyone was junior and because they were very skilled on one specific thing, they assumed they were senior. The difference in those teams are that skilled engineers: - Code review holistically bc they understand that part of the codebase, and other parts it interacts with, and they ask thoughtful questions. So things like logging sensitive info in plain text are not even a question. - They understand how multiple components of a system work, like the tcp/ip stack, http, and other parts. Specifically not just how they eg. send messages, but how connections are setup/managed/torn down. Often that's where the security issues are (like which parts of a connection are insecure and when/how the upgrade happens). - They have this deep understanding because they put effort and time to diagnose issues that happen do them and enjoy sharing. Unskilled devs just say "it's not working, someone else fix it please". I had a mobile dev once lose his mind because he was unable to upload a file to the api. Turned out his app was using a library that was messing up the multipart upload boundaries and content length headers (tracked it to a bug with multiple gh issues). He was unable to use this info to proceed. - Participate in the hiring process, for they're a good filter for the company - They abstract away a lot of the implementation details from product managers and eat a lot of the complexity to the point that the product manager only sees 60% or less of the actual work in Jira. - A security autidor would need to really be worth his pay to find vulnerabilities, scanning for OWASP top 10 is not enough. Note, these engineers do not need to be 10x, they just need to...be engineers. Companies like Sunbird would not know how to tell one from the other, and product managers don't know what a secure app looks like. They could actually add that as a requirement and not know how to verify it. Often it's the developers that tell QA how to verify something. If your engineers are crap, you end up with apps like Nothing Chat. They aren't to blame, the company had no standards to begin with.