4 ms·

Is this the end of "responsible disclosure?" Seems all these companies do is drag their feet in the face of vulnerabilities.

magnetowasright 3y ago
Between this kind of feet dragging behaviour, the total lack of QA (especially with microsoft), and some of the murmurings on how people have been screwed over with bug bounty programs, it kinda feels like the end to me.
- withinboredom 3y ago
  It's not just microsoft. The "throw it over the wall and let QA find my bugs" mentality is going strong everywhere these days. It's like devs don't care anymore. Throw in the fact that most devs can't even be bothered to learn their tools (such as git) beyond simple incantations ... Yeah, software has gone to shit, yet it powers the world.
  - yfw 3y ago
    [flagged]
  - dymax78 3y ago
    Odd position. Apache devs thanklessly busted their ass patching log4shell in 2021.
    - richbell 3y ago
      I don't think that's a good example. While Apache devs are volunteers and Microsoft devs are employees, they were nevertheless criticized for their slow response time and perceived lack of urgency until it was far too late. https://github.com/apache/logging-log4j2/pull/608#issuecomment-990065982 https://github.com/apache/logging-log4j2/pull/608#issuecomme...
  - magnetowasright 3y ago
    You're right, it is everywhere. I call out microsoft specifically because of their flat out destruction of their QA teams and their pioneering of normalising totally broken software amongst tech people, power users, and the generally clueless alike. Things couldn't be this bad across the board without microsoft and such hits as that time a windows update somehow started deleting people's files, or one that changed all printers to one specific model. That's even ignoring the gaming side of microsoft and they fully support the release of games they publish that are varying shades of unplayable at launch, like Forza Horizon 5. I strongly disagree that devs as in software engineer/software developer titled people are the problem, though. Devs as in the companies, like Playground Games as the developer of FH5, are though. The companies don't care. Why would they? Release garbage, get a bunch of money, and maybe tidy up a few bugs ...eventually. Maybe. Why have staff learn their craft and know their tools when the company priorities don't need it? Why respect the craft as a craft at all when all you want is code monkeys to do what they're damned well told? That culture hasn't come from software developers the people, it comes from the staff at these companies who realise it's cheaper in the short term to just burn people out to slap something together as quickly as possible and rake in the cash. On to the next steaming pile of garbage and a totally new team because the last lot left the industry entirely after suffering under that shit. Even better if you can get a bunch of bright-eyes, bushy-tailed, single, childless interns who don't yet have the experience to know how bad it all is. Why hire someone who has been in the industry for more than a couple of years who wants to bother with things like source control, QA, BA, mentoring the newbies, or anything else that slows everything down when you can just ...not do that and still get money? It's not the software devs whose passion is selling in-game currencies, live service slot machine garbage, or lovingly reinstalling candy crush every time you update windows; that's the realm of 'infinite' growth fetishising weirdos. They don't need artist/wizard/god-tier problem solving software engineers who can squeeze an unimaginable amount of value out of every single bit of memory on the PS1 to bring the world of Crash Bandicoot to life. They don't need an operating system that is thoughtfully engineered. They don't need an office suite that actually works. They want ongoing revenue and that is the only thing that matters. Pardon my ramble, but unfortunately, right now we all have bills to pay, and there's just not enough great jobs doing great things (in at least a thoughtful way) for all of us.
    - 3y ago
- krageon 3y ago
  bug bounty programs are almost never really safe for the researcher
DANmode 3y ago
What metric does the SLA depend on? Expect dishonesty on that metric, from finance-led firms.
Log_out_ 3y ago
They have no incentive, sitting in the giant walled gardens of their monopolies. What is needed is a "zero friction transition" law. As in everything you have gets exported to neutral formats, allowing easy eco system transitions. Aka competition. That most hated word at cooperate.

magnetowasright 3y ago

Between this kind of feet dragging behaviour, the total lack of QA (especially with microsoft), and some of the murmurings on how people have been screwed over with bug bounty programs, it kinda feels like the end to me.

withinboredom 3y ago
It's not just microsoft. The "throw it over the wall and let QA find my bugs" mentality is going strong everywhere these days. It's like devs don't care anymore. Throw in the fact that most devs can't even be bothered to learn their tools (such as git) beyond simple incantations ... Yeah, software has gone to shit, yet it powers the world.
- yfw 3y ago
  [flagged]
- dymax78 3y ago
  Odd position. Apache devs thanklessly busted their ass patching log4shell in 2021.
  - richbell 3y ago
    I don't think that's a good example. While Apache devs are volunteers and Microsoft devs are employees, they were nevertheless criticized for their slow response time and perceived lack of urgency until it was far too late. https://github.com/apache/logging-log4j2/pull/608#issuecomment-990065982 https://github.com/apache/logging-log4j2/pull/608#issuecomme...
- magnetowasright 3y ago
  You're right, it is everywhere. I call out microsoft specifically because of their flat out destruction of their QA teams and their pioneering of normalising totally broken software amongst tech people, power users, and the generally clueless alike. Things couldn't be this bad across the board without microsoft and such hits as that time a windows update somehow started deleting people's files, or one that changed all printers to one specific model. That's even ignoring the gaming side of microsoft and they fully support the release of games they publish that are varying shades of unplayable at launch, like Forza Horizon 5. I strongly disagree that devs as in software engineer/software developer titled people are the problem, though. Devs as in the companies, like Playground Games as the developer of FH5, are though. The companies don't care. Why would they? Release garbage, get a bunch of money, and maybe tidy up a few bugs ...eventually. Maybe. Why have staff learn their craft and know their tools when the company priorities don't need it? Why respect the craft as a craft at all when all you want is code monkeys to do what they're damned well told? That culture hasn't come from software developers the people, it comes from the staff at these companies who realise it's cheaper in the short term to just burn people out to slap something together as quickly as possible and rake in the cash. On to the next steaming pile of garbage and a totally new team because the last lot left the industry entirely after suffering under that shit. Even better if you can get a bunch of bright-eyes, bushy-tailed, single, childless interns who don't yet have the experience to know how bad it all is. Why hire someone who has been in the industry for more than a couple of years who wants to bother with things like source control, QA, BA, mentoring the newbies, or anything else that slows everything down when you can just ...not do that and still get money? It's not the software devs whose passion is selling in-game currencies, live service slot machine garbage, or lovingly reinstalling candy crush every time you update windows; that's the realm of 'infinite' growth fetishising weirdos. They don't need artist/wizard/god-tier problem solving software engineers who can squeeze an unimaginable amount of value out of every single bit of memory on the PS1 to bring the world of Crash Bandicoot to life. They don't need an operating system that is thoughtfully engineered. They don't need an office suite that actually works. They want ongoing revenue and that is the only thing that matters. Pardon my ramble, but unfortunately, right now we all have bills to pay, and there's just not enough great jobs doing great things (in at least a thoughtful way) for all of us.
  - 3y ago
krageon 3y ago
bug bounty programs are almost never really safe for the researcher

DANmode 3y ago

What metric does the SLA depend on? Expect dishonesty on that metric, from finance-led firms.

Log_out_ 3y ago

They have no incentive, sitting in the giant walled gardens of their monopolies. What is needed is a "zero friction transition" law. As in everything you have gets exported to neutral formats, allowing easy eco system transitions. Aka competition. That most hated word at cooperate.