3 ms·
I partially agree. While there is nothing wrong with boring "legacy" systems, and the world runs on them, practices like sending plain text passwords over email
by paxys 3y ago
I partially agree. While there is nothing wrong with boring "legacy" systems, and the world runs on them, practices like sending plain text passwords over email and all other security failures mentioned in the post are inexcusable. Software like Atrium is a perfect example of companies getting large contracts (usually in the public sector) through connections/corruption and outsourcing development for pennies, with no quality control or other oversight. This stuff should not be romanticized.
In fact there is a non-zero chance that the company's response to this blog post will be to file a lawsuit against these students for "hacking" and ruining their lives, as has happened many times in the past in such cases.
- gorjusborg 3y agoWhile I do not like the 'get out of breach free card' that companies like Equifax seem to get, your tone has that exact sort of arrogance that smacks of immaturity. You just can't always apply today's sensibilities to code that has lasted longer than your life so far. I agree that companies need to be held responsible for their decisions not to update security, but that's a different (related) issue than 'legacy'. I am more concerned with legislation and law enforcement. That's the real way to fix things. Rust rewrites wont change business incentives.
- elondaits 3y agoI’m 46 and been working professionally since the late 90s. There was never a time in the history of the web when storing user passwords in plaintext was OK. Encrypted passwords were already well established in UNIX.. although I remember using systems without shadow passwords or salt.
- gorjusborg 3y agoI am similar age, and there is software older than us that is still running.