3 ms·
The problem with prioritizing security is that it is hard to measure preventing bad things which may happen in the future. For example, how do you reward emplo
by jmathai 2y ago
The problem with prioritizing security is that it is hard to measure preventing bad things which may happen in the future.
For example, how do you reward employees for investing in security, besides punishing them for security breaches?
I've seen this sort of message come from CEOs but sub organizations optimize for what they're measured against. It's rarely security, tech debt, maintenance, etc.
- pjmlp 2y agoReward those that push for cultural changes, ship something in .NET, Go, Rust, Java, that would otherwise kept being done in C++, even though there is no technical reason other than "that is how we do around here". Sure it doesn't kill all kinds of exploits, but it would already be an improvement.