3 ms·

There are security vulnerabilities due to expediency and there are others due to ignorance. Expediency is an organizational issue. Ignorance could be considered

There are security vulnerabilities due to expediency and there are others due to ignorance. Expediency is an organizational issue. Ignorance could be considered organizational or personal. Part of the issue with software engineering as a field is we keep telling ourselves that university isn’t vocational training, even though we act as if it is. So it’s entirely possible (even likely) that a new grad hasn’t heard of any of the OWASP top 10 vulnerabilities, but they will know how to reverse a linked list. Organizations can harden themselves by making sure everyone has a minimum understanding of the most common threats. If you save a password in plaintext it’s malpractice at this point. Second thing is you need to have someone in the organization whose job isn’t beholden to expediency. Studies have to pass an ethics review before they’re greenlit. Maybe a product should at least get some eyeballs before it’s implemented.

infamouscow 2y ago
There's always going to be a new person that has to learn from experience -- I'm way less concerned about that problem. In fact, I will argue this is a complete waste of time to be concerned about at it. Mistakes happen, security-minded folks get sick, and teams get so busy they lose track of the daily news. The real problem stems from the organization issues. We didn't get the OPM breach, Equifax breach, $MASSIVE_ENTITY breach from 0-day's that went unpatched for a few days. We got those breaches from systemic incompetence of management for years and years.
atoav 2y ago
The problem is that studying CS does not automatically a good programmer make. And the truth is that many graduates would be glad if their software works. Designing in security from the start means you are experienced enough to no longer have to worry about it working at all, you worry about resources, security, extendability, dependecies — so you try to compose software from many single choices that yields you the needed functionality, while being computationally efficient, scalable, safe, secure, reliable, extendable, modular, well documented etc. You won't be able to write a masterful Haiku without learning to speak the language you want to write it in fluently first.
- x0x0 2y ago
  we're still an industry where many companies can't reliably ship basic crud apps. getting from there to solid security in the absence of extraordinary investment... not sure how that happens. Rachel of rachelbythebay related a story from a faang where some genius replaced code that created a directory with a shell call to `mkdir -p` in a core lib. Because it was convenient to get a mkdir call that would create parents. This got through code review! "Surprise, we're dumping the args you hand us straight to sh/bash/zsh/whatever. Hope every caller has a deep understanding of shell escaping rules and can correctly clean these args! tada!" You hear things like that and I'm not sure what hope most of us have... edit: https://rachelbythebay.com/w/2021/12/24/mkdir/ https://rachelbythebay.com/w/2021/12/24/mkdir/
  - Log_out_ 2y ago
    contain and recover from it,instead of fixing th complex cheese layers that is Software ? one huge try catch and a os that fires exception in case of the unexceptional? sandbox is all security?
    - x0x0 2y ago
      Oh, it definitely seems like, by default, a random process should not be allowed to fork a shell, and so doing should kill the process tree...
  - ozim 2y ago
    Sorry but that is not true and we have tools and processes that allow us to reliably deliver new versions of crud apps. I am doing that with multiple teams for over 10 years now. Yes I have seen teams that cannot get basic app to prod over the year because they mess around with tooling instead of doing the job. If you expect that there be no bugs - just go for an inspection with building inspector and check how many buildings have not even a single flaw.
myworkinisgood 2y ago
> If you save a password in plaintext it’s malpractice at this point. And yet there is no standardized way for applications like git, docker etc to interface with an encrypted password store.
- paulddraper 2y ago
  Why would git need passwords?
  - mjlee 2y ago
    To authenticate with remote repositories.
    - paulddraper 2y ago
      SSH keys my guy better than passwords
      - myworkinisgood 2y ago
        right, and what happens when you want to use that stuff in CIs?
harimau777 2y ago
I think that even ignorance is organizational. As the article points out, we don't reward people for becoming less ignorant about security so why should they put in the effort to do so?
- abbadadda 2y ago
  We can punish those who make egregious errors, like saving passwords in plain text, either literally or figuratively during code reviews (i.e., if a senior developer rejects a PR because it is too insecure)
- water-your-self 2y ago
  Becoming less ignorant is time that could have been spent on this sprint, and is often punished.

infamouscow 2y ago

There's always going to be a new person that has to learn from experience -- I'm way less concerned about that problem. In fact, I will argue this is a complete waste of time to be concerned about at it. Mistakes happen, security-minded folks get sick, and teams get so busy they lose track of the daily news. The real problem stems from the organization issues. We didn't get the OPM breach, Equifax breach, $MASSIVE_ENTITY breach from 0-day's that went unpatched for a few days. We got those breaches from systemic incompetence of management for years and years.

atoav 2y ago

The problem is that studying CS does not automatically a good programmer make. And the truth is that many graduates would be glad if their software works. Designing in security from the start means you are experienced enough to no longer have to worry about it working at all, you worry about resources, security, extendability, dependecies — so you try to compose software from many single choices that yields you the needed functionality, while being computationally efficient, scalable, safe, secure, reliable, extendable, modular, well documented etc. You won't be able to write a masterful Haiku without learning to speak the language you want to write it in fluently first.

x0x0 2y ago
we're still an industry where many companies can't reliably ship basic crud apps. getting from there to solid security in the absence of extraordinary investment... not sure how that happens. Rachel of rachelbythebay related a story from a faang where some genius replaced code that created a directory with a shell call to `mkdir -p` in a core lib. Because it was convenient to get a mkdir call that would create parents. This got through code review! "Surprise, we're dumping the args you hand us straight to sh/bash/zsh/whatever. Hope every caller has a deep understanding of shell escaping rules and can correctly clean these args! tada!" You hear things like that and I'm not sure what hope most of us have... edit: https://rachelbythebay.com/w/2021/12/24/mkdir/ https://rachelbythebay.com/w/2021/12/24/mkdir/
- Log_out_ 2y ago
  contain and recover from it,instead of fixing th complex cheese layers that is Software ? one huge try catch and a os that fires exception in case of the unexceptional? sandbox is all security?
  - x0x0 2y ago
    Oh, it definitely seems like, by default, a random process should not be allowed to fork a shell, and so doing should kill the process tree...
- ozim 2y ago
  Sorry but that is not true and we have tools and processes that allow us to reliably deliver new versions of crud apps. I am doing that with multiple teams for over 10 years now. Yes I have seen teams that cannot get basic app to prod over the year because they mess around with tooling instead of doing the job. If you expect that there be no bugs - just go for an inspection with building inspector and check how many buildings have not even a single flaw.

myworkinisgood 2y ago

> If you save a password in plaintext it’s malpractice at this point. And yet there is no standardized way for applications like git, docker etc to interface with an encrypted password store.

paulddraper 2y ago
Why would git need passwords?
- mjlee 2y ago
  To authenticate with remote repositories.
  - paulddraper 2y ago
    SSH keys my guy better than passwords
    - myworkinisgood 2y ago
      right, and what happens when you want to use that stuff in CIs?

harimau777 2y ago

I think that even ignorance is organizational. As the article points out, we don't reward people for becoming less ignorant about security so why should they put in the effort to do so?

abbadadda 2y ago
We can punish those who make egregious errors, like saving passwords in plain text, either literally or figuratively during code reviews (i.e., if a senior developer rejects a PR because it is too insecure)
water-your-self 2y ago
Becoming less ignorant is time that could have been spent on this sprint, and is often punished.