4 ms·

The problem is that studying CS does not automatically a good programmer make. And the truth is that many graduates would be glad if their software works. Desig

by atoav 2y ago

The problem is that studying CS does not automatically a good programmer make. And the truth is that many graduates would be glad if their software works. Designing in security from the start means you are experienced enough to no longer have to worry about it working at all, you worry about resources, security, extendability, dependecies — so you try to compose software from many single choices that yields you the needed functionality, while being computationally efficient, scalable, safe, secure, reliable, extendable, modular, well documented etc. You won't be able to write a masterful Haiku without learning to speak the language you want to write it in fluently first.

x0x0 2y ago
we're still an industry where many companies can't reliably ship basic crud apps. getting from there to solid security in the absence of extraordinary investment... not sure how that happens. Rachel of rachelbythebay related a story from a faang where some genius replaced code that created a directory with a shell call to `mkdir -p` in a core lib. Because it was convenient to get a mkdir call that would create parents. This got through code review! "Surprise, we're dumping the args you hand us straight to sh/bash/zsh/whatever. Hope every caller has a deep understanding of shell escaping rules and can correctly clean these args! tada!" You hear things like that and I'm not sure what hope most of us have... edit: https://rachelbythebay.com/w/2021/12/24/mkdir/ https://rachelbythebay.com/w/2021/12/24/mkdir/
- Log_out_ 2y ago
  contain and recover from it,instead of fixing th complex cheese layers that is Software ? one huge try catch and a os that fires exception in case of the unexceptional? sandbox is all security?
  - x0x0 2y ago
    Oh, it definitely seems like, by default, a random process should not be allowed to fork a shell, and so doing should kill the process tree...
- ozim 2y ago
  Sorry but that is not true and we have tools and processes that allow us to reliably deliver new versions of crud apps. I am doing that with multiple teams for over 10 years now. Yes I have seen teams that cannot get basic app to prod over the year because they mess around with tooling instead of doing the job. If you expect that there be no bugs - just go for an inspection with building inspector and check how many buildings have not even a single flaw.

by atoav 2y ago

x0x0 2y ago

we're still an industry where many companies can't reliably ship basic crud apps. getting from there to solid security in the absence of extraordinary investment... not sure how that happens. Rachel of rachelbythebay related a story from a faang where some genius replaced code that created a directory with a shell call to `mkdir -p` in a core lib. Because it was convenient to get a mkdir call that would create parents. This got through code review! "Surprise, we're dumping the args you hand us straight to sh/bash/zsh/whatever. Hope every caller has a deep understanding of shell escaping rules and can correctly clean these args! tada!" You hear things like that and I'm not sure what hope most of us have... edit: https://rachelbythebay.com/w/2021/12/24/mkdir/ https://rachelbythebay.com/w/2021/12/24/mkdir/

Log_out_ 2y ago
contain and recover from it,instead of fixing th complex cheese layers that is Software ? one huge try catch and a os that fires exception in case of the unexceptional? sandbox is all security?
- x0x0 2y ago
  Oh, it definitely seems like, by default, a random process should not be allowed to fork a shell, and so doing should kill the process tree...
ozim 2y ago
Sorry but that is not true and we have tools and processes that allow us to reliably deliver new versions of crud apps. I am doing that with multiple teams for over 10 years now. Yes I have seen teams that cannot get basic app to prod over the year because they mess around with tooling instead of doing the job. If you expect that there be no bugs - just go for an inspection with building inspector and check how many buildings have not even a single flaw.