3 ms·
we're still an industry where many companies can't reliably ship basic crud apps. getting from there to solid security in the absence of extraordinary investme
by x0x0 2y ago
we're still an industry where many companies can't reliably ship basic crud apps. getting from there to solid security in the absence of extraordinary investment... not sure how that happens.
Rachel of rachelbythebay related a story from a faang where some genius replaced code that created a directory with a shell call to `mkdir -p` in a core lib. Because it was convenient to get a mkdir call that would create parents. This got through code review! "Surprise, we're dumping the args you hand us straight to sh/bash/zsh/whatever. Hope every caller has a deep understanding of shell escaping rules and can correctly clean these args! tada!"
You hear things like that and I'm not sure what hope most of us have...
edit: https://rachelbythebay.com/w/2021/12/24/mkdir/ https://rachelbythebay.com/w/2021/12/24/mkdir/
- Log_out_ 2y agocontain and recover from it,instead of fixing th complex cheese layers that is Software ? one huge try catch and a os that fires exception in case of the unexceptional? sandbox is all security?
- x0x0 2y agoOh, it definitely seems like, by default, a random process should not be allowed to fork a shell, and so doing should kill the process tree...
- ozim 2y agoSorry but that is not true and we have tools and processes that allow us to reliably deliver new versions of crud apps. I am doing that with multiple teams for over 10 years now. Yes I have seen teams that cannot get basic app to prod over the year because they mess around with tooling instead of doing the job. If you expect that there be no bugs - just go for an inspection with building inspector and check how many buildings have not even a single flaw.