3 ms·
Here's a true story about one instantiation of "security is our top priority". You be the judge on whether this is an extreme outlier or pretty much the norm.
by jjav 2y ago
Here's a true story about one instantiation of "security is our top priority". You be the judge on whether this is an extreme outlier or pretty much the norm.
I was at one company where the PM blurted out (paraphrasing, but very close) "Enough of security talk. We will put out some nice wording on our website stating that security is our top priority and our product is perfectly secure. And that's that. We will not spend a single penny beyond that on making it so-called secure."
So, that's often what companies mean when they say "security is our top priority".
(The referred PM has since had a long career at a fruit-shaped FAANG, presumably making products secure. I hope they have grown up a bit.)
- Dalewyn 2y agoLooking at it another way, he put an end to further spending on "security talk" by putting up the security talk of security talks. Art of the Deal indeed.
- lb1lf 2y agoOn a somewhat related note, I once worked on a vessel which had 'SAFETY FIRST' stencilled onto the superstructure (quite common). Underneath, someone had stencilled in slightly smaller script 'second only to profit' (Somewhat less common, but refreshingly honest. Or cynical. Or both)
- Dalewyn 2y agoReminds me of this insightful article: https://mikerowe.com/2020/03/walk-me-through-this-safety-third-thing/ https://mikerowe.com/2020/03/walk-me-through-this-safety-thi...
- WalterBright 2y agoSafety is a luxury that profit enables. Increased productivity => increased profits => more safety Nothing comes for free.
- worble 2y agoOr, more likely Increased productivity => increased profits => shareholders see number goes up => number must go more up year on year => everything (including safety) falls to the wayside in the pursuit of more profit
- WalterBright 2y agoWith the size of liability judgments, that is not a profitable strategy.
- doctor_eval 2y agoSafety is not a “luxury enabled by profit”. It’s one of many necessary dimensions for efficiently creating value over time. If you are a sole trader and you fall off a ladder and hurt yourself because you took some stupid shortcut, the cost is extremely high. If you work for someone and they make you do something stupid that hurts you, the cost to them has traditionally been relatively low, so they are motivated to push you because that’s better for them. Fortunately, in most modern countries this is no longer the case. Safety only becomes a “luxury” when capital becomes concentrated into the hands of people for whom other people are disposable.
- WalterBright 2y agoI bought a chainsaw recently for $10. I then bought about $100 of kevlar armor to wear while I use the saw. No money => no safety Take a look at history as far back as it will go. Safety expenses only happen when the money is there. Next time you see someone using a chainsaw, take a look at their protective equipment. If they work for a company, they're likely wearing: 1. ear protection 2. face shield 3. helmet 4. kevlar gloves 5. kevlar chaps 6. kevlar boots If they're some rando with a saw, odds are pretty good they have none of that on. They won't spend their own money on their own safety. It's only deemed essential if someone else is paying for it.
- doctor_eval 2y ago
- jtwaleson 2y agoFrustrating but recognizable. Having a framework in place allows you to quantify the risk and effort, and makes it less of an opinionated shouting match and more of an analysis. The challenge will then be to get everyone to take the time to understand the framework.