24 ms·
How can these companies be certified and compliant, etc., and then in practice have horrible SDLC? What was the impact of diverse teams (offshoring)? Often com
by mc32 2y ago
How can these companies be certified and compliant, etc., and then in practice have horrible SDLC?
What was the impact of diverse teams (offshoring)? Often companies don’t have necessary checks to ensure disparateness of teams does not impact quality. Maybe it was zero or maybe it was more.
- hulitu 2y ago> How can these companies be certified and compliant, etc., and then in practice have horrible SDLC? Checklists ?
- hello_moto 2y agoYou're saying there exist a complex software system without a bug despite following best practices to the dot and certified + compliant?
- mc32 2y agoNo, but their release process should catch major bugs such as this. After internal QA, you release to small internal dev team, then to select members of other depts willing to dog-food it, then limited external partners then GA? Or something like that so that you have multiple opportunities to catch weird software/hardware interactions before bringing down business critical systems for major and small companies around the planet?
- hello_moto 2y ago> After internal QA, you release to small internal dev team, then to select members of other depts willing to dog-food it, then limited external partners then GA What about AV definition update for 0day swimming in the tubes right now?
- mc32 2y agoSure, those have happened before, but nothing with an impact like last weekend. That's inexcusable. At least definitions can update themselves out of trouble.
- hello_moto 2y agoWhat do you refer to "those have happened before"? Isn't that what happened? Not a software update, not an AV-definition update but more so an AV-definition "data" update. At least that's how I interpret "Rapid Response Content"
- YZF 2y agoStandards generally don't mandate specifics and almost certainly nothing specific to SDLC. At least none I've heard of. Things like FIPS and ISO and SOC2 generally prescribe having a certain process, sometimes they can mandate some specifics (e.g. what ciphers for FIPS). Maybe there should be some release process standards that prescribe how this is done but I'm not aware of any. I think part of the problem is the standard bodies don't really know what to prescribe, this sort of has to come from the community. Maybe not unlike the historical development of other engineering professions. Today being compliant with FIPS doesn't really mean you're secure and being SOC2 compliant doesn't really mean customer data is safe etc. It's more some sort of minimal bar in certain areas of practice and process.
- mc32 2y agoSadly, I agree with your take. All it is is a minimum bar. Many who don't have the above are even worse --tho not necessarily, but as a rule probably yes.