5 ms·

There is sparsely little real “engineering” that goes on in the field of “software engineering”, industry wide, in terms of ensuring that our software is reliab

There is sparsely little real “engineering” that goes on in the field of “software engineering”, industry wide, in terms of ensuring that our software is reliable and secure. Performance and development velocity seem to take the driver seat always, in a whole lot of software. See also this talk by Bryan Cantrill, “Scale by the Bay 2018: Rust and Other Interesting Things” https://youtu.be/2wZ1pCpJUIM https://youtu.be/2wZ1pCpJUIM where he talks about software platform values, in the sense of what different programming languages and other things focus on. He also touches on the fact that while higher level layers in the stack might value security it kind of falls apart when the very microcode in our CPUs sacrifices security for performance. This was in a period of time where Spectre https://en.m.wikipedia.org/wiki/Spectre_(security_vulnerability) https://en.m.wikipedia.org/wiki/Spectre_(security_vulnerabil... and Meltdown https://en.m.wikipedia.org/wiki/Meltdown_(security_vulnerability) https://en.m.wikipedia.org/wiki/Meltdown_(security_vulnerabi... had reared their ugly heads.

blablabla123 2y ago
> There is sparsely little real “engineering” that goes on in the field of “software engineering”, industry wide There surely is actual engineering but it's scattered unevenly across companies. It's funny that Crowdstrike did fuzz their code but didn't even check for correct arity. I think that the Cybersecurity industry isn't such a strong adopter of sophisticated engineering techniques as for instance in Web development where new testing techniques evolve every few years.
- jrockway 2y ago
  I really don't think that's true. All software is undertested and it's likely that there isn't a significant differences between web apps and security apps. Having said that, writing ring 0 drivers an unsafe language sounds like an invitation to disaster. That's what went wrong with CrowdStrike. You don't need any testing to avoid crashing the OS when given a bad virus definition file. (Making the virus definition file do something useful... sure, you're gonna need tests for that.)
chestertonsgate 2y ago
Performance is dead in the trunk next to a shovel and some quicklime. I know people say they take performance seriously, but as someone who is also a user of commercial software, I am reminded of James Baldwin: "I don't believe what you say, because I see what you do".

blablabla123 2y ago

> There is sparsely little real “engineering” that goes on in the field of “software engineering”, industry wide There surely is actual engineering but it's scattered unevenly across companies. It's funny that Crowdstrike did fuzz their code but didn't even check for correct arity. I think that the Cybersecurity industry isn't such a strong adopter of sophisticated engineering techniques as for instance in Web development where new testing techniques evolve every few years.

jrockway 2y ago
I really don't think that's true. All software is undertested and it's likely that there isn't a significant differences between web apps and security apps. Having said that, writing ring 0 drivers an unsafe language sounds like an invitation to disaster. That's what went wrong with CrowdStrike. You don't need any testing to avoid crashing the OS when given a bad virus definition file. (Making the virus definition file do something useful... sure, you're gonna need tests for that.)

chestertonsgate 2y ago

Performance is dead in the trunk next to a shovel and some quicklime. I know people say they take performance seriously, but as someone who is also a user of commercial software, I am reminded of James Baldwin: "I don't believe what you say, because I see what you do".