3 ms·

Why does software require so many urgent patches? Conspiracy theory: creating new bugs they can always fix later is a good source of continued employment. Of

Why does software require so many urgent patches? Conspiracy theory: creating new bugs they can always fix later is a good source of continued employment. Of course there's also the counterargument that insecurity is freedom: if it weren't for some insecurity, the population would be digitally enslaved even more by companies who prioritise their own interests. Stallman's infamous "Right to Read" is a good reminder of that dystopia. This also ties in with right-to-repair. The optimum amount of cybercrime is nonzero.

wredue 2y ago
It isn't malice dude. Unfortunately, it really is just that 70% of developers are utterly incompetent.
- tsimionescu 2y ago
  If having security vulnerabilities in code you wrote or reviewed is a sign of incompetence, then there has probably never been a competent developer in the history of the industry.
  - wredue 2y ago
    I wouldn’t say that. There are some not obvious things like timing attacks that you probably shouldn’t feel bad about. If you’re still writing sql injections though, yeah, you’re terrible.
tonetegeatinst 2y ago
One thing is software development is not really focused on secure software. If Microsoft ca n manage to call recall a engineered product feature where those M$ folks get payed stacks to work on, can't even both securing the data in rest, and then decide its a great idea to use cloud computing for recall, then I can totally see "security software engineer" becoming a separate field. Securing software seems to be hard especially in web development. You got to worry about regular development, then all these crazy different exploit methods like xss,SQL injection, data sanitation, etc....and then you got to get this site working for multiple browsers, you need to jugle all of this. And if an api or some 3rd party tool gets compromised how do you prevent that except a crystal ball a bottle of burbon and a clairvoyant chant? Also their was iirc people submitting bogus CVE reports to increase the mental drain on people and overwhelm the human link which is always the weakest.
LinuxBender 2y ago
Conspiracy theory: creating new bugs they can always fix later is a good source of continued employment. That is absolutely a thing [1]. There are hardware devices that can be fixed illegally fixed using 3rd party software for this reason. The people making a work around to the scam then get sued. The video is worth a watch in my opinion. It was created 3 years ago and the problem is still ongoing. [1] - https://www.youtube.com/watch?v=SrDEtSlqJC4 https://www.youtube.com/watch?v=SrDEtSlqJC4 [video][29min]

wredue 2y ago

It isn't malice dude. Unfortunately, it really is just that 70% of developers are utterly incompetent.

tsimionescu 2y ago
If having security vulnerabilities in code you wrote or reviewed is a sign of incompetence, then there has probably never been a competent developer in the history of the industry.
- wredue 2y ago
  I wouldn’t say that. There are some not obvious things like timing attacks that you probably shouldn’t feel bad about. If you’re still writing sql injections though, yeah, you’re terrible.

tonetegeatinst 2y ago

One thing is software development is not really focused on secure software. If Microsoft ca n manage to call recall a engineered product feature where those M$ folks get payed stacks to work on, can't even both securing the data in rest, and then decide its a great idea to use cloud computing for recall, then I can totally see "security software engineer" becoming a separate field. Securing software seems to be hard especially in web development. You got to worry about regular development, then all these crazy different exploit methods like xss,SQL injection, data sanitation, etc....and then you got to get this site working for multiple browsers, you need to jugle all of this. And if an api or some 3rd party tool gets compromised how do you prevent that except a crystal ball a bottle of burbon and a clairvoyant chant? Also their was iirc people submitting bogus CVE reports to increase the mental drain on people and overwhelm the human link which is always the weakest.

LinuxBender 2y ago

Conspiracy theory: creating new bugs they can always fix later is a good source of continued employment. That is absolutely a thing [1]. There are hardware devices that can be fixed illegally fixed using 3rd party software for this reason. The people making a work around to the scam then get sued. The video is worth a watch in my opinion. It was created 3 years ago and the problem is still ongoing. [1] - https://www.youtube.com/watch?v=SrDEtSlqJC4 https://www.youtube.com/watch?v=SrDEtSlqJC4 [video][29min]