2 ms·

I hate to be dismissive, but tired old meme is tired. With what I do I work with a lot of larger companies and get to see the crap they push out with no archit

by pixl97 2y ago

I hate to be dismissive, but tired old meme is tired. With what I do I work with a lot of larger companies and get to see the crap they push out with no architectural design and no initial security posture. I see apps with thousands of packages, including things like typosquats. I see the quality of the security teams which are contractors following checklists with no idea what they mean. Saying that actual professions would make no difference sounds insane to me. Again, to me, it sounds like every other industry in saying 'self regulation is fine, we're special, we'll manage ourselves".

holowoodman 2y ago
No. Licensed professionals are the engineering checklist people. "Not my fault, wasn't on the checklist, I've used the official approved one". Licensed professionals checked a dam built by licensed professionals. Dam broke, killed people. Everyone claims to be innocent and the other party didn't read the right reports or didn't report the right problems: https://www.ecchr.eu/fileadmin/Fallbeschreibungen/Case_Report_Brumadinho_ECCHR_MISEREOR_20191014_EN.pdf https://www.ecchr.eu/fileadmin/Fallbeschreibungen/Case_Repor... It is all just another method of shifting blame. What really helps more than prescriptive regulation is liability. As soon as there is a strict liability for software companies, things will get better. What could also help is mandatory insurance for software producers. Then the insurance companies will either charge them big bucks or demand proof of safety and security.