4 ms·

You prosecute whoever set the system up. The same way you’d prosecute a surgeon for malpractice. These are professionals. It’s their responsibility to build a

by jaoane 1y ago

You prosecute whoever set the system up. The same way you’d prosecute a surgeon for malpractice. These are professionals. It’s their responsibility to build a solid, secure system. If they can’t or don’t want to then they should find another job.

oaththrowaway 1y ago
Then you're going to have to start paying entry level IT like surgeons. Nobody is going to take that kind of risk for $30K.
- ben_w 1y ago
  Or this becomes another profession where everyone gets (and needs) liability insurance. That might not be a bad thing, if the insurance comes with some kind of way to get lower premiums for being less risky.
- AlotOfReading 1y ago
  More likely, they'd just start carrying errors and omissions insurance for a bit extra.
- lurking_swe 1y ago
  since when does entry level IT “call the shots” on reviewing code that gets deployed to prod? Sure a junior programmer or devops may do something dumb. That’s not the problem - at all. The problem is pretending they are a professional. They are not. They are juniors that need mentorship and should be _expected_ to mess up frequently. To use a different analogy. If I bring my car to the mechanic, i’m OK with the new guy working on my car, assuming that the senior mechanic, you know, double checks their work. Is that not a reasonable assumption? None of this makes ANY sense to me. To be blunt.
egorfine 1y ago
They are professionals. They cannot upgrade this particular windows server, because the software they're running on it requires visual basic 6.0 support. The vendor cannot provide any upgrade for their system, because certifying anything newer than Windows 2003 for this software is prohibitively expensive for the vendor. You cannot switch vendor due to obscure clauses in contract. Real situation btw.
netdevphoenix 1y ago
If the pay difference doesn't reflect that additional responsibility, it probably is not expected
- jaoane 1y ago
  I am not convinced by this attitude of “I am being paid peanuts so I’m not going to do my job”. If you don’t like the salary then find some other job.
  - celticninja 1y ago
    You have an incomplete understanding of the situation. The services that have been affected are 3rd party systems, built by the private sector on a government contract. The service was built by people who were not going to support it. It is not possible to upgrade and patch these services. The civil servant developers working on them do what they can, but they have been warming management, who have warned government, that they systems are insecure, but govt won't spend money on updating them. There are services built by civil servant developers, that are built with security in mind, and they are not affected by this breach. So it's nothing to do with being paid peanuts, or not wanting to do the best job possible. It's very easy to backseat drive and offer opinions but your opinion is based on a fallacy.
    - lurking_swe 1y ago
      > The civil servant developers working on them do what they can, but they have been warming management, who have warned government, that they systems are insecure, but govt won't spend money on updating them. Makes sense. So if i’m understanding this right, the fault basically lies with the decision maker(s) in government who said “nope, not worth paying $x to secure/maintain our systems” Sounds to me like they shouldn’t be allowed to create these public facing systems in the first place if they can’t afford (or don’t want to) maintain them. no? That would be like paying someone to build a bridge for you and then deciding to purposely ignore maintenance on the bridge when the experts warn you it needs maintenance.

by jaoane 1y ago

oaththrowaway 1y ago

Then you're going to have to start paying entry level IT like surgeons. Nobody is going to take that kind of risk for $30K.

ben_w 1y ago
Or this becomes another profession where everyone gets (and needs) liability insurance. That might not be a bad thing, if the insurance comes with some kind of way to get lower premiums for being less risky.
AlotOfReading 1y ago
More likely, they'd just start carrying errors and omissions insurance for a bit extra.
lurking_swe 1y ago
since when does entry level IT “call the shots” on reviewing code that gets deployed to prod? Sure a junior programmer or devops may do something dumb. That’s not the problem - at all. The problem is pretending they are a professional. They are not. They are juniors that need mentorship and should be _expected_ to mess up frequently. To use a different analogy. If I bring my car to the mechanic, i’m OK with the new guy working on my car, assuming that the senior mechanic, you know, double checks their work. Is that not a reasonable assumption? None of this makes ANY sense to me. To be blunt.

egorfine 1y ago

They are professionals. They cannot upgrade this particular windows server, because the software they're running on it requires visual basic 6.0 support. The vendor cannot provide any upgrade for their system, because certifying anything newer than Windows 2003 for this software is prohibitively expensive for the vendor. You cannot switch vendor due to obscure clauses in contract. Real situation btw.

netdevphoenix 1y ago

If the pay difference doesn't reflect that additional responsibility, it probably is not expected

jaoane 1y ago
I am not convinced by this attitude of “I am being paid peanuts so I’m not going to do my job”. If you don’t like the salary then find some other job.
- celticninja 1y ago
  You have an incomplete understanding of the situation. The services that have been affected are 3rd party systems, built by the private sector on a government contract. The service was built by people who were not going to support it. It is not possible to upgrade and patch these services. The civil servant developers working on them do what they can, but they have been warming management, who have warned government, that they systems are insecure, but govt won't spend money on updating them. There are services built by civil servant developers, that are built with security in mind, and they are not affected by this breach. So it's nothing to do with being paid peanuts, or not wanting to do the best job possible. It's very easy to backseat drive and offer opinions but your opinion is based on a fallacy.
  - lurking_swe 1y ago
    > The civil servant developers working on them do what they can, but they have been warming management, who have warned government, that they systems are insecure, but govt won't spend money on updating them. Makes sense. So if i’m understanding this right, the fault basically lies with the decision maker(s) in government who said “nope, not worth paying $x to secure/maintain our systems” Sounds to me like they shouldn’t be allowed to create these public facing systems in the first place if they can’t afford (or don’t want to) maintain them. no? That would be like paying someone to build a bridge for you and then deciding to purposely ignore maintenance on the bridge when the experts warn you it needs maintenance.