5 ms·

> For whatever reason, distro maintainers working for free seem a lot more competent with security than billion dollar hardware vendors I don't believe that th

> For whatever reason, distro maintainers working for free seem a lot more competent with security than billion dollar hardware vendors I don't believe that these billion dollar hardware vendors are really incompetent with security. It's rather that the distro maintainers do care quite a bit about security, while for these hardware vendors consider these security concerns to be of much smaller importance; for their business it is likely much more important to bring the next hardware generation to the market as fast as possible. In other words: distro maintainers and hardware vendors are simply interested in very different things and thus prioritize things very differently.

da_chicken 9mo ago
Sure. New sales means new revenue. Maintenance and support is just overhead. It's shortsighted, but modern capitalism is more shortsighted than Mr. Magoo.
- lloeki 9mo ago
  It's a cost vs benefit. As long as the cost of such blatant violation of security principles doesn't outweight the benefit of focusing on something else, nothing is done. https://www.legalexaminer.com/lestaffer/legal/gm-recall-defective-ignition-switch-saved-company-1/ https://www.legalexaminer.com/lestaffer/legal/gm-recall-defe... https://www.youtube.com/watch?v=IA2EBWFCULg https://www.youtube.com/watch?v=IA2EBWFCULg
  - jbstack 9mo ago
    I don't buy it. It makes sense for a small company where the cost of fixing it might be noticed. But AMD generates some ~$30bn in annual revenues. How much of a developer's time does it take to change the code to use HTTPS? $1000? $5000? Let's be extreme and call it $10,000. That's 0.00003% of AMD's annual revenue. It's barely even a rounding error on their accounts.
    - scott_w 9mo ago
      Because that's not how corporate maths works. The comparison is not "what is the cost of this vs our current revenue?" The calculation is "what could that engineer be doing instead and what is that worth vs fixing this issue?" Will fixing this issue bring in more revenue than ignoring it and building a new feature? Or fixing a different issue? If the answer is "no" then the answer is that it doesn't get fixed.
      - jbstack 9mo ago
        > The calculation is "what could that engineer be doing instead and what is that worth vs fixing this issue?" I don't agree with this, because it pre-supposes that there's a limited number of engineers available. The question isn't "shall I pull engineer X off project Y so that he can fix security bugs?", it's "shall I hire an additional engineer to fix security bugs?". The comment above mine suggests the answer to that question is "no, because it's too expensive to do that compared to just paying to clean up security breaches after they happen", which is what I was questioning in my first comment.
        scott_w 9mo ago
        It doesn't matter: the equation is exactly the same. Why would you hire someone to work on a bug fix or security fix when you could hire that same person and have them work on something even more valuable again?
        jbstack 9mo ago
        Now there's a related problem in the premise: it pre-supposes that the company has an unlimited amount of valuable work to be done. If that were the case, all companies would simply expand their workforce as much as possible all the time, only constrained by money running out (which itself would be an exponential increase since "valuable" work presumably leads to more money in future). In reality, companies do not prioritise expansion above all else. In fact any time a company pays a dividend to its shareholders, or otherwise refrains from spending cash reserves on new hires, it's recognising that it cannot invest profits in an effective way into its labour force. When framed correctly (there's effectively an unlimited labour supply for most companies, and effectively a limited demand for staff) then the question becomes "shall we hire an engineer to fix security bugs when we don't need an engineer for anything else?".
Symmetry 9mo ago
Years of working in embedded computing have left me with the impression that most hardware companies are just bad at software. I think part of it is that the long cycle times of making hardware push them towards a culture of waterfall development. But years of working with the microcontroller libraries for ethernet PHYs, the bash scripts to build the kernels for SoCs, etc make me perfectly willing to believe they are incompetent with security.
- M95D 9mo ago
  And which are the companies that are good at software? Please, give at least one example.
  - hhh 9mo ago
    Apple
    - scns 9mo ago
      XCode and Tahoe beg to differ.
    - 4nonverbal-alit 9mo ago
      used to be. they're becoming microslop 2.0
    - mring33621 9mo ago
      Surely you jest, good Sir!
    - cmcaleer 9mo ago
      These days I use Apple hardware despite Apple’s software, not because of it.
    - hbn 9mo ago
      Everyone's gonna give you shit for this answer and there's a hundred things I could tell you about their software that pisses me off, but the bar is so low for software these days, their stuff is still in the high end of quality (they need to do a lot to get back to where they were 10 years ago though) Only other software I regularly use that I think is overall high quality and I enjoy using are the JetBrains IDEs, and the Telegram mobile app (though the Premium upselling has gotten kinda gross the past few years)
zeendo 9mo ago
This comes down to intentions versus results. Viewed through the lens of results the comment you're replying to is still correct: The result is incompetence. I'd argue that's the only lens that matters when you're on the receiving end of such work.

da_chicken 9mo ago

Sure. New sales means new revenue. Maintenance and support is just overhead. It's shortsighted, but modern capitalism is more shortsighted than Mr. Magoo.

lloeki 9mo ago
It's a cost vs benefit. As long as the cost of such blatant violation of security principles doesn't outweight the benefit of focusing on something else, nothing is done. https://www.legalexaminer.com/lestaffer/legal/gm-recall-defective-ignition-switch-saved-company-1/ https://www.legalexaminer.com/lestaffer/legal/gm-recall-defe... https://www.youtube.com/watch?v=IA2EBWFCULg https://www.youtube.com/watch?v=IA2EBWFCULg
- jbstack 9mo ago
  I don't buy it. It makes sense for a small company where the cost of fixing it might be noticed. But AMD generates some ~$30bn in annual revenues. How much of a developer's time does it take to change the code to use HTTPS? $1000? $5000? Let's be extreme and call it $10,000. That's 0.00003% of AMD's annual revenue. It's barely even a rounding error on their accounts.
  - scott_w 9mo ago
    Because that's not how corporate maths works. The comparison is not "what is the cost of this vs our current revenue?" The calculation is "what could that engineer be doing instead and what is that worth vs fixing this issue?" Will fixing this issue bring in more revenue than ignoring it and building a new feature? Or fixing a different issue? If the answer is "no" then the answer is that it doesn't get fixed.
    - jbstack 9mo ago
      > The calculation is "what could that engineer be doing instead and what is that worth vs fixing this issue?" I don't agree with this, because it pre-supposes that there's a limited number of engineers available. The question isn't "shall I pull engineer X off project Y so that he can fix security bugs?", it's "shall I hire an additional engineer to fix security bugs?". The comment above mine suggests the answer to that question is "no, because it's too expensive to do that compared to just paying to clean up security breaches after they happen", which is what I was questioning in my first comment.
      - scott_w 9mo ago
        It doesn't matter: the equation is exactly the same. Why would you hire someone to work on a bug fix or security fix when you could hire that same person and have them work on something even more valuable again?
        jbstack 9mo ago
        Now there's a related problem in the premise: it pre-supposes that the company has an unlimited amount of valuable work to be done. If that were the case, all companies would simply expand their workforce as much as possible all the time, only constrained by money running out (which itself would be an exponential increase since "valuable" work presumably leads to more money in future). In reality, companies do not prioritise expansion above all else. In fact any time a company pays a dividend to its shareholders, or otherwise refrains from spending cash reserves on new hires, it's recognising that it cannot invest profits in an effective way into its labour force. When framed correctly (there's effectively an unlimited labour supply for most companies, and effectively a limited demand for staff) then the question becomes "shall we hire an engineer to fix security bugs when we don't need an engineer for anything else?".

Symmetry 9mo ago

Years of working in embedded computing have left me with the impression that most hardware companies are just bad at software. I think part of it is that the long cycle times of making hardware push them towards a culture of waterfall development. But years of working with the microcontroller libraries for ethernet PHYs, the bash scripts to build the kernels for SoCs, etc make me perfectly willing to believe they are incompetent with security.

M95D 9mo ago
And which are the companies that are good at software? Please, give at least one example.
- hhh 9mo ago
  Apple
  - scns 9mo ago
    XCode and Tahoe beg to differ.
  - 4nonverbal-alit 9mo ago
    used to be. they're becoming microslop 2.0
  - mring33621 9mo ago
    Surely you jest, good Sir!
  - cmcaleer 9mo ago
    These days I use Apple hardware despite Apple’s software, not because of it.
  - hbn 9mo ago
    Everyone's gonna give you shit for this answer and there's a hundred things I could tell you about their software that pisses me off, but the bar is so low for software these days, their stuff is still in the high end of quality (they need to do a lot to get back to where they were 10 years ago though) Only other software I regularly use that I think is overall high quality and I enjoy using are the JetBrains IDEs, and the Telegram mobile app (though the Premium upselling has gotten kinda gross the past few years)

zeendo 9mo ago

This comes down to intentions versus results. Viewed through the lens of results the comment you're replying to is still correct: The result is incompetence. I'd argue that's the only lens that matters when you're on the receiving end of such work.