5 ms·

Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineerin

Software development jobs are too accessible. Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification, and there should be business-cratering fines for something as egregious as completely ignoring security reports. It is ridiculous how we've completely normalised leaks like this on a weekly or almost-daily basis.

morpheuskafka 7mo ago
They may be part of it, but as a publicly traded company, there's got to be a at least a few people there with a fancy pedigree (not that that actually means they are good at their job or care). But if such a test existed, they presumably would have passed it. They also have an ISO 27001 certificate (they try to claim a bunch of AWSs certs by proxy on their security page, which is ironic as they say AWS stores most of their data while apparently all uploads are on this).
- trollbridge 7mo ago
  A while ago I had a customer come to me who had a simple Shopify site and fell for a phishing type of attack where someone simply had an email like "shopify_security at gmail" and kept telling her she needed to apply all kinds of changes. They laundered the payments through Fiverr. Then they would install WordPress plugins to make the site worse and claim even more "work" was needed. I documented the entire thing, including my own credentials, and sent it off to Fiverr. Fiverr's response was everything was fine and there was nothing they could do about it, even though it was obvious fraud. Google never did anything about it either, nor did Shopify. Given how they handled such a minor situation like that... I guess it shouldn't be surprising they're just asleep at the switch for a major one like this.
- bluefirebrand 7mo ago
  > But if such a test existed, they presumably would have passed it Sure, and now they could have their credentials revoked, potential be legally liable, and never find work in this field again which would prevent them from cocking up another company this way
fnimick 7mo ago
At least I'm sure LLM tools deploying code to production won't result in this happening more frequently. "Make sure it's secure. Make no mistakes."
- coldtea 7mo ago
  "You were right, mistakes have been made!"
Loughla 7mo ago
Teachers have to be licensed and keep up on licensing. Plumbers. Electricians. Lawyers. Doctors. Hell, I have to get a license to run my own business. Why shouldn't software come with a branch for licenses if you're working with sensitive data?
- coldtea 7mo ago
  We're going the other way: now any random vibe coded slop is the norm.
  - bad_haircut72 7mo ago
    Normalize "vibe-plumbing"
    - bombcar 7mo ago
      Both plumbing and wiring are “easier” in a way than programming-as they’ll violently and potentially explosively let you know if you messed up; whereas programming lets you be blissfully unaware until you see your data plastered across the nightly news.
      - avian 7mo ago
        Wiring mistakes can kill or burn down a house months or years after they have been done. You will not notice unconnected protective earth or badly dimensioned circuit breakers until something else breaks and the protective element is not there.
      - Ekaros 7mo ago
        There are many failure cases that are slow. Especially with water. Let say they sag a bit and connection is poor. It might slowly start leaking over months causing structural damage or at least dampness and microbiological effects.
      - ChoGGi 7mo ago
        I'm in the midst of renovating a house at the moment, it's about ten years old. The plumber siliconed all the shower valves to the fiberglass walls without screwing them to a backplate. Unsurprisingly the builder is now out of business.
Aurornis 7mo ago
> should require some kind of genuine software engineering certification Wouldn't change a thing, other than add another hassle you have to pay for to do your job. This is the result of carelessness, not someone who didn't know that private data should be private because they weren't certified.
- applfanboysbgon 7mo ago
  This is the result of somebody who has no idea how the fuck the tech they're using works. They surely knew it should be private, but they did not know that they were making it publicly available because they were blindly fumbling their way around in a job beyond their competence level. There is a 0% chance this was ordinary carelessness, in the form of "I know better but don't care enough", this is so clearly a case of "I don't know what I'm doing".
  - Aurornis 7mo ago
    Any time someone tries to suggest certification as a solution I ask the same question: How would it have solved this problem? Would the certification require someone to take an official certification test for the framework used? And therefore we’re only allowed to use frameworks which have certification tests available? If you want to write some new software, do you have to generate a certification for it and get that approved so people are allowed to use it? Sounds like a great way to force us all to use Big Company approved software because they’re the only ones with pockets deep enough to play all of the certification games
    - applfanboysbgon 7mo ago
      The fact that you're thinking purely in frameworks is the exact problem that plagues the software industry. Framework-focused development is why we're in this mess; frameworks make it easy for people who don't understand how to program to publish shitty software by copying-and-pasting code and fudging around a few strings or variables to match their use case. That kind of accessibility is great for low-stakes software, letting anyone make interesting toys, but should be completely unacceptable in a professional environment with, for example, people's fucking tax documentation at stake. If I had my way, the certification process starts at the bottom of the stack, ie. you should be expected to have a functional knowledge of assembly instructions, memory management, registers, the call stack, and build up from there. Not that we need to write assembly on a daily basis, but all of the abstractions are built on top of that, and you cannot realistically engineer secure software if you don't understand what is being abstracted away. If you do understand the things being abstracted away, you have the fundamentals necessary to do good work with any programming language or framework. Throw in another certification starting from networking fundamentals if your job involves that. 30 years ago, most professional programmers had this level of understanding as table stakes, so we can hardly say it's an unrealistic burden that's impossible to meet. Would it be a higher barrier to entry that massively cuts the size of the field working on sensitive software and slows software development down, yes. That is exactly what we need. There was a time when people built bridges that collapsed, then we implemented standards and expected engineers to do real work to make sure that didn't happen. Is that work expensive and expertise-intensive, yes, do bridges still collapse, only very rarely. We are witnessing software bridge collapses on a weekly basis, which should be seen as completely unacceptable. The harm is less obvious than when everyone on a bridge dies, but I do think that routinely leaking millions of people's sensitive data is causing serious harm and likely does lead to people dying in second-order effects.
ge96 7mo ago
People at my company don't even lock their computer when they walk away from their desk. Which yeah it's in a controlled environment but still.
- yojo 7mo ago
  My work has a “donuts” slack channel for this. You find an unlocked computer you post “donuts on me!” Social pressure says they buy the office donuts. Still get a few a week, but at least it’s public and amusing.
  - rcbdev 7mo ago
    This would be borderline illegal in most countries. Not very enforcable, sure, but illegal.
    - livesinhel 7mo ago
      Nobody would give a damn about it.
- SillyUsername 7mo ago
  We used to flip display upside down in display options, which also reverses the mouse. We'd then lock the PC and disconnect the keyboard. After they figured out the keyboard had been pulled they often couldn't work out why their screen was upside down...
philip1209 7mo ago
good thing it's getting easier to code - nothing bad can come of this :-)
userbinator 7mo ago
some kind of genuine software engineering certification That only gives those in power another way to push people into toeing the line. There's enough corporate authoritarianism these days as it is already. Give Stallman's "Right to Read" a read. His dystopia is exactly where we're going to be headed quickly if we keep demanding someone to "do something". "The optimal amount of fraud is nonzero." "Those who give up freedom for security deserve neither."
- computably 7mo ago
  You're responding to literally 7 words out of context. > Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification FAANG, Fortune 500, etc., almost universally go out of their way to violate user freedom in pursuit of profit. Regulation is practically the only way to force megacorps to respect users' rights and improve their security, as evidenced by right-to-repair, surveillance/privacy, and so on. And none of that has anything to do with users' individual rights to create, run, and modify their own software. (Yes, regulatory capture exists, no, it doesn't mean all regulation is bad.)
  - userbinator 7mo ago
    If the megacorps are going in that direction of being strictly regulated, the rest of the industry will follow. It's the general movement of the Overton Window that's the underlying issue.
    - subscribed 7mo ago
      No, they won't. No one in their right mind "wants" ISO27001, ISO9001, SOC or multiple PITA certifications. Companies do that because they want to attract certain kind of customers and have enough spare manpower and money to go through this all year long. ....or they want to hold a very sensitive data that requires *proven* processes, trainings and skills. My firm has several of these and we have to keep full compliance team and *always* have some auditor on site. No one does it just because.
victorbjorklund 7mo ago
I once worked in a company and noticed that customer financial statements were publicly accessible. Ran into the software team. And got the reply that no one told them that it should be behind authentication. Some people really don't use their own brains.
- 21asdffdsa12 7mo ago
  If you do, you get into trouble with the hierarchy, all those middle-managers and responsibility distributing committees will be unemployed.
morpheuskafka 7mo ago
At my last job, I opened up Shodan in my free time and clicked through our ASN with the free filters. In two minutes I found multiple iDRACs online. Surprisingly, none had default pw. But one had a public exploit vuln that was years old allowing takeover... Turns out during the firewall hardware migration years ago, several units firewalls were switched to audit mode (not enforcing rules). So an entire institute (health research!) had their whole subnet public with zero firewalls, both the server OS and iDRAC interfaces. iDRAC isn't even supposed to be on the same VLAN per Dell let alone on the internet. To top it off, after making some tickets (admittedly not all as serious, ex MFP web UIs on internet) from Shodan, I got pushback from the firewall team for causing units to submit to many changes. I also got in trouble with our Qualys analyst for undermining his work because he hadn't gotten to that units annual review yet, even though I didn't even have a Qualys login. (And even if I had found it there, since when do we wait for annual reviews to fix that?) It took at least three weeks internally to get it fixed, and by that I mean only the iDRAC IP blocked with the server itself still wide open. And that's only because I mentioned it to my manager (awesome guy and not formally responsible for firewall rules) after an unrelated no firewall host incident came through and he authorized an emergency rule.
- bblb 7mo ago
  Huawei Enterprise devices tend to have a CAPTCHA by default on their BMC/OOB GUIs or the other various system/infrastructure service GUIs (such as the HuaweiCloud/FusionCloud products). I'm guessing the reason is that people leave the management ports and GUIs wide open to the public Internet, so the CAPTCHA is protecting at least from the very basic script kiddie bots.
borplk 7mo ago
Unfortunately everything is going in the opposite direction. We are in the age of AI-slop AI-everything AI-break-it AI-fix-it. Software companies are competing with each other on how low they can push the quality and still get away with it. There's no reward or incentive for paying attention to the details or the quality. In fact you will get penalised for it.

morpheuskafka 7mo ago

They may be part of it, but as a publicly traded company, there's got to be a at least a few people there with a fancy pedigree (not that that actually means they are good at their job or care). But if such a test existed, they presumably would have passed it. They also have an ISO 27001 certificate (they try to claim a bunch of AWSs certs by proxy on their security page, which is ironic as they say AWS stores most of their data while apparently all uploads are on this).

trollbridge 7mo ago
A while ago I had a customer come to me who had a simple Shopify site and fell for a phishing type of attack where someone simply had an email like "shopify_security at gmail" and kept telling her she needed to apply all kinds of changes. They laundered the payments through Fiverr. Then they would install WordPress plugins to make the site worse and claim even more "work" was needed. I documented the entire thing, including my own credentials, and sent it off to Fiverr. Fiverr's response was everything was fine and there was nothing they could do about it, even though it was obvious fraud. Google never did anything about it either, nor did Shopify. Given how they handled such a minor situation like that... I guess it shouldn't be surprising they're just asleep at the switch for a major one like this.
bluefirebrand 7mo ago
> But if such a test existed, they presumably would have passed it Sure, and now they could have their credentials revoked, potential be legally liable, and never find work in this field again which would prevent them from cocking up another company this way

fnimick 7mo ago

At least I'm sure LLM tools deploying code to production won't result in this happening more frequently. "Make sure it's secure. Make no mistakes."

coldtea 7mo ago
"You were right, mistakes have been made!"

Loughla 7mo ago

Teachers have to be licensed and keep up on licensing. Plumbers. Electricians. Lawyers. Doctors. Hell, I have to get a license to run my own business. Why shouldn't software come with a branch for licenses if you're working with sensitive data?

coldtea 7mo ago
We're going the other way: now any random vibe coded slop is the norm.
- bad_haircut72 7mo ago
  Normalize "vibe-plumbing"
  - bombcar 7mo ago
    Both plumbing and wiring are “easier” in a way than programming-as they’ll violently and potentially explosively let you know if you messed up; whereas programming lets you be blissfully unaware until you see your data plastered across the nightly news.
    - avian 7mo ago
      Wiring mistakes can kill or burn down a house months or years after they have been done. You will not notice unconnected protective earth or badly dimensioned circuit breakers until something else breaks and the protective element is not there.
    - Ekaros 7mo ago
      There are many failure cases that are slow. Especially with water. Let say they sag a bit and connection is poor. It might slowly start leaking over months causing structural damage or at least dampness and microbiological effects.
    - ChoGGi 7mo ago
      I'm in the midst of renovating a house at the moment, it's about ten years old. The plumber siliconed all the shower valves to the fiberglass walls without screwing them to a backplate. Unsurprisingly the builder is now out of business.

Aurornis 7mo ago

> should require some kind of genuine software engineering certification Wouldn't change a thing, other than add another hassle you have to pay for to do your job. This is the result of carelessness, not someone who didn't know that private data should be private because they weren't certified.

applfanboysbgon 7mo ago
This is the result of somebody who has no idea how the fuck the tech they're using works. They surely knew it should be private, but they did not know that they were making it publicly available because they were blindly fumbling their way around in a job beyond their competence level. There is a 0% chance this was ordinary carelessness, in the form of "I know better but don't care enough", this is so clearly a case of "I don't know what I'm doing".
- Aurornis 7mo ago
  Any time someone tries to suggest certification as a solution I ask the same question: How would it have solved this problem? Would the certification require someone to take an official certification test for the framework used? And therefore we’re only allowed to use frameworks which have certification tests available? If you want to write some new software, do you have to generate a certification for it and get that approved so people are allowed to use it? Sounds like a great way to force us all to use Big Company approved software because they’re the only ones with pockets deep enough to play all of the certification games
  - applfanboysbgon 7mo ago
    The fact that you're thinking purely in frameworks is the exact problem that plagues the software industry. Framework-focused development is why we're in this mess; frameworks make it easy for people who don't understand how to program to publish shitty software by copying-and-pasting code and fudging around a few strings or variables to match their use case. That kind of accessibility is great for low-stakes software, letting anyone make interesting toys, but should be completely unacceptable in a professional environment with, for example, people's fucking tax documentation at stake. If I had my way, the certification process starts at the bottom of the stack, ie. you should be expected to have a functional knowledge of assembly instructions, memory management, registers, the call stack, and build up from there. Not that we need to write assembly on a daily basis, but all of the abstractions are built on top of that, and you cannot realistically engineer secure software if you don't understand what is being abstracted away. If you do understand the things being abstracted away, you have the fundamentals necessary to do good work with any programming language or framework. Throw in another certification starting from networking fundamentals if your job involves that. 30 years ago, most professional programmers had this level of understanding as table stakes, so we can hardly say it's an unrealistic burden that's impossible to meet. Would it be a higher barrier to entry that massively cuts the size of the field working on sensitive software and slows software development down, yes. That is exactly what we need. There was a time when people built bridges that collapsed, then we implemented standards and expected engineers to do real work to make sure that didn't happen. Is that work expensive and expertise-intensive, yes, do bridges still collapse, only very rarely. We are witnessing software bridge collapses on a weekly basis, which should be seen as completely unacceptable. The harm is less obvious than when everyone on a bridge dies, but I do think that routinely leaking millions of people's sensitive data is causing serious harm and likely does lead to people dying in second-order effects.

ge96 7mo ago

People at my company don't even lock their computer when they walk away from their desk. Which yeah it's in a controlled environment but still.

yojo 7mo ago
My work has a “donuts” slack channel for this. You find an unlocked computer you post “donuts on me!” Social pressure says they buy the office donuts. Still get a few a week, but at least it’s public and amusing.
- rcbdev 7mo ago
  This would be borderline illegal in most countries. Not very enforcable, sure, but illegal.
  - livesinhel 7mo ago
    Nobody would give a damn about it.
SillyUsername 7mo ago
We used to flip display upside down in display options, which also reverses the mouse. We'd then lock the PC and disconnect the keyboard. After they figured out the keyboard had been pulled they often couldn't work out why their screen was upside down...

philip1209 7mo ago

good thing it's getting easier to code - nothing bad can come of this :-)

userbinator 7mo ago

some kind of genuine software engineering certification That only gives those in power another way to push people into toeing the line. There's enough corporate authoritarianism these days as it is already. Give Stallman's "Right to Read" a read. His dystopia is exactly where we're going to be headed quickly if we keep demanding someone to "do something". "The optimal amount of fraud is nonzero." "Those who give up freedom for security deserve neither."

computably 7mo ago
You're responding to literally 7 words out of context. > Jobs with access to/control over millions of people's data should require some kind of genuine software engineering certification FAANG, Fortune 500, etc., almost universally go out of their way to violate user freedom in pursuit of profit. Regulation is practically the only way to force megacorps to respect users' rights and improve their security, as evidenced by right-to-repair, surveillance/privacy, and so on. And none of that has anything to do with users' individual rights to create, run, and modify their own software. (Yes, regulatory capture exists, no, it doesn't mean all regulation is bad.)
- userbinator 7mo ago
  If the megacorps are going in that direction of being strictly regulated, the rest of the industry will follow. It's the general movement of the Overton Window that's the underlying issue.
  - subscribed 7mo ago
    No, they won't. No one in their right mind "wants" ISO27001, ISO9001, SOC or multiple PITA certifications. Companies do that because they want to attract certain kind of customers and have enough spare manpower and money to go through this all year long. ....or they want to hold a very sensitive data that requires *proven* processes, trainings and skills. My firm has several of these and we have to keep full compliance team and *always* have some auditor on site. No one does it just because.

victorbjorklund 7mo ago

I once worked in a company and noticed that customer financial statements were publicly accessible. Ran into the software team. And got the reply that no one told them that it should be behind authentication. Some people really don't use their own brains.

21asdffdsa12 7mo ago
If you do, you get into trouble with the hierarchy, all those middle-managers and responsibility distributing committees will be unemployed.

morpheuskafka 7mo ago

At my last job, I opened up Shodan in my free time and clicked through our ASN with the free filters. In two minutes I found multiple iDRACs online. Surprisingly, none had default pw. But one had a public exploit vuln that was years old allowing takeover... Turns out during the firewall hardware migration years ago, several units firewalls were switched to audit mode (not enforcing rules). So an entire institute (health research!) had their whole subnet public with zero firewalls, both the server OS and iDRAC interfaces. iDRAC isn't even supposed to be on the same VLAN per Dell let alone on the internet. To top it off, after making some tickets (admittedly not all as serious, ex MFP web UIs on internet) from Shodan, I got pushback from the firewall team for causing units to submit to many changes. I also got in trouble with our Qualys analyst for undermining his work because he hadn't gotten to that units annual review yet, even though I didn't even have a Qualys login. (And even if I had found it there, since when do we wait for annual reviews to fix that?) It took at least three weeks internally to get it fixed, and by that I mean only the iDRAC IP blocked with the server itself still wide open. And that's only because I mentioned it to my manager (awesome guy and not formally responsible for firewall rules) after an unrelated no firewall host incident came through and he authorized an emergency rule.

bblb 7mo ago
Huawei Enterprise devices tend to have a CAPTCHA by default on their BMC/OOB GUIs or the other various system/infrastructure service GUIs (such as the HuaweiCloud/FusionCloud products). I'm guessing the reason is that people leave the management ports and GUIs wide open to the public Internet, so the CAPTCHA is protecting at least from the very basic script kiddie bots.

borplk 7mo ago

Unfortunately everything is going in the opposite direction. We are in the age of AI-slop AI-everything AI-break-it AI-fix-it. Software companies are competing with each other on how low they can push the quality and still get away with it. There's no reward or incentive for paying attention to the details or the quality. In fact you will get penalised for it.