3 ms·

Eh, I'm not sure they are incompetent. They are, however, swimming in a sea where the slightest mistake is lethal. Some people see these stories and think "ha

Eh, I'm not sure they are incompetent. They are, however, swimming in a sea where the slightest mistake is lethal. Some people see these stories and think "ha, I could do better than that!" Other people see these stories and think "can I really be sure that I haven't made even one fatal mistake?" All software engineers write bugs. All software engineers write security holes. For most of us, the fatal flaw doesn't irrevocably wipe out a bunch of people's life savings.

unclebucknasty 13y ago
>Eh, I'm not sure they are incompetent. Some of these guys are indisputably incompetent with regard to the software and services they are building. While it's true that all software can have bugs, these are extraordinarily unsophisticated attacks that any non-hacker can exploit by, say, refreshing his browser in rapid succession. That is, there is a sliding scale with regard to the level of competence imputed to, say, a certain type of bug. And, this wasn't a simple coding error (which, can be more easily forgiven). This was a fundamental oversight in the overall approach to the software, with regard to a critical operation. And it involves such basic concepts as transactions and race conditions. While eliminating the latter can be difficult to get right, it appears that they didn't even consider the fact that they could occur. I am one of the guys in your group who thinks "have I considered everything?" In fact, I would be inclined to believe that I haven't. Perhaps that's pessimism or just realism, given what I've seen from determined hackers attacking my business over the years. So, I can certainly give a pass to oversights or errors. But, at a certain point, the nature of some oversights or errors are indicative of the fact that the developer(s) are not competent, at least with regard to the domain.

unclebucknasty 13y ago

>Eh, I'm not sure they are incompetent. Some of these guys are indisputably incompetent with regard to the software and services they are building. While it's true that all software can have bugs, these are extraordinarily unsophisticated attacks that any non-hacker can exploit by, say, refreshing his browser in rapid succession. That is, there is a sliding scale with regard to the level of competence imputed to, say, a certain type of bug. And, this wasn't a simple coding error (which, can be more easily forgiven). This was a fundamental oversight in the overall approach to the software, with regard to a critical operation. And it involves such basic concepts as transactions and race conditions. While eliminating the latter can be difficult to get right, it appears that they didn't even consider the fact that they could occur. I am one of the guys in your group who thinks "have I considered everything?" In fact, I would be inclined to believe that I haven't. Perhaps that's pessimism or just realism, given what I've seen from determined hackers attacking my business over the years. So, I can certainly give a pass to oversights or errors. But, at a certain point, the nature of some oversights or errors are indicative of the fact that the developer(s) are not competent, at least with regard to the domain.