2 ms·

"Its not about beauty, its about buggy software." In the vast majority of cases, it's about delivering customer value--whether through good, buggy, or nonexist

"Its not about beauty, its about buggy software." In the vast majority of cases, it's about delivering customer value--whether through good, buggy, or nonexistent software. A buggy language used to make buggy software beats a perfect solution every time if it gets you paid. EDIT: Downvote all you'd like; in the vast majority of cases the pain point of a customer getting solved is what matters, not how we solve it.

dllthomas 13y ago
There is an element of truth to this. It is also how we get things like Heartbleed.
- angersock 13y ago
  So, library code and critical infrastructure would fall outside of the "vast majority of cases". :) And again, the question there is "Did Heartbleed keep people from getting value out of OpenSSL?". The answer is no, even if the value provided wasn't as advertised. It was more useful to have something--anything!--than nothing.
  - dllthomas 13y ago
    'So, library code and critical infrastructure would fall outside of the "vast majority of cases".' Arguably, though the limited sandboxes in wide deployment are sufficiently full of holes that most code provides some access to something that might be considered critical infrastructure. 'And again, the question there is "Did Heartbleed keep people from getting value out of OpenSSL?". The answer is no, even if the value provided wasn't as advertised. It was more useful to have something--anything!--than nothing.' Possibly. Belief that you're secure when you aren't can quite definitely be much worse than no belief that you're secure, but I'm significantly less sure that Heartbleed moved many people from "sufficiently secure" to "insufficiently secure" in many individual cases (the possibility exists, I just lack the data to make any determination). Also, for many use cases, there exist (and existed then, of course) alternatives that are probably more secure. If "nothing" meant using those instead it was quite a bit better to have "nothing".
paulajohnson 13y ago
I can have it done next week if it doesn't have to work. And of course this is a false dichotomy anyway.
deleted 13y ago
[deleted]

dllthomas 13y ago

There is an element of truth to this. It is also how we get things like Heartbleed.

angersock 13y ago
So, library code and critical infrastructure would fall outside of the "vast majority of cases". :) And again, the question there is "Did Heartbleed keep people from getting value out of OpenSSL?". The answer is no, even if the value provided wasn't as advertised. It was more useful to have something--anything!--than nothing.
- dllthomas 13y ago
  'So, library code and critical infrastructure would fall outside of the "vast majority of cases".' Arguably, though the limited sandboxes in wide deployment are sufficiently full of holes that most code provides some access to something that might be considered critical infrastructure. 'And again, the question there is "Did Heartbleed keep people from getting value out of OpenSSL?". The answer is no, even if the value provided wasn't as advertised. It was more useful to have something--anything!--than nothing.' Possibly. Belief that you're secure when you aren't can quite definitely be much worse than no belief that you're secure, but I'm significantly less sure that Heartbleed moved many people from "sufficiently secure" to "insufficiently secure" in many individual cases (the possibility exists, I just lack the data to make any determination). Also, for many use cases, there exist (and existed then, of course) alternatives that are probably more secure. If "nothing" meant using those instead it was quite a bit better to have "nothing".

paulajohnson 13y ago

I can have it done next week if it doesn't have to work. And of course this is a false dichotomy anyway.

deleted 13y ago

[deleted]