Ask HN: Why do you think vulnerable code is still being released today?

Post by mathattack » Wed, Feb 12, 2014, 7:14 PM UTC

twstdroot wrote: post #14

mathattack wrote: post #11

Earlier quoted context omitted.

I think you over-estimate the impact of universities. Many (perhaps most?) CS professors think of themselves as Applied Mathematicians. It's unrealistic to expect your linear algebra teacher to worry about style. Negligence is the first. Sometimes it's even willful. "Get this out in 3 weeks under budget, I don't care how." That leads to human error, which is more likely when you have underqualified people working on…

I don't think that is an over estimation of the impact of universities. First, are the majority of university educated programmers really learning from CS professors? I'd venture that more programming is taught outside of the CS programs these days. Second, as someone finishing a degree in information security and having worked in IT for 14 years and IT security for 4 years, universities are not doing a great job in…

I think we're saying the same thing. Universities aren't teaching security, so folks learn it elsewhere. Most people hiring new grads know this.

Post by mathattack » Wed, Feb 12, 2014, 7:16 PM UTC

zamalek wrote: post #16

mathattack wrote: post #11

Earlier quoted context omitted.

I think you over-estimate the impact of universities. Many (perhaps most?) CS professors think of themselves as Applied Mathematicians. It's unrealistic to expect your linear algebra teacher to worry about style. Negligence is the first. Sometimes it's even willful. "Get this out in 3 weeks under budget, I don't care how." That leads to human error, which is more likely when you have underqualified people working on…

> I think you over-estimate the impact of universities. I may, I have a bit of a vendetta for them. > Negligence is the first. Arguably, yes. Most of the comments when I posted mine indicated that negligence was the cause -- I was aiming to find the other ones. Still I somehow fail to understand how even pressure results in SQL injections -- nearly all languages I have worked with have a productivity reward/time savi…

On point one - perhaps my expectations are lower. I think a CS degree signals a level of rigor that is absent in other degrees, but I don't pretend that the practicality is so high that people can be instantly useful. I assume that it takes 3 months of general training, and several more of "Here's how we do it here" before you can expect much. (As opposed to a Math major who would require programming training on top of it, or a History major who might be lost outright)

Re: Ask HN: Why do you think vulnerable code is still being released today?

Re: Ask HN: Why do you think vulnerable code is still being released today?