Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

Post by skrebbel » Thu, Mar 28, 2019, 4:17 PM UTC

Aeolun wrote: post #223

skrebbel wrote: post #122

Earlier quoted context omitted.

Engineer Alice is the only person incompetent at their job in this conversation. If " irrepressibly existential sigh " is how you argue security with your bosses then maybe you're not senior enough to be in meetings like these. The Manager and QA Engineers here depend on the expertise of the engineers. If the engineers fail to communicate key details of the situation, then that's on them. Sure, the boss is still at f…

If you answer with the existential sigh, you’ve had at least 20 conversations with a similar outcome before. Nobody arrives at a new company that jaded.

Post by davesque » Thu, Mar 28, 2019, 4:29 PM UTC

Post by pjmlp » Thu, Mar 28, 2019, 4:39 PM UTC

konstmonst wrote: post #256

pjmlp wrote: post #186

Earlier quoted context omitted.

Quitting assumes the possibility of finding a job around the corner and not having people that depend on you.

You might be surprised, but if you move to Europe, it is actually so! Move to Berlin of Frankfurt. There is always work for Software Developer here, it is hard not to get one and you get spammed by recruiters all the time. You don't have to take shit from management, you can just go elsewhere. Everything is also very near.

Post by admax88q » Thu, Mar 28, 2019, 4:46 PM UTC

pdpi wrote: post #213

admax88q wrote: post #112

Earlier quoted context omitted.

On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly". You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one woul…

If you're a company the size of Cisco, and you have two widely publicised vulnerabilities like this, then this sort of failure is _always_ management's responsibility. That responsibility might come in the form of "big bad management" chasing the cheapest possible "fix" against the advice of the the hero engineers, but it can take other shapes too. It might be poor oversight and QA processes, or a failure to hire and…

Post by spaceribs » Thu, Mar 28, 2019, 5:10 PM UTC

PaulHoule wrote: post #255

spaceribs wrote: post #220

Earlier quoted context omitted.

I've come to the conclusion recently that we're all just barbers, bloodletting and burring holes. Until we have proper certifiable and reproducible competency, we'll never become surgeons.

Don't you need a license to be a barber?