I'm not burned out, I'm pissed off

Your mom and dad, or grandparents probably didn't need to know, even though they know how.

Most of their interactions were with local businesses, with people who, like themselves, were part of the local community. The unofficial grapevine worked pretty well for rooting out the good and bad mechanics, lawyers and florists. Your dad could change the oil, but almost certainly knew which mechanics could be trusted to have done what was on the invoice, and the few to avoid at all costs. Mostly if really was OK not to care, because they knew someone who did. The network meant something. Doubly so in smaller towns, and yes, small town life came with some downsides too. :)

That breaks horribly when recommendations are of global mega-multinationals, and most businesses on most high streets are national and international chains. A recommendation counts for nothing for a business of that scale, and an individual vote may be an employee you might never encounter again. The network means nothing, except as something to be gamed. Taking your custom elsewhere means nothing unless a million or two others do too. You have to care as no one else gives a shit about your interests, just the sale or commission. Except precisely none of us have the time for that.

If we want the benefits of larger scale business I think we need to start giving them some responsibilities too. Like a duty of care in law as exists in some areas already, but further reaching to consider the public interest as a priority. Without something the power imbalance is impossible.

Without constraint, large business takes the piss. It's time for some constraint. Then maybe we actually can depend on each other again.

"A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."

No one in management wants the expense or the overhead of actual security. They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand. Then something real happens, a leak of user data, or credit cards or internal memos... suddenly everyones job is security and no one knows what to do. The last problem gets solved, there is more "theater" and a few quickly forgotten changes that get worked around or just ignored in the long run.

Furthermore your average engineer wouldn't eat a ham sandwich handed to them on the street by a stranger but will happily run code from 100's of other people on their servers with out even looking at it. Note: I too am guilty as charged. Sure you can vendor it, and miss out on future security patches (it was already broken). Or you could just pull it from whatever repo you got it from to begin with and pick up new flaws. Never mind the fact that pulling from random places assumes that all those other chains of trust remain un-compromised.

Management and Engineers should be the ones most concerend and most thoughtful regarding security and both seem to ignore it for cost and convenience reasons till it is (far too late and) a REAL problem.

"Yo are not seeing the fact that it is only you who are responsible for what’s happening inside you ."

This kind of pop-psych babble is naive and abusive.

As well as cutting 98% of your workforce as no office employee knows how to work on anything different.

> BTW I'm quite wary of "security products" for enterprise; it reeks of antivirus software writ large. That said I can see some benefit to services like audits, or even things like honey pots or "dark net scans" for detecting leaks. But something tells me that's not what you're talking about...

The product itself is quite reasonable on paper [1]. (And, yes, it would provide value even if all of the software industry would ramp up their security practices, so it's not a band aid like antivirus software.) The execution is the problem. Despise selling "nation state attacker secure" appliances, we are not internally focusing on producing a high security product but give priority to certifications and features. The disconnect between marketed identity and day-to-day developer experience is breathtakingly depressing... at least to those of us who have an interest in security. Management doesn't care of course. It sells (because of certification and little alternatives on the market), so all is well.

[1] Sorry for being so vague. Given the set of statements I've given already, anything more would make me personally identifiable to my coworkers.