Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm not burned out, I'm pissed off

myname.website

Post reply on HN
Print view View original

171–180 of 335 posts

Re: I'm not burned out, I'm pissed off

#171

Post by lidHanteyk »

javajosh wrote: post #13
ailideex wrote: post #6

Earlier quoted context omitted.

> artificial scarcity for software Can you elaborate on this? Why would you say there is artificial scarcity for software?

Software costs ~0 to copy and distribute absolutely perfect copies, world-wide. To drive the price up you create artificial scarcity, mostly rooted in IP law. Important note for HN readers: 'driving the price up' is a net benefit for programmers. Artificial scarcity is why you get paid big bucks. Interestingly, data is legitimately scarce. But that's a discussion for another time...

Quality software is scarce, though. Even in a world without copyright, or a world in which copyright does not apply to pure information like source code, it would still be difficult to produce short effective code (because finding short effective code is NP-complete!) and so some of us would still be employed without difficulty.

Re: I'm not burned out, I'm pissed off

#172

Post by SamuelAdams »

coldcode wrote: post #161
EnderMB wrote: post #81

I don't explicitly work in security, but I've had a handful of arguments in the past where I've discovered a serious vulnerability, and been told either by my managers or by a client that it is low-priority. Sometimes, the vulnerability was then exploited, and what shocked me was that people were okay with this. I won't name names, but one marketing department I worked with was happier to suffer a customer data leak…

I worked at a healthcare company in the US (we provided HIPAA data connections between insurance and providers) and discovered all the production passwords were storied in a text file in the code repo half the company had access to. The CTO told me "we trust our employees". There was also no auditing on who access the DB and servers, and they never changed the passwords because the chief architect did not want to rem…

I worked at a retailer (not Target) that did something similar. Once Target got breached in 2014, they mandated security training and began making changes to some things in the org. This was one - instead of storing those passwords in plain-text, they were encrypted. So people encrypted them, commited them into the repositories, and deployed the now encrypted files to production. Cool, right?

They didn't actually change the passwords, since that would break too many things at once. So you could just look at the git history to get the plain text password. Or debug the application locally.

Security theater all day. Sigh.

Re: I'm not burned out, I'm pissed off

#173

Post by ilteris »

wayoutthere wrote: post #151

I 100% agree as a consultant working in product development. I think what drives this is a lack of ability for anyone to understand the end-to-end product from a technical standpoint and make coordinated decisions about direction. Instead, you have 30 teams with their own architects and roadmaps (which often overlap functionality) so you build the same thing 5 times across the org, then 3 of them end up drawing meani…

This comment nails it. Is there anyway to fix this problem? Not the burnout as that's the symptom but the cause, bad structure.

Re: I'm not burned out, I'm pissed off

#174

Post by Wheaties466 »

I also work for a security product vendor and this 100% reflects exactly how I feel. My god you'd think I wrote this.

I'm still very upset that my employers product doesn't have particular features but what i've come to realize is that we don't have feature X because the competitor doesn't have feature X.

If someone was to buck the trend and just try and be the best vendor possible because its what users deserve that would completely disrupt the industry.

I completely understand this thinking but im tired of hearing that the dev team is developing feature Y that only 1 customer will use simply because they are a fortune 500 customer.

Re: I'm not burned out, I'm pissed off

#175

Post by flir »

arethuza wrote: post #160
Koshkin wrote: post #155

Earlier quoted context omitted.

Indeed, if you are a security engineer, everything looks like a threat to you. Therefore, a developer's workstation must be protected just as strongly as a critical database server - at the gross expense, of course, of the developer's productivity.

I once worked somewhere as a contractor where developers had 3 separate PCs with a KVM switch - with there being separate development, test and production infrastructure. Ironically they had a serious production incident that almost took the entire (large) company out for a day because they were doing load testing in one environment (they had about 10 separate environments) but they had shared email infrastructure be…

My worst: Developer machines were dumb (but secure) terminals for remote desktop connections to a jump box, where a VNC connection got us to a Linux desktop living on AWS GovCloud where actual development took place.

It was a remarkably risk-averse client.

Re: I'm not burned out, I'm pissed off

#176

Post by BlueTemplar »

masonhensley wrote: post #169
wayoutthere wrote: post #151

I 100% agree as a consultant working in product development. I think what drives this is a lack of ability for anyone to understand the end-to-end product from a technical standpoint and make coordinated decisions about direction. Instead, you have 30 teams with their own architects and roadmaps (which often overlap functionality) so you build the same thing 5 times across the org, then 3 of them end up drawing meani…

Huge problem in many orgs. Many product decisions are made on the fly by the wrong person in an attempt to check a box and get something out the door quick. Or if the right decision gets made upstream, teams downstream don’t align for a litany of reasons. Haven’t been able to put my finger on it exactly (definitely a multi dimensional issue), but I don’t think the issues you outlined will continue to fly if you want…

Do you have any counter-example in mind ?

Re: I'm not burned out, I'm pissed off

#177

Post by kbr2000 »

wayoutthere wrote: post #151

I 100% agree as a consultant working in product development. I think what drives this is a lack of ability for anyone to understand the end-to-end product from a technical standpoint and make coordinated decisions about direction. Instead, you have 30 teams with their own architects and roadmaps (which often overlap functionality) so you build the same thing 5 times across the org, then 3 of them end up drawing meani…

I experienced this several times as an employee. It becomes hard to stand when you realize that every positive contribution just results in more money being shoveled out of the window behind your back (mainly because of greed, inefficiency, keeping the status quo, and wreckless behaviour caused by trust in your capabilities to somehow fix it again, every time over again) -- as opposed to contributing to a more efficient way of working for everyone.

Been doing extreme over-hours in the hope of fixing stuff once and for ever, only to realize your job becomes more and more like shit-shoveling, since management starts to feel invincible (and protected by your contributions), which leads them to make even more errors without accountability. I've seen some of them with tears in their eyes when I finally quit. 'nuff said. Profiteurs!

Re: I'm not burned out, I'm pissed off

#178

Post by bonoboTP »

tempguy9999 wrote: post #45
Iv wrote: post #26

Earlier quoted context omitted.

Thing is, it took me a long time to accept that people not caring was ok. Now I realize that my dad is frustrated I never learned something as simple as changing the oil on my car. My mom does not understand how I can't name more than two flowers and can't bake a pie. My legal-minded friends are astounded I do not take a day to work on my legal status to pay less taxes. Hell, my wife does the paperwork I am not even…

I can't accept that not caring is ok. The small "I don't care" extends into "I don't care about anything outside my immediate environment" and that has political and eventually global consequences. If their bank account is drained they will care, and get angry, and then maybe do something (but preferably the bank will recompense them in which case they feel better and go back to not caring). Some stuff you just can't…

> I really do not understand people.

Well, then learning more about people's psychology and motivations seems like a thing you could benefit from immediately :)

Re: I'm not burned out, I'm pissed off

#179

Post by xorfish »

umvi wrote: post #156
Koshkin wrote: post #155

Earlier quoted context omitted.

Indeed, if you are a security engineer, everything looks like a threat to you. Therefore, a developer's workstation must be protected just as strongly as a critical database server - at the gross expense, of course, of the developer's productivity.

Qualcomm is like this. Their developer workstations are ultra locked down. If you so much as plug in a flash drive, alarms will start going off. If you email them a file, any attachments are instantly quarentined. While I was there it was extremely difficult to transfer a log file from one of their workstations to my laptop for analysis during a debug session. It was also extremely difficult getting new builds into t…

I guess you could have used a private nextcloud instance to transfer it.

Re: I'm not burned out, I'm pissed off

#180

Post by BlueTemplar »

Koshkin wrote: post #155
contingencies wrote: post #142

The problem with the security mindset is that security goals are relative to other business goals within almost every organization. A breach can be OK. A rebuild can be OK. Some downtime can be OK. It depends on the system. To put it eloquently: I don't trust security people to do sane things. - Linus Torvalds (2017) ... via https://github.com/globalcitizen/taoup

Indeed, if you are a security engineer, everything looks like a threat to you. Therefore, a developer's workstation must be protected just as strongly as a critical database server - at the gross expense, of course, of the developer's productivity.

Isn't threat assessment (risk/mitigation cost) part of their job ?
Post reply on HN