101–104 of 104 posts
I see no links between infosec and functional programming.
The link is that FP is usually bottom up and InfoSec is top down and they fail to meet in the middle Big FP shops will have solved this of course. I doubt StanChart or Jane Street are losing any sleep over it.
I've done more than my fair share of vendor due diligences (and audits, action plans and contract reviews,..) To me this is a non-issue, because customers almost always ask for types of security checks, not for specific tooling (ie: asking for source code analysis vs asking for veracode). As a rule, compliance/government folks will be concerned about the types of security measures you have in place and not about the…
This is not my experience. I've had buyers push on specific software. E.g. I've had one push back and arbitrary state that we must use "paid" source code analysis vs an open source solution. No reason given. I've had another say that vendor supplied antivirus is not good enough (e.g. Windows Defender or Apple Xprotect). Again, no reason given.
It doesn't surprise me in the least that you didn't get any feedback. The default option for these companies is to make you accept their specific blend of security requirements... Of course, you then have to support that forever...
I've had good luck setting up a meeting with both the due diligence person and the actual buyer/champion present. It's often easier to explain your stance in person and the buyer is going to stop the due diligence person when he's getting into the weeds.
Yeah im confused by this article. Why would this push functional programming into a small niche? Is it just because the scanners are only written small range of languages like C# or javascript? Seems like functional programming makes for BETTER security scanning all around. If anything I actually see this potentially giving FP a boost, unless the scanners are just surface level and are adopted as a matter of faith, a…
> Is it just because the scanners are only written small range of languages like C# or javascript? Yes. > Seems like functional programming makes for BETTER security scanning all around. Yes. > unless the scanners are just surface level and are adopted as a matter of faith Kinda. They are very useful, as they catch all those stuff that should have been designed out of the language/framework to start with. They are no…
Earlier quoted context omitted.
The link is that FP is usually bottom up and InfoSec is top down and they fail to meet in the middle Big FP shops will have solved this of course. I doubt StanChart or Jane Street are losing any sleep over it.
I've heard a lot recently about Jane Street. Do you know a lot about them? I was curious to know their background in more detail and generally what kind of company it is, or the general attitude or atmosphere of the place. Also, why do you mention them specifically in the context of FP?
They are mostly famous in tech circles for one day one of their interns Yaron Minsky saying, hey let's rewrite everything in OCaml. And they did, and were wildly successful, and he's the CTO now. They bet big on FP and it happened to be an excellent fit for their problem domain.