131–140 of 150 posts
Earlier quoted context omitted.
There are bad engineers too.
Absolutely, but systemically, that's not been their problem. Too many MBAs are making decisions without Engineering involvement. I know because my industry works the exact same way le rage
Earlier quoted context omitted.
This is not how companies work. Engineers at Boeing didn't have a design labeled "not-good-enough-but-cheap" and another labelled "more-skookum-but-is-expensive" and because they were bad engineers decided to go with the cheap one. It's a systemic issue due to cost cutting by, you guessed it, people MBA's. No engineer, if given the choice, would have re-used the old plane design instead of designing a fully new, mode…
And no engineer would have gone with only two AoA sensors. And no engineer would have made the computer ignore one of those two AoA sensors because two isn't enough and now you have a dilemma of which to trust. And no engineer would have cooked up the cockamamie idea of hiding the new CAS scheme so that they could claim that the new plane was the same type as the previous plane. And no engineer would have insisted th…
Earlier quoted context omitted.
Argumentative? I agreed that he was a jackass with a pithy comment about spelling. Inflammatory? What else do you call a clown that would spit on his own mother for a nickel? Point taken, but FFS. The man was a grand mal asshole and that should be mentioned every time his name appears.
You aren’t contributing to the conversation by going on a tirade.
Every single time assholes are mentioned, their assholery should be mentioned too. Let's not rewrite history for those unaware of how these "people" acted.
By your logic, the only thing that should be mentioned about Pol Pot is that he was a leader of Cambodia at one point.
Earlier quoted context omitted.
Absolutely, but systemically, that's not been their problem. Too many MBAs are making decisions without Engineering involvement. I know because my industry works the exact same way le rage
Well in the 737 MAX case here it is. There are multiple engineering failures, and regardless the management pressures there are specific engineers who implemented them and who signed them off.
1. Engineering incompetence.
2. Mgmt pressure.
3. Engineering failure. As in legitimately attempted, but missed the mark.
Considering how this company has operated, for decades, it's fairly simple to point to Option 2 as the most likely culprit. Option 1 is possible, but unlikely, since there are a number of engineers involved. Option 3 is also possible and could still be the issue, but if we were betting, it would be option 2, because they've already proven, that's who they are.
Earlier quoted context omitted.
Argumentative? I agreed that he was a jackass with a pithy comment about spelling. Inflammatory? What else do you call a clown that would spit on his own mother for a nickel? Point taken, but FFS. The man was a grand mal asshole and that should be mentioned every time his name appears.
You aren’t contributing to the conversation by going on a tirade.
Talking about this is doing a serious service.
Earlier quoted context omitted.
The usual problem is that the CSO is given things to do, no budget, and no authority. Which, again, if you go in open-eyed can be fine.
Untrue (in general). The CSO is frequently given lots of budget and authority. Having talked to some of the big bank executive teams, they have thousands of employees and hundreds of M$ budgets with wide latitude to enforce restrictions. It is just that the best commercial cybersecurity processes and “best practices” are useless against professional attackers with even minimal budgets and staff. Any technically compe…
Many security leaders (CISOs or otherwise) do not have the budget or authority to meet their board's or CEO's expectations, but it may be outside your sample of big banks.
I'm otherwise aligned with your comment. The successful CISOs I've interacted with, regardless of industry, educate their leadership team on the trade-offs and risks of investment levels, set realistic response and recovery times expectations based on those investments, and turn it into a business decision, rather than promising the impossible.
Earlier quoted context omitted.
And no engineer would have gone with only two AoA sensors. And no engineer would have made the computer ignore one of those two AoA sensors because two isn't enough and now you have a dilemma of which to trust. And no engineer would have cooked up the cockamamie idea of hiding the new CAS scheme so that they could claim that the new plane was the same type as the previous plane. And no engineer would have insisted th…
If the engineer doesn't remove the 3rd sensor to match cost expectations of the bean counter, then the bean counter can always find another engineer, fresh out of school, afraid for his job and CV, with no real-world experience, that WILL remove that 3rd sensor if someone yells at him/her or is offered a promotion for his/her "achievements". This new engineer will also cost less to hire than the old experienced engin…
Earlier quoted context omitted.
Untrue (in general). The CSO is frequently given lots of budget and authority. Having talked to some of the big bank executive teams, they have thousands of employees and hundreds of M$ budgets with wide latitude to enforce restrictions. It is just that the best commercial cybersecurity processes and “best practices” are useless against professional attackers with even minimal budgets and staff. Any technically compe…
Banking and financial services average 8.1% of revenue on IT Spending. Industries like industrial manufacturing, food and beverage, retail, and energy average 1.2% - 1.9%. Many security leaders (CISOs or otherwise) do not have the budget or authority to meet their board's or CEO's expectations, but it may be outside your sample of big banks. I'm otherwise aligned with your comment. The successful CISOs I've interacte…
I said CISOs are uniformly incompetent at cybersecurity. No matter how many resources they are provided they are uniformly incapable of delivering security acceptable to the business customers, shareholders, and stakeholders.
There are exactly zero universes in which it is acceptable for a bank to be thoroughly compromised for 1 M$. If they wrote the truth in their advertising and investor documents there would be calls for blood. It is the job of the security organization to make sure the CEO is not aware of the truth so that the CEO can continue safely making statements palatable to the stakeholders.
This is not a problem that can be solved by the current actors through increased resources, effort, or focus. They have demonstrated they are incapable of achieving minimally acceptable outcomes across the entire range in every field. There are no gold standards to point to, no paragons to emulate, just piles of crap littering the wasteland. Meaningful security will not be attained until we throw away all of the commercial IT garbage and build things on the various high robustness systems designed and verified to protect against professional and state actors.
Earlier quoted context omitted.
> Bombardier of Canada had to throw in the towel To be fair, that's because Boeing forced them to sell the rights to the A220 for $1. https://en.wikipedia.org/wiki/CSeries_dumping_petition_by_Bo...
You mean to say the rights were sold to Airbus, who went on to acquire more.