Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm not burned out, I'm pissed off

myname.website

Post reply on HN
Print view View original

181–190 of 335 posts

Re: I'm not burned out, I'm pissed off

#181

Post by umvi »

contingencies wrote: post #142

The problem with the security mindset is that security goals are relative to other business goals within almost every organization. A breach can be OK. A rebuild can be OK. Some downtime can be OK. It depends on the system. To put it eloquently: I don't trust security people to do sane things. - Linus Torvalds (2017) ... via https://github.com/globalcitizen/taoup

> I don't trust security people to do sane things

Seriously. Security decisions that demolish UX can tank entire products.

Recent-ish example: Oracle VirtualBox. Used to love that software and I would recommend it to friends needing VMs. They added a new hardening feature that makes it unusable on my setup for whatever reason (VMs fail to start with "hardening failures"). There is no option to disable the hardening feature short of going into the source code figuring out how to disable it and building from scratch[1]. It's like geez, I don't even care about hardening - I'm not trying to analyze stuxnet or some ransomware virus here, I just want to work on my web app in between classes at school on my windows laptop.

There's a massive FAQ on the VirtualBox forums on how to debug hardening failures[2]. I spent about 5 hours working through the FAQ and troubleshooting before I just said "screw this" and bought VMWare which worked perfectly first try. I no longer recommend VirtualBox to friends - I tell them it will likely give them headaches and to use VMWare or WSL instead.

[1] https://forums.virtualbox.org/viewtopic.php?f=6&t=84523

[2] https://forums.virtualbox.org/viewtopic.php?f=25&t=82106

[3] https://forums.virtualbox.org/viewtopic.php?f=1&t=62897

Note: [3] is actually pretty entertaining thread with insane security people defending the new terrible hardening issues of VirtualBox.

Re: I'm not burned out, I'm pissed off

#182

Post by 0xffff2 »

ilteris wrote: post #173
wayoutthere wrote: post #151

I 100% agree as a consultant working in product development. I think what drives this is a lack of ability for anyone to understand the end-to-end product from a technical standpoint and make coordinated decisions about direction. Instead, you have 30 teams with their own architects and roadmaps (which often overlap functionality) so you build the same thing 5 times across the org, then 3 of them end up drawing meani…

This comment nails it. Is there anyway to fix this problem? Not the burnout as that's the symptom but the cause, bad structure.

I'm a software engineer in a research environment. GP sticks out to me because it's nearly the opposite of how it works for me. I as the architect/lead software engineer make basically all of the important decisions about the software. I have a project manager and about 6 researchers who are, theoretically, my customers, but they all know that they're not software engineers so they tell me what they need and defer all intermediate decisions to me.

Combining my experience with GP, the glib, almost tautological, answer is that you fix the problem by not letting "non-technical middle managers" make technical decisions. Actually implementing this in an organization that already suffers from it is a political problem which I don't have any advice on. For orgs where this isn't a problem yet, the answer is simple. If you're a technical organization, don't hire non-technical managers. Every single person in my management structure started out as an engineer or researcher and it works remarkably well.

Re: I'm not burned out, I'm pissed off

#183

Post by BlueTemplar »

vfc1 wrote: post #163

The bad news is that this will happen everywhere where you work for someone else, especially in large companies. And this cannot be avoided while working as an employee, it's part of the system. The good news is that there is one way to avoid this (the only way AFIK) is to start your own company, there you get to call all the shots for good or for bad. It doesn't have to be a big company though, it can be just you an…

Everything a new graduate could wish for ! /s

Re: I'm not burned out, I'm pissed off

#184

Post by 0xffff2 »

vfc1 wrote: post #163

The bad news is that this will happen everywhere where you work for someone else, especially in large companies. And this cannot be avoided while working as an employee, it's part of the system. The good news is that there is one way to avoid this (the only way AFIK) is to start your own company, there you get to call all the shots for good or for bad. It doesn't have to be a big company though, it can be just you an…

I couldn't disagree more. I work for the government (in R&D) of all places (about as close as possible to the opposite of working for myself IMO) and I don't feel this at all. I have near-total control over my work environment. If I need something, all I have to do is articulate why I need it and I will get it or get a precise technical explanation of why I can't have it.

Re: I'm not burned out, I'm pissed off

#185

Post by finnthehuman »

I'm a recovering security guy.

When I listen to security people rant, I can see their points and it's a bit of fun, I like a good rant. But I get the impression that they're continuously discovering new and exciting ways that individual facets of individual pieces of software (and the processes around them) suck. All without ever accepting that the entirety of the software ecosystem sucks (and that they're rarely moving the needle on that front).

All software and the internet combined is a giant ball of mud that just grows and grows as more people add onto it. There's no architecture more than the strict minimum to keep the whole thing from falling apart the moment someone breaths too heavily near it. And that's not even including when commercial interests keep trying to design their chunks of the mudball in unique ways that make themselves more money at the cost of everyone else's chunk getting more complex.

Like everyone else adding mud, security wants to get in, hit their requirements, and get out. I just don't like the chip on their shoulder that nobody else is doing enough to fix the system throughout in a way that helps them achieve their goals with the least fuss.

Re: I'm not burned out, I'm pissed off

#187

Post by Redsquare »

wayoutthere wrote: post #151

I 100% agree as a consultant working in product development. I think what drives this is a lack of ability for anyone to understand the end-to-end product from a technical standpoint and make coordinated decisions about direction. Instead, you have 30 teams with their own architects and roadmaps (which often overlap functionality) so you build the same thing 5 times across the org, then 3 of them end up drawing meani…

This is so so very true

Re: I'm not burned out, I'm pissed off

#188

Post by luxuryballs »

Sometimes the best way to solve a problem is to stop participating in it. Why do the security breaches matter so much in the first place?

If the risk is so high and the security so bad, stop using the technology for things that demand more than provided protection.

Otherwise it makes it sound as if we are being sold snake oil. (Hint it’s a stepped approach that starts with being disconnected to the internet.)

Re: I'm not burned out, I'm pissed off

#190

Post by javajosh »

saberdancer wrote: post #69
javajosh wrote: post #27

Earlier quoted context omitted.

You tacitly assume that I am not aware that software products have an R&D cost, and you are (insultingly) wrong. Of course they do. And without artificial scarcity that R&D cost will not be recouped. The default state of software is an open source model, where the "developing, building, and deployment" doesn't cost money because there isn't any.

Copy and distribution costs for movies in a digital age are non existant. Are movies using artificial scarcity?

Yes.
Post reply on HN