221–230 of 335 posts
Earlier quoted context omitted.
I've heard from someone selling security products that some companies prefer to pay ransonware to a hacker, instead of investing in building up their defense and paying for security products
The easiest security investment is to switch your shop from Windows, cutting like 98% of threats out there cold.
I'm a recovering security guy. When I listen to security people rant, I can see their points and it's a bit of fun, I like a good rant. But I get the impression that they're continuously discovering new and exciting ways that individual facets of individual pieces of software (and the processes around them) suck. All without ever accepting that the entirety of the software ecosystem sucks (and that they're rarely mov…
As a software engineer, I think this is my experience at every job I've had around systems in general.
Basically everyone wants security, but nobody wants to pay for it. Maybe the market equilibrium means people don't get hurt enough yet.
Everybody wanna be a bodybuilder. But ain't nobody wanna lift no heavy-ass weight. https://www.invidio.us/watch?v=4UlgXIL0-3g
I'm a recovering security guy. When I listen to security people rant, I can see their points and it's a bit of fun, I like a good rant. But I get the impression that they're continuously discovering new and exciting ways that individual facets of individual pieces of software (and the processes around them) suck. All without ever accepting that the entirety of the software ecosystem sucks (and that they're rarely mov…
This is key. They're not the ones pushing to replace C/C++, even though you'd think that would logically follow. In that way, infosec is the DEA of IT.
The bad news is that this will happen everywhere where you work for someone else, especially in large companies. And this cannot be avoided while working as an employee, it's part of the system. The good news is that there is one way to avoid this (the only way AFIK) is to start your own company, there you get to call all the shots for good or for bad. It doesn't have to be a big company though, it can be just you an…
I managed to recover from a similar level of burnout/pissed-offedness by changing my domain of software development completely. I got out of high-stakes server-side software and into client-side mobile software. It took some effort to pivot, but in the end it was a great relief. In my experience, Apple's slow approval process is a much better problem to have than getting pinged at 3am for any reason.
Earlier quoted context omitted.
Do you have any counter-example in mind ?
The best architectures, requirements and designs come from a team with a fantastic lead/architect/product manager?
The product my current employer is working on suffers immensely from a lack of central leadership to the point where each of the pieces of the application have different (and sometimes contradictory!) ideas of what the world looks like.
It's absolutely maddening.
"A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one." N…
>They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand. And don't forget the universal elixir that cures all security ills: adding even more rules about which passwords are allowed.
I'm a recovering security guy. When I listen to security people rant, I can see their points and it's a bit of fun, I like a good rant. But I get the impression that they're continuously discovering new and exciting ways that individual facets of individual pieces of software (and the processes around them) suck. All without ever accepting that the entirety of the software ecosystem sucks (and that they're rarely mov…