Zoom: Remote Code Execution with XMPP Stanza Smuggling • Hacker News Board

Re: Zoom: Remote Code Execution with XMPP Stanza Smuggling

#91

Post by salawat » Wed, May 25, 2022, 8:26 PM UTC

IshKebab wrote: post #83

salawat wrote: post #54

Earlier quoted context omitted.

Wrong. If you care about security, verify your goddamn invariants . This is not a software problem. This is a lazy programmer/software engineer problem. Electrical Engineering, or hell, any matyre engineering field understands this concept. If you have mot read your entire codepath, you have no idea what it is you are doing . Welcome to why my life as a QA is effing miserable. Every bit of ignorance by devs following…

> This is not a software problem. This is a lazy programmer/software engineer problem. The old "good programmers don't write bugs" fallacy. How do so many people still think like this in 2022??

There is a difference between not writing bugs, and checking your invariants.

If you have not read implementation code you are dependent on, you by sefinition have not had the signal that raises that invariant violation into your consciousness.

It would be like a civil engineer building a bridge out of limestone at a thickness that would require a larger thickness of steel and just saying "to hell with it, go figure it out".

The write-only programmer is a threat to themselves and everyone around them. And to be frank, even more dangerous are those members of management who have their expectations around implementation time so skewed by this cavalier attitude toward knowing the dynamics of your stack.

You will make bugs. Crossed invariants are completely preventable though.

Re: Zoom: Remote Code Execution with XMPP Stanza Smuggling

#92

Post by salawat » Wed, May 25, 2022, 8:31 PM UTC

KronisLV wrote: post #61

salawat wrote: post #54

Earlier quoted context omitted.

Wrong. If you care about security, verify your goddamn invariants . This is not a software problem. This is a lazy programmer/software engineer problem. Electrical Engineering, or hell, any matyre engineering field understands this concept. If you have mot read your entire codepath, you have no idea what it is you are doing . Welcome to why my life as a QA is effing miserable. Every bit of ignorance by devs following…

> If you care about security, verify your goddamn invariants. While it would be nice to be able to do this, sadly we don't have infinite resources, lest we be okay with actually shipping software in 5-10 years instead of 1-2. I know that I would be okay with such a world, but people who pay my salary might not share that point of view. Nor do the people who would have to choose an app to use in the near future, inste…

And thus we come back to the age old quandry. The implicit act of economic violence tucked away into our current society.

I have capital, you don't, do what I want, or starve.

It always comes back to violence.

This is why we waste so much time reinventing things and white labelling, and subjecting other professions to the most ungodly tooling. We mass-produce suffering. We engineer it into the product in the form of lack of care under the guide of "we're innovating guyz".

Re: Zoom: Remote Code Execution with XMPP Stanza Smuggling

#93

Post by KronisLV » Wed, May 25, 2022, 10:26 PM UTC

salawat wrote: post #92

KronisLV wrote: post #61

Earlier quoted context omitted.

> If you care about security, verify your goddamn invariants. While it would be nice to be able to do this, sadly we don't have infinite resources, lest we be okay with actually shipping software in 5-10 years instead of 1-2. I know that I would be okay with such a world, but people who pay my salary might not share that point of view. Nor do the people who would have to choose an app to use in the near future, inste…

And thus we come back to the age old quandry. The implicit act of economic violence tucked away into our current society. I have capital, you don't, do what I want, or starve. It always comes back to violence. This is why we waste so much time reinventing things and white labelling, and subjecting other professions to the most ungodly tooling. We mass-produce suffering. We engineer it into the product in the form of…

Ehh, that's a somewhat grim view, though I doubt I can offer many valuable points about the wider nature of capitalism as a whole.

That said, what I can say is that there definitely is a wide spectrum of different circumstances that people are dealing with and therefore the level of care that certain things will get will also vary.

For example, would it be cool to spend 2 decades working on the perfect GUI framework that'd be tested, dependable, performant and would also have exceedingly good usability? Sure. Is that going to happen in our current world? Perhaps not.

But hey, starting out with a bit of pushback and selling the concept of TDD or quality gates is a start as well, or even having proper tests for all of the important business logic, whilst willingly ignoring (putting off) the things that are just infeasible.