Not a Problematic Liz
A
Report asked me if it was really necessary to keep your imported libraries up to date because "so many repos don't update their packages". I'm sick of re-explaining best practices so I flippantly said "well yeah, there's a lot of average developers" and would you believe that actually worked?
07:25 AM - Mar 01, 2024
Avatar
0
7
1
Nefarious Newt
A
In response to Not a Problematic Liz.
The number of "average" developers is staggering. If you ever want to know why data breaches and security flaws occur, start with the fact that maybe half of software engineers don't understand the use of logic or the idea of testing input for validity.
07:27 AM - Mar 01, 2024
1
1
Not a Problematic Liz
A
In response to Nefarious Newt.
You're absolutely right.

I was actually stunned when he pushed back on this. Me and my work BFF are always trying to stay on top of these things. We don't wait for infosec to warn us and we aim for a proactive approach.

They want to become a senior but they clearly aren't paranoid enough imo.
07:37 AM - Mar 01, 2024
1
0
Nefarious Newt
A
In response to Not a Problematic Liz.
I was writing secure code back in the early 00's, because Perl is nice enough to have the '-T' flag, or the "Paranoia Flag," as I like to call it, which basically FORCES a script to treat any information you try to jam into it as dirty until you verify its authenticity. It forced me to write clean.
07:41 AM - Mar 01, 2024
1
1
Nefarious Newt
A
In response to Nefarious Newt.
It takes so little effort to say, "You know what? I know this data comes form our own database but I really SHOULDN'T trust it, just in case," but everyone is in such a hurry to get product "out the door," that any extra steps to sanitize data are treated as "luxuries" and not "necessities."
07:43 AM - Mar 01, 2024
1
1
Not a Problematic Liz
A
In response to Nefarious Newt.
Personally, I'm a fan of "slow engineering". Slow is smooth, and smooth is fast enough for me.

I'm lucky I build mostly internal products so there isn't as much pressure to get things out the door more so than making sure it's quality.

In my case, I think some people were being lazy.
07:47 AM - Mar 01, 2024
1
3
Nefarious Newt
A
In response to Not a Problematic Liz.
Lazy is the other part of the problem. Guys looking for canned code they can just bolt it, without being able to understand how it works or why it's a BAD IDEA. I mean, does anyone do ACTUAL code review anymore, or have we handed that over to the computers?
07:49 AM - Mar 01, 2024
1
1
Not a Problematic Liz
A
Omg can I work with you?
In response to Nefarious Newt.
08:06 AM - Mar 01, 2024
0
1

 

{{ notificationModalContent }} {{ promptModalMessage }}