Even with all the bullshit that the whole IT sector will have to go through due to #Meltdown and #Spectre I still find it... hopeful, I guess would be the word.
The hopeful part is: it seems possible to find such bugs.
We seem to need to go deeper and deeper, lower and lower to find the really huge gaping security holes. That means that there is *some* progress. And so there is *some* hope.
I like to also think that each one of these actually removes something from NSA's and APT's arsenals.
@Cybertrash it even means we *have improved*.
Question is will the lessons be learned. Will we learn to put "engineering" into "software engineering".
Time will tell.
@rysiek something worth noting! Maybe software engineers need to start folding more with computer scientists.
@Cybertrash I don't think so. Construction engineers do not mingle much with material scientists. Engineering != Science.
@rysiek fair. While overall I think software engineers need to actually put the engineering part of their name into perspective, my headspace is that this flaw comes from a performance/security compromise at the hardware level.
@Cybertrash I'd say it comes more from "hey let's reinvent te wheel every 2 years" approach to things.
How can engineers be taught if the whole field changes before they're done with college?
It's also a question of incentives. There is a lot of incentives in IT to "move fast and break things". There is almost none to create safe and secure solutions.
Almost all software comes with warranty disclaimers and liability waivers!
@rysiek also extremely true. Software engineers need to actually take responsibility for the things they create. Y'know, the engineering part of their name.
@rysiek @Cybertrash +1 to this issue.
I started learning about tech stuff in 2007 as part of a BTEC ND, then did a Comp Sci degree. By the time I graduated in 2013 half of what I'd learned was obsolete, and the rest years out of date.
Even now when I join a new project I'm effectively starting from zero.
In my last project it was "We're glad you know Java. Unfortunately you've not been on a Spring course or read up on Apache Camel, so the most of this codebase is alien jibberish to you"
@bobstechsite @rysiek @Cybertrash well, my university claims to teach CompSci skills that won't become obsolete. There are patterns that repeat in every iteration of technology. There's theory behind certain problems that stayed the same regardless of the implementation.
@Wolf480pl @rysiek @Cybertrash Oh, my sweet summer child... 😂
@bobstechsite @rysiek @Cybertrash so are you saying that in 20 years, none of today's concurrency models will be relevant? Or that programmers will no longer make abstraction layers? Or encapsulate state with small pieces of code (that we sometimes, but not always, call classes) in order to easily preserve invariants?
@Wolf480pl @rysiek @Cybertrash I'm saying that after graduation, your being booksmart on those things will mean very little.
Your employer will ask for a system, and that's what you'll build. You may influence some of the tech choices, but in reality you'll be dealing with existing codebases built on unfamiliar tech stacks.
Most of your job will be puzzling out a framework you're not familiar with, determining if bugs are in the code/config errors and arguing with people over Atlassian JIRA.
@Cybertrash @rysiek @Wolf480pl although I'm aware I've worked exclusively for big corporates and consultancies. Who's to say smaller companies and startups wouldn't be different?
@bobstechsite @rysiek @Cybertrash still, I bet it's easier to learn a new programming language or framework if you are a programmer than if you're not.
@Wolf480pl @rysiek @Cybertrash of course.
You're mostly being paid I guess to learn new stuff. And the pay isn't bad 🙂
If you want to get ahead learn about TDD, BDD and CIT.
But to forewarn you it will take 6 months to a year after graduation to get up to speed. (You can be top of the class at school, but coding stuff for assignments isn't the same as doing it for 40 hours a week for years at a time)
@bobstechsite @Wolf480pl @rysiek you can reasonably expect the same into any new dev job you go into. Seniority becomes meaningless when everywhere has a new, HORRIBLE way of doing things.
@Cybertrash @bobstechsite @rysiek So basically the problem isn't that we don't have enough time to teach programmers how to do things right, but that whatever we teach them, their employer will still require them to do things in a new HORRIBLE way, i.e. wrong.
@Wolf480pl @Cybertrash @rysiek yup. He who has the money rules the world 😂
Fortunately if you have "solutions architects" & project managers on your team they can push back on some of their zanier ideas, as that's what they're being paid for.
But there's not much you can do about legacy cruft unless the client/company you're working for is willing to allocate your time & resources to fixing it.
We do get some autonomy over which tasks we pick up, scoring, etc. But new shinies are a hard sell
@bobstechsite @Cybertrash @rysiek Ok, it's decided, I'm not gonna become a software developer, I'm gonna become a sysadmin.
@Wolf480pl @bobstechsite welcome to the club. As someone who's played both sides of the field prepare to be at odds with both management (who don't know why you need all this expensive crap and expect you to work miracles with EOL hardware) and developers (who don't know why they can't have root access, or random shit at their leisure and why don't we have admin rights at our workstations???)
@Cybertrash @bobstechsite still somehow sounds better than the other option
@Wolf480pl @Cybertrash @rysiek Snap!
I'd have a chat with a few more software developers first before you make any firm decisions though. It's fair to say I've become pretty jaded... 😂
@bobstechsite @Cybertrash @rysiek it's always been more like "I'll try to be a sysadmin, if I don't like it, then maybe software developer"
@Wolf480pl @bobstechsite @rysiek technology is a crapshoot but you often get paid to fuck around with neat toys no matter what you do!
@Wolf480pl @bobstechsite @Cybertrash and you think sysadmins have it better?
Welp.
@Wolf480pl @Cybertrash @bobstechsite that is indeed part of the problem.
And I am starting to think perhaps we do need some regulation to fix it.
Warranty and liability for bugs in closed source software could be required by law, just like it is for physical products, for starters.
@rysiek @Cybertrash @bobstechsite good luck explaining someone why open vs closed source is relevant.
I'd rather go for paid vs gratis software. If you get paid for it, you're liable. Or sth.
@Wolf480pl @Cybertrash @bobstechsite explanation is not that hard, been doing this for a while.
Whereas "paid vs. gratis" means:
1. FLOSS that is supported financially falls under the liability and warranty requirement
2. closed source software with business model around services instead of product does not.
Not the outcomes I am thinking of.
@rysiek @Cybertrash @bobstechsite So are you saying that if I pay a developer to write FLOSS for me, and there are bugs that affect me, they shouldn't be liable? Would it work the same if I paid someone to build a road?
@Wolf480pl @Cybertrash @bobstechsite the reasons why I am considering this particular way of slicing the cake are:
1. With FLOSS security audits are easier, so is sending patches, and even fixing the bug internally.
2. Adding warranty and liability requirements to FLOSS could potentially kill FLOSS altogether. Many projects are small, one-person operations that do not have the resources to deal with that (but community helps)
3. It would be a way to push more software into open licensing
@Wolf480pl @Cybertrash @bobstechsite the road analogy is very imperfect, since when you pay someone to build a road that person doesn't retain control over and rights to said road after construction is finished.
They cannot easily replicate the built road however and wherever they wish, also.
@rysiek @Cybertrash @bobstechsite as for outcomes, I think that if you make it so that "liable iff closed-source", the outcome will be:
1. small companies will create tons of shitty open-source software nobody will want to look at
2. codehouses will be like "yes, we can write it as open-source for your company, but then you don't get any warranty, you sure want this?"
3. open-source will become generaly regarded as lower quality
@Wolf480pl @Cybertrash @bobstechsite opens ource is generally regarded as lower quality already, by anyone from outside the broader hacker community. Sadly.
Re. 2. right now there is no way to get the warranty anyway. So that would actually be an improvement.
Re 1. Tons of companies are already creating shit-tons of crappy FLOSS. Nothing changes here.
The change to me would seem to be that closed source would come with a warranty, and *some* stuff would get opened. Win-win.
@Wolf480pl @bobstechsite @Cybertrash certainly, and we do get a bit better wiht each iteration.
However, immense amounts of energy and time go into re-writing all the libraries into the new language du jour, while clearly not enough goes into securing stuff.
That's something that bothers me, even though obviously nobody is saying we should stop working on newer, better languages.
@rysiek @bobstechsite @Cybertrash
>we get better with each iteration
sounds like a quote from Matrix: Reloaded.
@rysiek spoiler alert: the real security vulnerabilities are abusive human beings 🤷
@rysiek agreed. Every time something like this comes to light it means we can improve.