I have an email in my inbox just this morning from a developer with the magic phrase “I just want to…” in it.
I mentally auto complete the suffix as: “disregard security requirements, ignore best practices, cut corners, do the needful at someone else’s expense, etc…”
There is no scenario where the rest of the sentence is “…do the right thing.”
I get an email like this weekly at a minimum.
This one is asking to punch an unauthorised, unauthenticated, unaudited path from the Internet to legacy servers on the network that will go end-of-life in a month. Exposing the gooey vulnerable insides of a huge network to direct attack.
I’ll politely refuse. He’ll just go to someone else, who won’t refuse.
You can assume the same scenario plays out every few seconds world-wide. It might be code review, or using a hard-coded credential “just for now”, or whatever.
This is the typical reality of software development. From what I’ve heard, embedded and industrial control software is worse still.
I mentally auto complete the suffix as: “disregard security requirements, ignore best practices, cut corners, do the needful at someone else’s expense, etc…”
There is no scenario where the rest of the sentence is “…do the right thing.”
I get an email like this weekly at a minimum.
This one is asking to punch an unauthorised, unauthenticated, unaudited path from the Internet to legacy servers on the network that will go end-of-life in a month. Exposing the gooey vulnerable insides of a huge network to direct attack.
I’ll politely refuse. He’ll just go to someone else, who won’t refuse.
You can assume the same scenario plays out every few seconds world-wide. It might be code review, or using a hard-coded credential “just for now”, or whatever.
This is the typical reality of software development. From what I’ve heard, embedded and industrial control software is worse still.