Hacker News Reader

Comment by PedroBatista | Hacker News Reader

Unfortunately most of the "hard" work will be metrics massaging, redefining words and covering stuff.

But the first phase will be a lot of "security & quality" presentations to the troops, some hiring and ground prep-work so the blaming can be done when things go south.

I would like to be more positive, but I already saw this cycle too many times.

How about security being part of the requirements to keep a job instead of monetary bonus? and this has to be applied to the top, only then to the bottom.

View on HN

If the person was notified of a security problem, and ignored it, or tried to sweep it under the rug, instead of taking it seriously, then absolutely fire them, but assuming no malfeasance, firing people just leads to institutional knowledge loss which would lead to worse outcomes.

I was talking about executives and high ranking managers, not devs. Firing someone for a bug or honest mistake would be ridiculous.

Executives and high ranking managers might not be people to you, but they also have invaluable institutional knowledge that will lost if they get fired.

Creating fiefdoms and executing layoffs isn't really invaluable institutional knowledge.

Thousands of new MBAs are minted each day, practically a commodity at this point.

> assuming no malfeasance, firing people just leads to institutional knowledge loss which would lead to worse outcomes.

You should meet my director who wants everything to be covered under the rug while he focuses on empire building.

Strongly disagree. If it was an executive fired for ignoring a security issue then no institutional knowledge would be lost. That's in engineering.

We work in a glass factory. Everyone is going to break something sometime. And it's the job to structure it so it isn't too much.

We are talking executives here, it's their job to organize teams and work in a way to achieve stated objectives. This is reality for every higher-up position and one of the reasons they are the way they are, etc.

I see some devs thinking I was talking about them and getting defensive :) It's not a "we discover a bug, we fire you" situation, that's ridiculous.

For huge mistakes sure. But unless people even top of the chain are more worried about fixing the problem than looking good you have a recipe for disaster.

I cannot speak for everyone, but in my neck of the woods there are specific deliverables like locking down server access more, removing poorly secured test accounts and older auth methods in general, locking down network in terms of what can access what, cleaning up dependencies, etc. There's a list of about 20-30 things that are to be measured automatically and driven to ~0.

>How about security being part of the requirements to keep a job instead of monetary bonus?

Because the monetary incentives are greater than the position for executives, and they are the ones to be accountable.

Of course this is a form of lip service. Of course there's way more to do. But they are making a very public statement to prioritize security. That's a positive.

Reply on news.ycombinator.com