Hacker News Reader

I would bet that a developer knew of the security issues, but was vetoed by Product.

The usual case for software development the last decade is developers who don't fully understand what they're doing, and are mostly focused on resume-driven-development (RDD) and looking good in Agile sprint standups.

Noteworthy exceptions: FAANG promotion bid orientation, and VC growth startup alignment towards shipping something to look like growth towards exit.

In a small minority of cases, you have developers who know what they are doing, and are thinking rigorously.

The norm isn't big-meanie Product making (forthright, courageous, photogenic) developers ship negligent security vulnerabilities, against developers' protests. Developers are at least as much responsible as Product.

Not getting time to do security because we need to ship v1 is a decision called by Product

If you know of a developer who would've done responsible security, but was pushed to ship instead, against their protest, I'd be happy to hear that.

In my experience, Product is always the first one to suggest cutting corners.

Part of the job of Product is triage on all sorts of things.

But I don't think there's hardly any developers who would've done something securely but didn't because Product said no.

Reply on news.ycombinator.com