Hacker News Reader

Comment by forgotaccount3 | Hacker News Reader

> I have to imagine the vast majority of normal developers do not give a damn about security in being in security patch lifecycles on software.

I just don't think it's the developer's responsibility.

Depending on the size of the team of course, but the work that developer's do comes from someone else. Empower me to make decisions and I'll make them, but don't blame me for the choices other people make if you won't empower me.

View on HN

I think I get where you're coming from. I've worked mostly on small teams (sub 30) so it's always been on us. The engineering leadership never prioritizes security unless it's something as big as the log4J stuff because it was on customers' minds.

That said, if they're software packages from something like Node or PyPI, I do think that it falls on the developer. If the point is that leadership needs to give devs the ability to act on that, that's very fair.

That's the problem with the tech industry. Nobody gives a fuck.

When a doctor makes a mistake they get to practice medicine in Peru for the rest of their life.

Exactly. It's not the bricklayer's responsibility when mortar fails. It's the person who specified that mortar.

So I'd agree it isn't not a coder or developer's responsibility when they're given a bill of materials and told how to build, but it is an engineer's responsibility. Comp should recognize that as well.

Reply on news.ycombinator.com