Hacker News Reader

I've admittedly not worked on a project team as large as the ones you'll find at Cisco, but a lot of the time it comes down to deadlines and a team biting off more than they can chew rather than active maliciousness. Never attribute to malice what can adequately be explained by stupidity, and all that.

View on HN

If software with backdoors in it makes it past QA there is something fundamentally wrong with the processes in the company.

Not so. The company processes are responding to a marketplace which allows products to ship with minimal security effort, thereby translating poor security into profit thanks to a more or less uninterested public. Nothing will change until legislation. For many kinds of companies they in fact cannot change until legislation.

"There are two things I am sure of after all these years: there is a growing societal need for high assurance software, and market forces are never going to provide it." - Earl Boebert

Ross Anderson has a good reply to your statement in the 7th chapter of his book, 'Security Engineering'. [1]

[1] https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c07.pdf

Reply on news.ycombinator.com