Hacker News Reader

Comment by avgDev | Hacker News Reader

Because by keeping it closed, it is safer. /s

Most executives care about profits, security is simply not important. Even if an engineer explains that he needs more time to properly secure something, he will be asked to cut corners. Then, when shit hits the fan the executive will make a "pikachu face" and engineer will get fired for not properly implementing security.

View on HN

Having met a fair number of top executives I don’t feel this is true. People at the top do care quite a bit, and put personal pride into their company being good. But all low level decisions are made downstream, and middle managers are far less personally invested. Reactions to bad press are reactions. Hard to say whether it reflects anyone’s reality.

Leadership starts at the top. If middle management is making bad decisions, the fault rests with their superiors.

Hmm sounds reasonable but I think not. Management is hard and information is imperfect to all actors. With a god like view you would probably conclude that there’s a variety of people who should be removed from an org for its health and performance. The top may be accountable for things, but I wouldn’t think it’s correct to blame them personally

They are good at giving lip service but I rarely see anything more than that given. When it comes to budgets and hiring, one might say when it comes to putting their money where their mouth is, then you see how much they actually care.

From everything I've heard, this changed around 1997-2001 when Boeing merged with McDonnell Douglas and moved their headquarters 2000 miles away from their engineers. Old Boeing (the first 80 years) was run by aerospace engineers. New Boeing is not.

The real reason is that there’s realistically only downsides for the company. The public doesn’t know what “responsible vulnerability management program” means, but they certainly know what “major vulnerability found in Boeing code” means. So doing that will only mean they gain nothing, or take reputation hits.

Open sourcing the codebase doesn’t mean that all it’s vulnerabilities will be discovered, and it’s certainly not the only way for a company to manage them. Out of all the options that are available, it’s really one of the worst ones from the company’s perspective.

Reply on news.ycombinator.com