Hacker News Reader

>They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand.

And don't forget the universal elixir that cures all security ills: adding even more rules about which passwords are allowed.

Make sure you change your password every 30 days, too. That way I have to write it down, or use a sequential password just in order to be able to remember it.

No worries, though: if you forget your password you can just call up IT and get it changed to "welcome1" :)

"Your password is too similar to one of your previous 24 passwords" -- an actual error message I've gotten before.

Google started doing this. I spent an hour changing my password literally 100 times to clear their cache of the password I intended to set. It's insanity.

> Furthermore your average engineer wouldn't eat a ham sandwich handed to them on the street by a stranger

We would however eat one provided by a café that our colleagues recommended.

That's true, and a good point, but a big part of that trust comes from the knowledge that no one can run a café without some kind of oversight and inspection on food safety.

I probably wouldn't eat a sandwich from a bootleg café.

Define "bootleg."

http://heartbleed.com/

s/bootleg/unlicensed/g

I would if the alternative was to grow all my own food.

Or one from the company cafeteria. I’m not sure if this is the point you were making, but trust, insight and ability to get things done is quite different when working internally in an org versus working with an outside-org, and it’s a big deal.

My biggest burnout was when internal teams I worked with started to feel like external teams. That was more about engineering teams but another example: I strongly discouraged internal IT from adopting vendor/client language and mentality.

Relationships like that put them on the back foot, become defensive, and when you encounter problems the sense of being able to honestly ask what’s actually going wrong here? evaporates.

> No one in management wants the expense or the overhead of actual security. They want the "theater" of security, the good feeling, the box to check on their resume (as management) so everyone can pretend everything is fine and go back to the business at hand. Then something real happens, a leak of user data, or credit cards or internal memos... suddenly everyones job is security and no one knows what to do. The last problem gets solved, there is more "theater" and a few quickly forgotten changes that get worked around or just ignored in the long run.

The incentive is that if every box was checked and shit hits the fan, insurance is on the hook to pay for stuff and not the company or the responsible party.

The biggest checkbox in any project/contract/initiative is the one marked "Plausible Deniability." Mgmt often goes by another dictum "Success has many fathers, failure is an orphan."

Almost everything anyone does in business, as far as I can tell, is dramatically optimized for speed at the expense of almost everything else.

This is a natural result of a very competitive market place and, as far as I can tell, its rational if you take that circumstance to be an immutable state of affairs. Its no good stopping to dot the i's and cross the t's if, in doing so, you get completely edged out of the market by a competitor who isn't doing so. And you haven't even made the world a better, safer, nicer place by doing so. You've just left the door open for someone less scrupulous to beat you with a shittier product.

The solutions aren't palatable in the current philosophical mode: much more aggressive penalties (corporate death penalties, for instance, in which shareholders literally lose all their money) or much tighter and well enforced regulations. Move fast and break stuff truly is the philosophy of the day.

If you don't want to break stuff, you have to make moving fast less competitive. As far as I can tell, that's the only way.

> If X is less than the cost of a recall, we don't do one.

We didn't take into account loss of sales and reputation, the equation is not (should not) be that simple

It's a movie quote.

For those who didn't get the reference:

The OP is quoting Tyler Durden, a fictional character of the movie 'fight club'. So take it with a grain of salt.

That is indeed fictional, but the real world Ford Pinto that was based on is real [1].

1. https://www.tortmuseum.org/ford-pinto/

Or, take it for what it is, a quote from a movie.

But don't dismiss the merits of the idea. It's essential Risk Management[0], which is most certainly a relevant part of Information Security. Specifically, this is a form of Cost-Benefit Analysis (specifically, Qunatativie Risk Analysis[1]), a critical component in proper Risk Management; the reality is you cannot "fix" every issue.

Take a look at methods like Single Loss Expectancy[2] and Annualized Loss Expectancy[3]; you'll find that the Fight Club quote is very close to the real-world methodology. I cannot speak for the Automobile Insurance industry, but given Insurance is founded in Risk Management, it seems likely to be closer to reality than not.

[0] https://en.wikipedia.org/wiki/Risk_management

[1] https://csrc.nist.gov/csrc/media/publications/conference-pap...

[2] https://en.wikipedia.org/wiki/Single-loss_expectancy

[3] https://en.wikipedia.org/wiki/Annualized_loss_expectancy

Fight Club is referencing to a real document made by Ford, the "Pinto Memo"

The quote is resonant because anybody with first hand experience with the way "corporations" think internally about such matters KNOWS that this is EXACTLY how it plays out.