Hacker News Reader

Comment by mr_toad | Hacker News Reader

If your company bases security decisions on articles in the NYT then they’re beyond helping. Frankly that’s both laughable and incompetent.

No professional (in any field) should base a decision solely on something written in any secondary source. Even if it was a specialist publication, a competent professional should do their own research, and look at the primary sources.

Imagine if a doctor or civil engineer based professional decisions on what they read in magazines and newspapers. The thought is horrifying.

The problem is not that the NYT article is factually incorrect (if in fact Jet Brains were being investigated, which seems plausible). The problem is that anyone who’s reasoning skills exceed that of a five year old child should realise that there is a good possibility that the investigation would turn out to be a red herring.

View on HN

> The problem is that anyone who’s reasoning skills exceed that of a five year old child should

The problem is that many companies have lots of clients that don’t have this reasoning capability. The reputation damage is much worse than the actual harm if you’re a “known contractor compromised by Russia” or whatever the dumb narrative is. It’s literally easier to drop it immediately “pending investigation”.

Is it really that obvious? If a company gets a bad rap for being insecure, is it rational to go for them? Sure, you should do your due diligence, when picking any solution, but it's certainly a factor which could discount someone from a shortlist.

You're not always the one to make a decision. When you are, there are a number of stakeholders who can influence your course of actions, and when solutions are similar enough, it is easier to take the path of least notoriety.

The "rap" in this case is entirely artificial. There's no evidence TeamCity is insecure, or at least, no more insecure than any other CI system.

In our field it is actually a reputational risk issue, but you're right. The fact they couldn't come up with a better solution than banning Jetbrains doesn't speak well.

I’m a 100% with you, but this is unfortunately not how people in many companies operate. The fact that organizations like Gartner and any one of the Big 4 exist proves that people are very much in the habit of transferring their decision-making risk onto another party.

> No professional (in any field) should base a decision solely on something written in any secondary source. Even if it was a specialist publication, a competent professional should do their own research, and look at the primary sources.

> Imagine if a doctor or civil engineer based professional decisions on what they read in magazines and newspapers. The thought is horrifying.

No, I really really don't want doctors looking at primary sources. They don't have time to find and read all the sources, and they tend not to have expertise to understand specialist papers.

I would much rather we have organisations like NICE or Cochrane who employ experts in evidence based medicine to gather and précis the science and come up with recommendations for assessment and treatment.

The doctors however absolutely should not based their decisions on NYT.

I'm not sure I agree. I'd much rather that doctors base their decisions on what they read in publications in their field rather than do their own research.

> Imagine if a doctor or civil engineer based professional decisions on what they read in magazines and newspapers. The thought is horrifying.

Naaah, don't worry, doctors are only basing their treatment on what their most obnoxious patients are requiring, based on things they have read on Facebook and Twitter. (I mean, how can you trust journalists ? As the linked article says, those people are "wrong" , too.)

Reply on news.ycombinator.com