Hacker News Reader

Comment by fortran77 | Hacker News Reader

This is like bugs we used to see on "MySpace". Is Apple unable to hire good people anymore given their current corporate culture?

View on HN

Apple hires top hardware engineers, good software engineers, and ok web engineers.

> ok web engineers

How are engineers who introduce XSS issues on production systems "ok" in 2021?

Makes me doubt the rest of your statement too. But mainly because I'm actually a Apple user myself so I know for a fact that neither the software nor the hardware people to be "top".

I can only assume they mean "ok" in the sense of "the large fraction of less-sophisticated engineers who only want to think about the happy paths in their code."

Github's co-pilot is a poor code generator, but it's a fair example of how bad a lot of public code is. I'm not sure private code tends to be much better in many orgs.

Apple outsources web development to low cost centers as well.

Honest question: are these the results of the seemingly industry-wide push to axe QA departments?

I work in QA at one of the BIG ones on hardware/software, and you would be scared how little top backend/frontend devs care about security, other than pluging in some common solution. I'm right now detecting vulnerabilities, I'm running test cases, writing reports with clear descriptions and screenshots of the holes in the system, and yet I'm pretty sure all of that will go into the managerial sewer because they don't want to take the costs of solving it. But I'm sure if I point to the company/project I'll be kicked out of my job.

I’ve worked on contracts for data integration projects for both financial and healthcare providers. There is a shocking lack of concern about code correctness, security, privacy, etc. And code quality? Pshaw, just pump out a solution, even if it’s a nasty hack instead of a well-considered solution.

Probably not. QA can't really stop devs from shipping buggy code (depending on release pipeline/processes). Of course a top-notch security team should have audited these services and the infrastructure around them, considering it's Apple...

Yup, My experience has been usually needing to give QA a list of strings with SQL / script injection. As well as Unicode strings with characters outside the BMP tho emojis now usually cover that case.

Which culture is that?

Reply on news.ycombinator.com