Hacker News Reader

What do you do with a 20 year old embedded Linux system which still "works" and where management has been saying they'll replace it for more than ten years but meanwhile don't touch it, and, oh yeah, "make it secure"? I can actually imagine somewhat exotic network firewalls that would be sufficiently secure (might even be a fun project) but there's zero provision for the required effort.

View on HN

I characterize refactoring as an exercise in staying familiar with the code. With security we talk about data at rest versus data in motion, which is a hard problem. You can stare at code a lot and think you understand it, but when you see it actually run it's a different experience. Poking at things teaches you a lot faster and more deeply than treating it like a religious artifact.

>meanwhile don't touch it, and, oh yeah, "make it secure"?

Yeah never take such a job, this is the manager trying to screw you.

Security is a big word, from stability to observe-ability to hack-ability, there is no way to secure a system without touching it.

Reply on news.ycombinator.com