Why are we blaming PMs, here? Plenty of engineers out there make really stupid decisions every day.
(To be clear: I'm an engineer, not a PM.)
EXACTLY! Because it's a known fact all devs make mistakes, and as such, as a product manager/owner you're responsible for the bigger picture of the product and ensuring the right requirements, checks and bound are put in palce and validated for a successful product release.
It's not the job of the lowly SW engineers who have little visibility in the product as a whole and who just sprint to punch out Jira tickets handed to them from above, to check your product works as intended, it's your job as a PM/PO to ensure the work of all the devs integrates nicely into a cohesive product as per the requirements/vision.
Kind of like that famous story of that intern who got fired for deleting the production DB by mistake on his first day. Was it the intern's fault for the mistake or the fault of all the seniors and managers who should have placed the proper checks and bounds in place so that nobody can so easily delete the production DB?
So the buck for the product success/fail stops with those at the top who orchestrate the band, not with the individual SW engineers at the bottom.
You cannot say that the project works because of you, and then turn around and pretend you have nothing to do with its failures.
You'd be surprised. I've been in at least 2 companies where that was the case and had to be the scapegoat for projects going sideways due to poor management.
Humans are shit and would much rather push the blame on someone if the company culture is not blameless.
First, the vast majority of people are not equipped to find or address major security issues well. Unless you have specialists integrated in the right places this means everyone's likely to be bad at the security part of their job and ill-equipped to notice.
Second, this means conflicts of interest everywhere. When you have a dedicated security org, you have people whose job it is to catch issues, hold things up, and generally make sure things get fixed. Without that, you have a bunch of people who have to choose between the possibility of a security event they don't understand and the certainty of blowing a deadline.
Third, security being everyone's job almost certainly means accountability is broken. Consequences will likely fall on some junior employee who might be directly accountable for an issue, but the huge org around them that did not enable them to succeed go unaffected.
You need specialists, an org to enable them, and an enterprise-wide apparatus to support a strong security process.
Nope, not at all.
>Security is everyone’s job
In theory at well run tech companies ideally yes, but when you're overworked and underpaid and crunching like in a sweatshop to meet some arbitrary deadline coming from above that you did not agree with, then work becomes a chore doing the bare minimum just to get home before dinner, and every other potential issue outside my allotted tickets that's not part of my KPIs becomes "not my job" and "someone else's problem" because "fuck it, I'm already overworked and I won't get any extra recognition for doing even more overtime on security topics nobody seems to care about".
In short, as a dev, you don't care about the outcome of the product because you're not paid or empowered enough to care.
Shit rolls uphill. If you want devs to actually give a fuck about the product as a whole instead of just mindlessly punching Jira tickets, then you need to empower them, pay them well and respect them and their WLB, which the vast majority of companies worldwide do not (HNers are a priviledged bubble that's the exception). Otherwise you get what you se before you, a shitshow, because most tech companies are run like crap.
A not unreasonable guess would be that Sunbird doesn't have a great number of senior engineers on staff, either do to cost, or because very few wanted to take on such a project. So it cobbled together by inexperienced engineering that know enough to understand the Sentry is useful, but not experienced enough avoid logging credentials.
Basically all the errors listed in the article just reads like what happens when you set a bunch of inexperience developers and SREs to build a platform that doesn't want to exist. Which leads me to: How the does this even work? I'd assume a massive number of virtualized macOS installation, anything more advanced would sort of negate the incompetence on the security front.
Sort of a side note: I questioned the point of the Nothing Phone and Nothing Phone 2 when they where both released, they are nothing more than Android phones with a few gimmick but everyone was loosing their minds over those things and now ArsTechnica writes: "Nothing has always seemed like an Android manufacturer that was more hype than substance" (and apparently also did for back when the Nothing Phone release. I'm getting so very tied of the hype and how easily any criticism can be reject as me being old and "not getting it".
I think there is a perception issue. Ars is not a person. I don’t know who was hyped when the phone was released, but Ron Amadeo sounds like someone who would indeed have been skeptical about Nothing’s pitch.
However I'd hope this is a case of an overworked team and over zealous management, because the alternative suggests a dangerously incompetent dev team.
So, they're useless?
Product managers should ideally be the technical voice of reason between the tech illiterate visionaries and the engineers in the trenches, steering the visionaries on what's technically feasible within the available resources.