Hacker News Reader

Comment by purplemoonx | Hacker News Reader

[dead]

I was at a much smaller YC company when I found that AWS root credentials were checked into the repo, purely for S3 file uploads for logos. When other engineers and I brought it to the CEO (he required infrastructure stuff get brought up to him first), he handled it with zero urgency and didn't see why it was a big deal.

I explained to him how the EC2 instances would assume the role that already had the permission and it took so long to convince him.

Needless to say, we had to explain lots of basic security and networking concepts to him, which he wouldn't believe until given live demos of basic things like public versus private IP addresses in AWS.

At a few companies I've worked at, they squelch this kind of bug/security breach reporting by immediately making it the discoverer's job to fix the problem and champion it through the system to production, taking on all responsibility if something breaks of course. You only have to go through that once to get the message.

More proof that software engineering isn't real engineering. If a civil engineer made a mistake that bad in my country, he'd likely lose his engineering licence.

I studied physics, did a PhD and postdoc, the whole science shebang. When I got into software development a few years ago, I was put into a well functioning pizza sized team that developed an internal app for another company. The crew was as software-dev as it gets,:

- one architect who was there from the apps inception yen years prior, who knows all the ins and outs of the application - one project lead, who was with the project two years, who could also code in the classical sense, but was mostly the connection to the customer - a tester who could not code, but also knew the app in and out (from the user perspective) and found things or relayed and reproduced bugs reported by the customer - a technical writer who could also code (somewhat), but was more responsible to think of user behavior, undefined app behavior, edge cases, logic issues etc - and several disposable code monkeys, who were exchangeable and expendable, who did most of the tickets. I joined as one of these

The work was great, the team functioned great and we delivered what the customer wanted. But what really struck me was that software dev is not science, or engineering, or an art form, it's most akin to a trade like plumbing or carpentry. I had computer science as minor in university and pretty much none of what I learned there helped for "real" work. I learned SVN in university, but obviously the team used git. And all of the software development and programming courses I did taught me nothing of how real software is structured or how a team works.

That impression only more strongly once I had to train new hires, PhDs in comp science, who knew basically nothing about real software development.

Again, it's a trade, something you learn on the job from someone who already knows it, like a master carpenter.

Heh, that idea resonates with me. I’ve been contemplating some projects that will require pulling permits, and as part of that process have been trying to understand how an engineer reviewing my submitted plans would think.

While you could absolutely generate a list of compliance checks to execute like a formula, at the end of the day you need to have absorbed enough experience that, when presented a physical or imagined project, your brain is immediately able to make connections between what it sees and the general principles of how you build something correctly.

Since I don’t have that experience, I know I need to stick to the well-trod path. No clean-sheet deck construction methods for me. :)

Software lost that status in the vibe coding era. It's an art form now, not necessarily something worse or easier, just different than engineering. But probably not the career path anymore for those who prefered math over philosophy in college.

It was this way well before vibe coding. Over a decade of zero interest rates combined with talent wars and other anticompetitive behaviors by large tech companies did the industry in.

Software engineering has always had that perception, long before vibe coding. Also you might call it an "art" but most normal people will not see it as such (if you actually care about defintions, in theory we can call anything anything if we want)

Amusingly i specialized in both AI and philosophy in college. Guess I'll be ok.

Software never had that status. I was disgusted by the decline I could see in the 90s even, and I was a teenager, I had no clue and still don't. I cannot imagine how it must be for people who do have a clue. They're probably all drinking.

Of course it's not real engineering, and most software development never was real engineering.

Trying to apply real engineering licensing ideas to software would just result in the word "engineering" no longer being used in the vast majority of cases. If that's your goal, then sure, great. But it won't stop ridiculous security mistakes from being made, they'll just be made by people with different job titles.

If a civil engineer made a negligent mistake that bad which "made it to production", rather than being caught before the structure collapsed, he would spend a decade in prison for negligent homicide.

https://www.constructiondive.com/news/contractors-sentenced-...

https://www.reddit.com/r/AskEngineers/comments/cjpva1/is_it_...

https://www.monitor.co.ug/uganda/oped/commentary/it-s-a12-ye...

To be fair, if the story in the comment you are replying to is actually factual and the company is found to be leaking private information on this scale, it can face pretty harsh legal consequences.

> I digress, the CTO didn't respond because he was more worried about how it would make him look. This industry is dead - the wrong people work in it.

The main problem is that the IT industry for a loooooooong time "self-regulated" itself, the only areas that did have regulation had it come in externally (i.e. automotive, aeronautic, astronauts and maritime). Only in the last years, GDPR + insurances forced a bit of change and accountability, but still, it's far removed from the standards that company owners, workers and planners are held to in construction (licensed engineers), legal or medical practice. Mess up there and everything can happen from fines over a license suspension to a permanent removal, or even jail time.

In contrast, mess stuff up as a CTO and you'll probably be "asked" to voluntarily depart in exchange for a nice golden parachute.

Many SWE teams don't care about security. Even talking about security annoys them. I get it though. I've had offensive security training at uni (VUSEC Amsterdam). It's a way different type of thinking.

I hate hearing about security because I saw orgs decimated by paranoid (and incompetent) security to such degree that nothing could be done there and I had to look for a new job.

unfortunately, that just how organization was

Reply on news.ycombinator.com