News for hackers. Stuff that matters.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by arkitaip on Thursday March 21, 2019 @12:28PM (#19454201)
Corollary: Most web development simply lack the rigor of engineering.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by mfoy_ on Thursday March 21, 2019 @03:49PM (#19456503)
A lot of HNers probably have the job title "software engineer" without any of the qualifications of an "engineer"... that's probably why you're being down-voted.

But you're not wrong.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by toomuchtodo on Thursday March 21, 2019 @12:34PM (#19454264)
Most software engineers aren’t. Engineering requires licensing and exams through a governing body. Can’t have the prestige of the title without the responsibility. Software developers want to have their cake and eat it too (power and respect with no oversight and governance).

Pile on the regulation (GDPR for starts, more PII protection to follow up, extremely painful fines for failures).

Re:Facebook Stored Hundreds of Millions of User Passwords in... by jjeaff on Thursday March 21, 2019 @01:02PM (#19454621)
In the US, you only need certifications and testing for a "professional engineer". Most electrical, chemical, mechanical, or civil engineers are not certified PEs. Yet I don't think anyone is claiming they aren't engineers.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by tsbertalan on Thursday March 21, 2019 @03:34PM (#19456382)
I have a PhD in chemical engineering, but not a PE, since I didn't go the industry route. I wouldn't feel comfortable calling myself an Engineer without it, and that was the attitude expressed by my professors and cohort coming out of undergrad.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by mfoy_ on Thursday March 21, 2019 @04:00PM (#19456615)
It's my opinion that the title "Engineer" should be on par with things like "Doctor" or "Lawyer". It should require certification and there should be consequences for claiming to be one if you aren't.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by mcbits on Thursday March 21, 2019 @08:49PM (#19458772)
I don't think anyone would get in trouble for job titles like "computer doctor" or "network protocol lawyer". Practicing medicine or practicing law (or in some cases, practicing as an engineer) without the required qualifications, regardless of job title ... different story.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by balls187 on Thursday March 21, 2019 @02:15PM (#19455531)
> Software developers want to have their cake and eat it too (power and respect with no oversight and governance).

This doesn't come from software developers.

This comes from the SV culture of "move fast and break things."

Re:Facebook Stored Hundreds of Millions of User Passwords in... by toomuchtodo on Thursday March 21, 2019 @02:25PM (#19455658)
I painted too broad strokes. I agree, and admit my mistake.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by mfoy_ on Thursday March 21, 2019 @03:53PM (#19456541)
Just replace "software developer" with "self-proclaimed software engineer" in your comment and you'd be spot-on.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by balls187 on Thursday March 21, 2019 @04:15PM (#19456785)
Nothing about engineering really covers security best principles and practices.

I went through classical engineering school, and I'd summarize with three categories:

* Newtonian Physics & The Mathematics Behind It (i.e. Differential Equations)

* Ethics

* Technical Communications

Re:Facebook Stored Hundreds of Millions of User Passwords in... by mfoy_ on Thursday March 21, 2019 @04:48PM (#19457156)
That's because there is no software engineering program, and other engineering programs don't deal with "security" per se.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by balls187 on Thursday March 21, 2019 @08:26PM (#19458660)
My alma mater offers a degree in Software Engineering.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by jammygit on Thursday March 21, 2019 @09:08PM (#19458858)
I think that was actually invented at Facebook in the early days, unless I'm mistaken. Its a good mantra unless its security related
Re:Facebook Stored Hundreds of Millions of User Passwords in... by vonmoltke on Thursday March 21, 2019 @01:51PM (#19455237)
> Engineering requires licensing and exams through a governing body.

Offering engineering services to the public requires licensure. Working at places like Boeing, General Motors, Texas Instruments, and Caterpillar does not (for the vast majority of positions); It just requires an accredited engineering degree.

Note that this is independent of the software industry needing more engineering rigor, which it desperately does.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by EnFinlay on Thursday March 21, 2019 @12:45PM (#19454402)
I couldn't agree more.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by gridlockd on Thursday March 21, 2019 @01:03PM (#19454643)
> Most software engineers aren’t.

"Software Engineer" is just a job title.

> Engineering requires licensing and exams through a governing body.

"Software Engineering" doesn't, it's just a job title.

> Can’t have the prestige of the title without the responsibility.

There is no real-world prestige associated with having "Software Engineer" as a job title (as opposed to "Software Developer").

> Software developers want to have their cake and eat it too (power and respect with no oversight and governance).

"Power and respect" is not actually something that is commonly associated with a guy sitting at a desk for a salary.

> Pile on the regulation (GDPR for starts, more PII protection to follow up, extremely painful fine for failures).

You just learned that Facebook stored passwords in plaintext for years and nothing bad happened. In fact, it's hard to conceive that anything particularly disastrous could have happened. Yet, you call for more regulation that will drive up costs for everything. Whole industries could become unprofitable and those high-paid "Software Engineers" would become redundant.

I have the opposite opinion: The fact that computer security is generally poor teaches people how to properly use computers. They need to assume that there are no secrets, because that is the plain reality. No amount of regulation will make computers secure. No certification or best-practice encryption scheme will prevent users from writing their password on post-it notes, or from opening "sexy.jpg.exe", or from answering that call from the "Microsoft Service Center".

Re:Facebook Stored Hundreds of Millions of User Passwords in... by mfoy_ on Thursday March 21, 2019 @03:44PM (#19456459)
In Ontario the Professional Engineers (http://www.peo.on.ca/) crack down on unlicensed use of the "Engineer" word in job titles pretty aggressively.

The point is that the public should have confidence in engineers. Software developers who tout themselves as "software engineers" actively piggy-back upon, and undermine this confidence. It's malicious, and you should feel bad for defending the practice.

If you still don't see why, "Lawyer" and "Doctor" are "just job titles" but obviously that's a problem. I trust you can see that.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by gao8a on Friday March 22, 2019 @10:38AM (#19462902)
I believe there are exceptions like the "Combat Engineer" in the Canadian Forces.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by gridlockd on Thursday March 21, 2019 @06:50PM (#19458139)
> In Ontario the Professional Engineers (http://www.peo.on.ca/) crack down on unlicensed use of the "Engineer" word in job titles pretty aggressively.

Yeah well, good for them I guess. I don't think anybody else cares.

> The point is that the public should have confidence in engineers.

Why? "Engineer" is a very broad term used in a variety of occupations for very different things. If you're looking at someone's credentials and you're so uninformed that you can't tell the difference between a licensed engineer in a particular profession and a guy that has "Engineer" written on their business card, you're not qualified to make a decision either way.

> If you still don't see why, "Lawyer" and "Doctor" are "just job titles" but obviously that's a problem. I trust you can see that.

I can see the argument for why a medical doctor or a lawyer should be afforded some amount of protection, because they are directly dealing with laymen. I don't buy the same argument for the word "Engineer", much less "Software Engineer". It just doesn't really mean anything. We already have degrees and certifications for when specifics matter.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by jammygit on Thursday March 21, 2019 @09:17PM (#19458890)
In Canada, the term engineer is protected, but in the states it is specialization dependent. I went to school for software engineering and I have my ring (I'm not a full engineer for a few more years though).

We focus a lot on testing and I just finished a mandatory ethics workshop. Its a different approach to software than I read about elsewhere. Almost no time spent on algorithms either - bad for interviews, but great for being able to write software that works though.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by darkpuma on Thursday March 21, 2019 @02:25PM (#19455660)
> "Software Engineer" is just a job title.

And like the job title "sandwich engineer", it should probably be derided.

Apologies to anybody working in the honorable trade of sandwich crafting. I love sandwiches and appreciate your work. They bring me much more enjoyment than software.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by randomdata on Thursday March 21, 2019 @03:35PM (#19456389)
I agree. The job title is literally _engine_er. Unless you oversee the operation of engines (as in locomotives), you are not an engineer.

But seriously, the definition of engineer in regular lexicon is someone who designs, builds, or maintains complex systems. I struggle to think how software does not tick all of those boxes. Sandwiches are a different story.

Perhaps you are confusing engineer with professional engineer? I can see how it might be easy to mix them up if you are not paying attention, but professional engineer carries a different meaning. Most software engineers are not professional engineers but are unquestionably engineers.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by kevin_thibedeau on Thursday March 21, 2019 @04:00PM (#19456624)
The word engine signifies a product of ingenuity. A siege engine is a clever device to attack fortifications. Engineers don't just have to be engaged with engines in the modern sense to do engineering. The PE bureaucracy is just gate-keeping by the guild masters.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by darkpuma on Thursday March 21, 2019 @05:06PM (#19457321)
A 'software engineer' need not even have a college degree, the only qualification for calling yourself a software engineer is finding an employer willing to give you that title. Even non-PE mechanical engineers at least have the bare minimum decency to get an undergraduate engineering degree before calling themselves engineers.

Of course, some people get software engineering degrees, or computer science degrees (that term is another can of worms entirely), but that is not the rule.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by mfoy_ on Thursday March 21, 2019 @03:47PM (#19456491)
It becomes a meaningless word if anyone can just call themselves one. There has to be some standard, some governing body, some degree of rigour applied here.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by randomdata on Thursday March 21, 2019 @08:59PM (#19458814)
> It becomes a meaningless word if anyone can just call themselves one.

Only to the extent that all words are meaningless. However, we keep a reference known as a dictionary that helps maintain some consistency around meanings of words.

The Oxford Dictionary defines engineer as:

1. A person who designs, builds, or maintains engines, machines, or structures.

2. A person who controls an engine, especially on an aircraft or ship.

3. A skilful contriver or originator of something.

Is software an engine, machine, or structure? That is debatable, although I would suggest that it does meet the definition of machine. Under that suggestion, software engineer is a perfectly appropriate term. Designing, building, and maintaining is exactly what software engineers do.

If you disagree that software falls under the definition of engine, there is still that third definition. Is software created by a skilful contriver or originator of something? I think that is a definite yes.

> There has to be some standard, some governing body, some degree of rigour applied here.

Professional engineers are expected to display those things. That is unrelated to engineers. Different terms with different meanings. Software engineers may not be professional engineers, although they can be.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by darkpuma on Thursday March 21, 2019 @10:26PM (#19459157)
> 1. A person who [...] maintains engines, machines, or structures.

So we should call car mechanics "mechanical engineers"? And maintaining structures? With all due respect to the janitors out there, their job is vital to society but it's not engineering.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by randomdata on Friday March 22, 2019 @02:49AM (#19460145)
> So we should call car mechanics "mechanical engineers"?

By definition, I don't see why not. I suspect the spirit of maintain may be a little more nuanced, but words are fluid and if someone wants to interpret it that way, then it is so.

> With all due respect to the janitors out there, their job is vital to society but it's not engineering.

If by janitor you are thinking of someone who sweeps the floors, I think that is well beyond the spirit of maintain. That, to me, is cleaning.

Maintenance of a structure is more like addressing a beam that is cracking. I doubt that is a role that an average janitor deals with, and in many cases will legally require a professional engineer to spec the resolution.

But words are fluid, so if you interpret a janitor as someone who maintains a structure, then I guess engineer fits. It really makes no difference either way.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by EnFinlay on Thursday March 21, 2019 @04:09PM (#19456709)
Professional engineers do engineering.

Title only engineers work on complex systems.

This distinction has largely been lost and most "Software Engineers" think they are doing PE Engineering when they are not.

Re:Facebook Stored Hundreds of Millions of User Passwords in... by michaelmrose on Thursday March 21, 2019 @06:30PM (#19457998)
Do you think that if someone calls themselves a sandwich engineer people will begin to believe that designing cars is like makings subs? Do you really think the public can't tell the difference?
Re:Facebook Stored Hundreds of Millions of User Passwords in... by EnFinlay on Friday March 22, 2019 @12:15PM (#19463991)
I think "Software Engineers" can't tell the difference.
Re:Facebook Stored Hundreds of Millions of User Passwords in... by hombre_fatal on Thursday March 21, 2019 @03:27PM (#19456317)
Same with electrical, chemical, mechanical, and civil engineers since almost none of them are PEs?

Seems a bit silly.