News for hackers. Stuff that matters.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by admax88q on Thursday March 28, 2019 @01:22AM (#19509494)
On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things "properly".

You'd be suprieed at how many incompetent engineers there are out there. If "engineer" Alice in your story was actually competent they would never agree to implement the proposed "fix". Its not a fix. To pass it off as one would be malpractice for a real Engineer.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by nabla9 on Thursday March 28, 2019 @05:23AM (#19510560)
"Engineer" conveys image of middle class white-collar job with relatively high status, good education and responsibilities. That word now used for everyone doing programming related jobs inside office space for no good reason.

I think the word "tehnician" should be used to describe most grey-collar ICT jobs, including most programmers. Their responsibility and scope of their work is limited. Many programming jobs are closer to blue collar factory level mechanic than engineer.

https://en.wikipedia.org/wiki/Grey-collar

https://en.wikipedia.org/wiki/Technician

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by TeMPOraL on Thursday March 28, 2019 @07:43AM (#19511199)
Yup. The reality of this industry is that most programmers are closer to the handymen you call to fix your faucet or lay floor tiles than to actual engineers. And we all have first-hand or second-hand horror stories related to handymen.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by spaceribs on Thursday March 28, 2019 @09:02AM (#19511746)
I've come to the conclusion recently that we're all just barbers, bloodletting and burring holes. Until we have proper certifiable and reproducible competency, we'll never become surgeons.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by PaulHoule on Thursday March 28, 2019 @10:35AM (#19512564)
Don't you need a license to be a barber?
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by spaceribs on Thursday March 28, 2019 @01:10PM (#19514246)
In modern times yes, here's some interesting reading on the guilds licensing originated from - https://en.wikipedia.org/wiki/Worshipful_Company_of_Barbers
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by flatline on Thursday March 28, 2019 @10:26AM (#19512489)
And yet the US has consistently been in the vanguard of software development worldwide. Do we need surgeons? Do you need a four year postgraduate degree and three more years of apprenticeship before slinging together a web app? Certainly the industry has its problems, and some applications demand more rigor, but I don’t see this as much of a general solution.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by spaceribs on Thursday March 28, 2019 @11:00AM (#19512825)
The market didn't demand a high survival rate or efficacy for barbering either, but do you think that the (conscious or unconscious) that software engineers are some sort of magical wizards will last forever?
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by mandelbrotwurst on Thursday March 28, 2019 @08:27PM (#19518027)
There may be explanations beyond wizardry - e.g. maybe barbers were historically often self-employed, small business owners who realized they stood to gain from creating barriers to entry such as licensing requirements.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by pjmlp on Thursday March 28, 2019 @07:18AM (#19511062)
Thankfully there are countries where Engineer is still a proper word, not something that you are allowed to call yourself after a 6 month bootcamp.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by FearNotDaniel on Thursday March 28, 2019 @07:41AM (#19511183)
Yup, in the UK it bugs me when I keep meeting people who introduce themselves as an 'engineer'. When I ask them if they do mechanical or civil engineering, then I usually get to say "ah, so you're a programmer, just like me".

One thing I did sometimes like about being in Austria is the obsession with academic titles they have there... if somebody is a qualified engineer, they invariably use "Ing" as a title in place of "Mr" or "Ms"; people with two doctorates (not uncommon) really do call themselves Dr Dr So-and-so.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by superwayne on Thursday March 28, 2019 @08:57AM (#19511703)
Austrian here. "Ing" (Ingenieur, so basically Engineer) is a protected title (not an academic one, though) but to be honest, it does not signal status or qualification to me. The actual academic titles are worth more.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by Aeolun on Thursday March 28, 2019 @08:55AM (#19511683)
Still doesn’t really mean anything. Due to a loophole in major assignment I can legally call myself Ing., but what I’ve really studied is more or less computer science.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by madengr on Thursday March 28, 2019 @08:15AM (#19511397)
What is qualified in Austria? In the USA, in most states, you must be licensed to have engineering in your business name. Your name is usually suffixed with PE.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by superwayne on Thursday March 28, 2019 @08:58AM (#19511710)
To use the "Ing" title you have to have a certain education and a few years of practice. To be honest, it doesn't mean much.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by dharmab on Thursday March 28, 2019 @08:44AM (#19511598)
But in the USA you can refer to yourself generically as a Software Engineer without any formal education.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by madengr on Thursday March 28, 2019 @09:00AM (#19511727)
Yes. I don’t think there is even a PE licensing path for software, so even with a CS degree you could never become a licensed engineer. You have to work under a PE for 5 years, then take the PE exam, then CE credits.

I have an MSEE, but can’t put engineer in my title. Though Ing. sounds kind of cool.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by russnewcomer on Thursday March 28, 2019 @10:26AM (#19512484)
There actually was a PE for Software Engineering, but it is being discontinued, because almost no one took it.

https://ncees.org/ncees-discontinuing-pe-software-engineerin...

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by madengr on Thursday March 28, 2019 @12:34PM (#19513831)
Wow, didn’t know they had one. I wonder how they handle the licensing as there would be no one to complete the 5 year understudy; chicken and the egg.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by joenot443 on Saturday March 30, 2019 @03:25PM (#19531261)
It bothers me to no end when I hear programmers here in Ontario call themselves engineers when they neither graduated from an engineering program nor completed their PEO exam. It's very much illegal, and the PEO _will_ go after companies that allow their employees to title themselves as engineers.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by r_smart on Thursday March 28, 2019 @10:53AM (#19512730)
How dare you leave out electrical engineering!
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by qstyk on Saturday April 06, 2019 @06:50PM (#19593519)
That said, there's many variants that are perfect valid: network engineer, sales engineer, systems engineer, etc.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by MagicPropmaker on Thursday March 28, 2019 @08:59AM (#19511715)
And most states in the US too. Just rarely enforced. Only a licensed PE can do business as an “Engineer”. (For example have a company with the word Engineer or Engineering in the name).
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by craftinator on Thursday March 28, 2019 @02:32PM (#19515143)
I believe the city of Portland OR recently sued a Danish man for "practicing engineering without a license". They were upset at him for generating strong proof of shortened yellow light times at intersections with red light cameras. He had a degree (and I believe a certificate) from Europe, but it wasn't recognized by the Authorities.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by TheCapn on Thursday March 28, 2019 @09:27AM (#19511937)
Protected term in Canada as well, but I don't know the last time anyone that was used against in any level of court. During my education there was a case study of some guy digging basements calling himself an engineer when he wasn't but that's about it.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by OJFord on Thursday March 28, 2019 @07:41AM (#19511180)
And still others have, though it may not be appreciated in all industries, _Chartered_ Engineers.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by cat199 on Thursday March 28, 2019 @10:20AM (#19512423)
And how many 'engineers' would tack on 1000x too much complexity to justify their 'engineering' effort?

software in many cases is more art than science.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by mceldeen on Thursday March 28, 2019 @10:27AM (#19512495)
I think this talk is relevant https://youtu.be/lLnsi522LS8
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by C1sc0cat on Thursday March 28, 2019 @06:36AM (#19510895)
Please bitch "associate professional"
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by pdpi on Thursday March 28, 2019 @08:55AM (#19511686)
If you're a company the size of Cisco, and you have two widely publicised vulnerabilities like this, then this sort of failure is _always_ management's responsibility.

That responsibility might come in the form of "big bad management" chasing the cheapest possible "fix" against the advice of the the hero engineers, but it can take other shapes too. It might be poor oversight and QA processes, or a failure to hire and/or assign competent engineers for the task.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by admax88q on Thursday March 28, 2019 @12:46PM (#19513964)
> That responsibility might come in the form of "big bad management" chasing the cheapest possible "fix" against the advice of the the hero engineers

This is the narrative that always shows up in HN. Big bad management vs the hero engineer. It makes us feel good about ourselves while also absolving us of all responsibility. Its a bullshit narrative.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by astrobe_ on Thursday March 28, 2019 @02:45AM (#19509835)
You live in a nice world, because usually the actual power (and duty) of a dev team member is to advise, not to agree or refuse.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by admax88q on Thursday March 28, 2019 @03:00AM (#19509903)
You can always quit. Or force them to fire you for refusing to implement a non fix.

In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix.

Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this is one of the most in demand professions in today's economy.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by voidifremoved on Thursday March 28, 2019 @08:46AM (#19511613)
At a large organisation I worked at years ago we used to call it Coder Shopping - when a manager would do the rounds trying to find someone who would say "yes" in a situation like this.

Invariably there would be someone who would, and if you were the person who had initially refused you probably wouldn't even be aware that it had happened until the bug reports came in...

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by adrianN on Thursday March 28, 2019 @04:13AM (#19510278)
If there were actual accountability, software engineers would have a much better lever against management. For some software this is case. If you write safety critical software you can be held personally responsible for accidents. In those industries engineer pushback is much more effective.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by philpem on Thursday March 28, 2019 @06:24AM (#19510832)
My background is safety-critical and -- speaking from first-hand experience -- it was truly incredible how much push-back we'd get when raising safety issues.

System tick timer rolled over after 2^32 1ms clock ticks (a little over seven weeks) and the software mishandled it by rebooting and losing control of the process. It wasn't until QA got involved (it turned out they saw it on a long-term test) that we were cleared to actually fix it. It was a two-character change in an inline function!

In some places "cover it up, don't discuss it in email" is the natural response. It really depends on the management and the organisational culture. You can have management who support the engineering team, or you can have management who micromanage and overrule and end up turning a two-day hotfix cycle into ten months of "try soldering a resistor to every single pin on the PCB".

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by madengr on Thursday March 28, 2019 @08:19AM (#19511426)
Ha ha, a resistor on every pin is a signal integrity hack.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by pjmlp on Thursday March 28, 2019 @07:20AM (#19511069)
Quitting assumes the possibility of finding a job around the corner and not having people that depend on you.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by konstmonst on Thursday March 28, 2019 @10:42AM (#19512631)
You might be surprised, but if you move to Europe, it is actually so! Move to Berlin of Frankfurt. There is always work for Software Developer here, it is hard not to get one and you get spammed by recruiters all the time. You don't have to take shit from management, you can just go elsewhere. Everything is also very near.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by pjmlp on Thursday March 28, 2019 @12:39PM (#19513884)
I live in Germany, now try to convince the family to move along.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by emptyfile on Friday March 29, 2019 @05:54AM (#19520285)
Well as a European I find the "uproot your life for a better job" mentality completely alien. Short of a war I'm not sure what would make me leave the place I call home.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by JustSomeNobody on Thursday March 28, 2019 @12:09PM (#19513570)
> Quitting assumes the possibility of finding a job around the corner and not having people that depend on you.

Quitting assumes the possibility of finding a job after spending 4 months doing leetcode 6 hours a day and not having people that depend on you.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by lr4444lr on Thursday March 28, 2019 @08:05AM (#19511331)
I like your spirit, but there's another conclusion we can draw: very few of us outside of a few special areas in embedded are "engineers". We tinker with bits and bytes to make business systems. Sometimes we bump up against some general engineering fundamentals. But we're just technicians meeting business goals.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by kortilla on Thursday March 28, 2019 @09:58AM (#19512210)
Yep, and the same can be said for “real engineers”. Most EEs, civil engineers, etc work on boring stuff as well with negligible risk of doing any harm.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by jodrellblank on Thursday March 28, 2019 @03:46AM (#19510155)
You suggest it was just one lone engineer being incompetent. Then you respond to downvotes with the non-sequitur "take some pride in your work" - are you suggesting pride is a fix for incompetence? What?
[dead]
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by kstenerud on Thursday March 28, 2019 @04:17AM (#19510296)
It's easy to opine and judge from on high when it's not your nuts in the vice.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by Blaiz0r on Thursday March 28, 2019 @05:16AM (#19510534)
Doesn't mean the point isn't valid though.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by kstenerud on Thursday March 28, 2019 @09:44AM (#19512099)
It's a problem of someone coming from a very incomplete view of the situation, and then issuing judgments and advice without doing any research into the actual situation on the ground (armchair warriors), which is irresponsible.

Yes, there is a possibility that they are in fact right, but they'll probably be right for the wrong reasons. It's far more likely that they'll just be plain wrong (and arrogantly so). Even a stopped clock is right twice a day.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by SkyBelow on Thursday March 28, 2019 @09:50AM (#19512138)
Let me know when pride is accepted as currency to pay bills or when insubordination due to personal pride is seen as a desirable quality in a candidate. At the very least, how much are you willing to pay a person for not implementing the fix you disagree with (including engaging in a legal contract to pay them if they lose their employment due to not implementing the fix). From my past experiences with others, moral high grounds rarely survive personal stake.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by konstmonst on Thursday March 28, 2019 @11:10AM (#19512926)
Pleas tell me in what country is it an issue for a software developer to make money? I mean in this situation, if I were forced to implement such fix, I would do it, but would then quit the next month. Because if I were to stay, not only would I get worse professionally, but I would feel dirty for not doing my work properly. The companies that accept such fixes are more often than not like a factory and treat you as gear in a machine. And also have an ugly software which make good engineers quit.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by SkyBelow on Thursday March 28, 2019 @05:17PM (#19516728)
USA. Not everyone has the economic mobility to just quit at any time. I know one such individual who I have been encouraging to get a new job because his current employment leaves him working a second job on weekends.

One could suggest to such people to display enough financial discipline to save up a rainy day fund, but this is ignoring all the procedures in place designed specifically for depressing wages.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by jodrellblank on Thursday March 28, 2019 @05:53AM (#19510678)
1) is obviously false, since an engineer could be competent and evil. Or competent and under duress - needing to keep their job to keep their visa, family health insurance, etc. Or competent but misled - "Implement the suggested fix to show how easy it is to work around" "OK, here it is" "Now work on something else", while it ships.

2) Why should you? Unless you're willing to be homeless and leave society, you're not going to find a way to live in a capitalist society which is pure idealism and no compromises, and you can't effect change in a system from without, only from within. Quit, and someone else will implement this fix - you feel good, which is worthless, and the fix ships, which is bad, and Cisco doesn't change, which is bad. Pick your battles and you could use this result in future - to build other people's trust in your recommendations, to widen the review process before future fixes are agreed upon, to have a proven record of the cost of doing things twice.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by grrowl on Thursday March 28, 2019 @05:16AM (#19510530)
Absolutely: Cisco made this happen, not Engineer Alice. If your boss asks you to do something within my ethical boundaries and you have 5 tired co-workers in favour of shipping it, eventually you'll break and say "fine". It doesn't make you responsible or the one that pulled the trigger.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by empath75 on Thursday March 28, 2019 @08:42AM (#19511586)
The fact that this fix made it to prod tells you that something is deeply deeply broken with cisco’s processes that goes well beyond any individual’s responsibility.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by martin_a on Thursday March 28, 2019 @09:03AM (#19511751)
Exactly. It's not like somebody just did this like in a three people startup. There are code reviews and quality management and many more, and this lousy "fix" has passed all those stages and instances. If nobody declined this, there's a serious problem within Cisco.
[dead]
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by dang on Thursday March 28, 2019 @04:48AM (#19510410)
Would you please stop breaking the site guidelines and posting unsubstantive comments here?

https://news.ycombinator.com/newsguidelines.html

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by onion2k on Thursday March 28, 2019 @03:38AM (#19510115)
I honestly envy the sort of person who can post something like this. Not liking nodejs is fine, but to extrapolate from "I don't like nodejs" to "Thousands of engineers at companies like Google are wrong and I am right" must require such a level of myopic, ignorant self-belief that is completely alien to me. I just find myself respecting other people's work too much, even if I don't like it.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by tomc1985 on Thursday March 28, 2019 @03:50AM (#19510176)
I might be inclined to believe you, but node's ecosystem really is a trainwreck
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by onion2k on Thursday March 28, 2019 @04:27AM (#19510324)
NPM is a trainwreck in many respects, and nodejs is terrible in many ways, but that doesn't mean developers can't use them both productively. It requires effort. You can't just push responsibility for what your app is doing under the hood to the ecosystem of library code you pull in.

However, this is true for literally every language we code in.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by admax88q on Thursday March 28, 2019 @03:47AM (#19510158)
> Thousands of engineers at companies like Google

That's an appeal to authority. It's also worth noting that nodejs is not a Google project and it is barely used internally at all. Only for small toy projects. Google uses python for scripting, or java for real servers.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by onion2k on Thursday March 28, 2019 @04:19AM (#19510300)
That's an appeal to authority.

It is, but it's also shorthand for "people who are likely to be good based on the fact they've been through a rigorous hiring process designed to filter out the worst engineers". Sometimes, maybe, you should let the principle of charity win over the rigorous rhetorical logic you can use to dismiss an argument because it broke The Rules you learned on LessWrong.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by myWindoonn on Thursday March 28, 2019 @09:02AM (#19511740)
Ex-Googler (Xoogler) here. It's an appeal to authority; Googlers don't know shit and FAANG employees aren't magically good at their jobs.

Maybe you shouldn't try pulling the Principle of Charity to support an argument from authority.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by logfromblammo on Thursday March 28, 2019 @10:14AM (#19512371)
We can "No True Scotsman" this all day long.

It is bad management to hire incompetent engineers.

It is bad management to fire competent engineers that push back.

It is bad management to make employees feel as though they would be fired for standing up in any way to management.

Take away the rhetorical shortcuts, and responsibility still always falls at the feet of the ones that have the power to make the decision. As long as engineers are hierarchically bound to obey managers upon pain of sudden and unplanned unemployment, the managers are ultimately responsible for everything the company does. If the company does not have tenured engineers that have stop work authority, the managers are fully to blame. And if they do, management still might be partially at fault.

We have this headcanon where a competent engineer could stand up, sweep away the slide deck on screen with a wave of the hand, and offer ironclad mathematical proof that the quick fix is no fix at all, and that the long, painful, but correct fix is what is Right for the Company (tm). The manager would then do the slow clap and tell that engineer to fix it right this time. It is a fantasy that is a great comfort to those of us doing maintenance work on a massive crock of shit, making the payments on technical debt that we are expressly forbidden from making any attempts to retire. But it is a fantasy. A real manager would cut the engineer off in mid-proof and say that the quick fix is happening, and that would be the end of the story.

The only way for an engineer that is "at will" and without a contract to push back is by falling on their own sword. They can quit, at great cost to themselves, to create a very minor inconvenience to the company, who will end up doing what it wanted anyway.

Being in this situation myself, you're damned right I have no responsibility for the crap code that goes out, because I have almost no autonomy in the manner in which I do my job. I cannot work outside the scope of the maintenance tickets I am assigned. And my company rents me out by the hour to the customer, so it has negative incentive to allow me to build up infrastructural capital that would allow me to do the same work in less time. I will blame management all day long, and then a bit more on evenings and weekends.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by skywhopper on Thursday March 28, 2019 @07:01AM (#19510983)
There are plenty of poor engineers, but this “fix” has to go through a process defined and enforced by managers. In a good process, multiple engineers would review the code, and if the office culture is good, then objections will be brought up and listened to, and if a fix is insufficient, management will understand and assign resources to make it right. None of those things depend on any one engineer or manager. They’re a culture issue. But the only people with the power to fix a broken culture is management. Engineer Alice doesn’t have that power herself.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by viraptor on Thursday March 28, 2019 @07:12AM (#19511027)
In large orgs there would also be some kind of security team which would have input on the CVEs. Cisco does have them. It sounds like they were not involved at all here for some reason.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by Ntrails on Thursday March 28, 2019 @09:21AM (#19511880)
The only way, and I mean the only way, this gets blocked is because a manager (not a dev) assesses the risk of improper fixing to be higher than the reward of not doing a shit ton of work justifies.

A significant portion of that is making sure the manager is fully cognisant of what the quick fix means. Alice's job is to ensure that happens. The managers job is to advocate to his bosses that this has to be done and is a net win to do it properly.

It is as likely manager person failed in advocacy as it is she failed in information transfer, but there are plenty of gradients here.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by raverbashing on Thursday March 28, 2019 @02:13AM (#19509700)
And I might add: especially at big companies where being yes men is a higher valued characteristic than being technical
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by philpem on Thursday March 28, 2019 @06:55AM (#19510961)
Oh, so much this.

"I'm sick of you bringing me problems, bring me solutions! And I want that blockchain based big-data cloud IoT solution by the end of the week!"

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by AnIdiotOnTheNet on Thursday March 28, 2019 @08:21AM (#19511443)
It really is amazing the kind of mental gymnastics HN commenters will display in order to shift the blame to everybody else, isn't it?
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by Aeolun on Thursday March 28, 2019 @08:52AM (#19511663)
The question here, is if it would stop 90% of the attacks, would it be a worthwile way to spend 5 minutes.

And the answer to that question is almost invariably yes.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by _jal on Thursday March 28, 2019 @10:09AM (#19512306)
Well, no.

That's like stopping 90% of a flood. The other 10% does more than enough.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by otakucode on Thursday March 28, 2019 @10:20AM (#19512433)
Yes, but this is software engineering. Where there is no such thing as malpractice, and where managers can not be prosecuted for criminal negligence even when their overriding of the engineers professional position gets dozens of people killed. In this delightful world, managers rule the roost and engineers do not have the ability to refuse to do anything.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by dkarl on Thursday March 28, 2019 @02:11PM (#19514917)
If management let this important security fix get executed and deployed without a competent engineer in the loop, that's a horrible mistake in itself, but it's far less likely than management choosing this alternative based on accurate information from engineers.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by JustSomeNobody on Thursday March 28, 2019 @12:02PM (#19513522)
Big bad management gets to keep their jobs when they make bad product decisions, so let's call it a wash.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by debacle on Thursday March 28, 2019 @10:15AM (#19512375)
If you read the parent post and think "bad management" I don't think the message was clear.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by craftinator on Thursday March 28, 2019 @02:23PM (#19515050)
Stereotypes are valid first order approximations.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by zeckalpha on Thursday March 28, 2019 @07:47AM (#19511221)
Who hired the incompetent engineers?