News for hackers. Stuff that matters.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by admax88q on Thursday March 28, 2019 @03:00AM (#19509903)
You can always quit. Or force them to fire you for refusing to implement a non fix.

In reality though I doubt this narrative even occurred. Some incompetent engineer likely proposed this fix thinking that it was actually a fix.

Edit: I see I've been downvoted for this comment. If we were real engineers working on things like cars and bridges we'd actually be held accountable. Take some pride in your work people, this is one of the most in demand professions in today's economy.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by voidifremoved on Thursday March 28, 2019 @08:46AM (#19511613)
At a large organisation I worked at years ago we used to call it Coder Shopping - when a manager would do the rounds trying to find someone who would say "yes" in a situation like this.

Invariably there would be someone who would, and if you were the person who had initially refused you probably wouldn't even be aware that it had happened until the bug reports came in...

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by adrianN on Thursday March 28, 2019 @04:13AM (#19510278)
If there were actual accountability, software engineers would have a much better lever against management. For some software this is case. If you write safety critical software you can be held personally responsible for accidents. In those industries engineer pushback is much more effective.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by philpem on Thursday March 28, 2019 @06:24AM (#19510832)
My background is safety-critical and -- speaking from first-hand experience -- it was truly incredible how much push-back we'd get when raising safety issues.

System tick timer rolled over after 2^32 1ms clock ticks (a little over seven weeks) and the software mishandled it by rebooting and losing control of the process. It wasn't until QA got involved (it turned out they saw it on a long-term test) that we were cleared to actually fix it. It was a two-character change in an inline function!

In some places "cover it up, don't discuss it in email" is the natural response. It really depends on the management and the organisational culture. You can have management who support the engineering team, or you can have management who micromanage and overrule and end up turning a two-day hotfix cycle into ten months of "try soldering a resistor to every single pin on the PCB".

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by madengr on Thursday March 28, 2019 @08:19AM (#19511426)
Ha ha, a resistor on every pin is a signal integrity hack.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by pjmlp on Thursday March 28, 2019 @07:20AM (#19511069)
Quitting assumes the possibility of finding a job around the corner and not having people that depend on you.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by konstmonst on Thursday March 28, 2019 @10:42AM (#19512631)
You might be surprised, but if you move to Europe, it is actually so! Move to Berlin of Frankfurt. There is always work for Software Developer here, it is hard not to get one and you get spammed by recruiters all the time. You don't have to take shit from management, you can just go elsewhere. Everything is also very near.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by pjmlp on Thursday March 28, 2019 @12:39PM (#19513884)
I live in Germany, now try to convince the family to move along.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by emptyfile on Friday March 29, 2019 @05:54AM (#19520285)
Well as a European I find the "uproot your life for a better job" mentality completely alien. Short of a war I'm not sure what would make me leave the place I call home.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by JustSomeNobody on Thursday March 28, 2019 @12:09PM (#19513570)
> Quitting assumes the possibility of finding a job around the corner and not having people that depend on you.

Quitting assumes the possibility of finding a job after spending 4 months doing leetcode 6 hours a day and not having people that depend on you.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by lr4444lr on Thursday March 28, 2019 @08:05AM (#19511331)
I like your spirit, but there's another conclusion we can draw: very few of us outside of a few special areas in embedded are "engineers". We tinker with bits and bytes to make business systems. Sometimes we bump up against some general engineering fundamentals. But we're just technicians meeting business goals.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by kortilla on Thursday March 28, 2019 @09:58AM (#19512210)
Yep, and the same can be said for “real engineers”. Most EEs, civil engineers, etc work on boring stuff as well with negligible risk of doing any harm.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by jodrellblank on Thursday March 28, 2019 @03:46AM (#19510155)
You suggest it was just one lone engineer being incompetent. Then you respond to downvotes with the non-sequitur "take some pride in your work" - are you suggesting pride is a fix for incompetence? What?
[dead]
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by kstenerud on Thursday March 28, 2019 @04:17AM (#19510296)
It's easy to opine and judge from on high when it's not your nuts in the vice.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by Blaiz0r on Thursday March 28, 2019 @05:16AM (#19510534)
Doesn't mean the point isn't valid though.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by kstenerud on Thursday March 28, 2019 @09:44AM (#19512099)
It's a problem of someone coming from a very incomplete view of the situation, and then issuing judgments and advice without doing any research into the actual situation on the ground (armchair warriors), which is irresponsible.

Yes, there is a possibility that they are in fact right, but they'll probably be right for the wrong reasons. It's far more likely that they'll just be plain wrong (and arrogantly so). Even a stopped clock is right twice a day.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by SkyBelow on Thursday March 28, 2019 @09:50AM (#19512138)
Let me know when pride is accepted as currency to pay bills or when insubordination due to personal pride is seen as a desirable quality in a candidate. At the very least, how much are you willing to pay a person for not implementing the fix you disagree with (including engaging in a legal contract to pay them if they lose their employment due to not implementing the fix). From my past experiences with others, moral high grounds rarely survive personal stake.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by konstmonst on Thursday March 28, 2019 @11:10AM (#19512926)
Pleas tell me in what country is it an issue for a software developer to make money? I mean in this situation, if I were forced to implement such fix, I would do it, but would then quit the next month. Because if I were to stay, not only would I get worse professionally, but I would feel dirty for not doing my work properly. The companies that accept such fixes are more often than not like a factory and treat you as gear in a machine. And also have an ugly software which make good engineers quit.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by SkyBelow on Thursday March 28, 2019 @05:17PM (#19516728)
USA. Not everyone has the economic mobility to just quit at any time. I know one such individual who I have been encouraging to get a new job because his current employment leaves him working a second job on weekends.

One could suggest to such people to display enough financial discipline to save up a rainy day fund, but this is ignoring all the procedures in place designed specifically for depressing wages.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by jodrellblank on Thursday March 28, 2019 @05:53AM (#19510678)
1) is obviously false, since an engineer could be competent and evil. Or competent and under duress - needing to keep their job to keep their visa, family health insurance, etc. Or competent but misled - "Implement the suggested fix to show how easy it is to work around" "OK, here it is" "Now work on something else", while it ships.

2) Why should you? Unless you're willing to be homeless and leave society, you're not going to find a way to live in a capitalist society which is pure idealism and no compromises, and you can't effect change in a system from without, only from within. Quit, and someone else will implement this fix - you feel good, which is worthless, and the fix ships, which is bad, and Cisco doesn't change, which is bad. Pick your battles and you could use this result in future - to build other people's trust in your recommendations, to widen the review process before future fixes are agreed upon, to have a proven record of the cost of doing things twice.