News for hackers. Stuff that matters.
[dead]
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by kstenerud on Thursday March 28, 2019 @04:17AM (#19510296)
It's easy to opine and judge from on high when it's not your nuts in the vice.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by Blaiz0r on Thursday March 28, 2019 @05:16AM (#19510534)
Doesn't mean the point isn't valid though.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by kstenerud on Thursday March 28, 2019 @09:44AM (#19512099)
It's a problem of someone coming from a very incomplete view of the situation, and then issuing judgments and advice without doing any research into the actual situation on the ground (armchair warriors), which is irresponsible.

Yes, there is a possibility that they are in fact right, but they'll probably be right for the wrong reasons. It's far more likely that they'll just be plain wrong (and arrogantly so). Even a stopped clock is right twice a day.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by SkyBelow on Thursday March 28, 2019 @09:50AM (#19512138)
Let me know when pride is accepted as currency to pay bills or when insubordination due to personal pride is seen as a desirable quality in a candidate. At the very least, how much are you willing to pay a person for not implementing the fix you disagree with (including engaging in a legal contract to pay them if they lose their employment due to not implementing the fix). From my past experiences with others, moral high grounds rarely survive personal stake.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by konstmonst on Thursday March 28, 2019 @11:10AM (#19512926)
Pleas tell me in what country is it an issue for a software developer to make money? I mean in this situation, if I were forced to implement such fix, I would do it, but would then quit the next month. Because if I were to stay, not only would I get worse professionally, but I would feel dirty for not doing my work properly. The companies that accept such fixes are more often than not like a factory and treat you as gear in a machine. And also have an ugly software which make good engineers quit.
Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by SkyBelow on Thursday March 28, 2019 @05:17PM (#19516728)
USA. Not everyone has the economic mobility to just quit at any time. I know one such individual who I have been encouraging to get a new job because his current employment leaves him working a second job on weekends.

One could suggest to such people to display enough financial discipline to save up a rainy day fund, but this is ignoring all the procedures in place designed specifically for depressing wages.

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by jodrellblank on Thursday March 28, 2019 @05:53AM (#19510678)
1) is obviously false, since an engineer could be competent and evil. Or competent and under duress - needing to keep their job to keep their visa, family health insurance, etc. Or competent but misled - "Implement the suggested fix to show how easy it is to work around" "OK, here it is" "Now work on something else", while it ships.

2) Why should you? Unless you're willing to be homeless and leave society, you're not going to find a way to live in a capitalist society which is pure idealism and no compromises, and you can't effect change in a system from without, only from within. Quit, and someone else will implement this fix - you feel good, which is worthless, and the fix ships, which is bad, and Cisco doesn't change, which is bad. Pick your battles and you could use this result in future - to build other people's trust in your recommendations, to widen the review process before future fixes are agreed upon, to have a proven record of the cost of doing things twice.