Security itself is a set of processes and policies where different teams monitor and ensure compliance with said policies. If security policies get in the way of the software compiling/working developers will disable security (and sometimes for short periods of time this is needed for testing to figure out why something has gone wrong). But it becomes easy and commonplace for developers to turn off the security because it gets in the way of productivity. And that's the problem with security, you don't generally get punished for violating it immediately by an attacker. It can be months or even years before someone downloads your source code and posts it online. You may not notice for months that your database was breached and everyone that you don't want has a list of your customers.
Re:VSCode remote code execution advisory
by pixl97 on Wednesday December 07, 2022 @08:20AM
(#33894017)
Working in the industry for a while now I've come to the realization that developers in the vast majority of situations are not security engineers, and should not and cannot be trusted to ensure both the software they write and the systems they run are secure in any manner.
That's a so annoying thing, I understand enough about admin stuff to understand that I have huge knowledge gaps but I'm seeing people all the time assuming they can securely administrate docents of servers while having less knowledge then I just because they made things somehow run (but then I also have seen more then just one or two really bad admins).
The worst case was someone who through because they have a doctor title in numerical math that and a (small) bit of programming/admin experience that they know what is needed to securely administrate a "private cloud" (cloud isn't quite the right term here,but good enough).
As expected it lead to the company being hacked due to some major security gaps in less then 2 years.