alt Hacker NewsIf a compromised laptop was the entry point and that allowed someone to steal 6 billion dollars, it’s not really the engineers fault, right?
Replies
Well it is engineers fault. But not that engineers. Some engineer designed a system without extreme oversight that should be involved in the process.
If nothing else it shows a complete disregard for insider threat.
Nope, that engineer had far too much access. I'm confident this is the case in pretty much all organizations to some degree, but a lot of engineers are also the only ones that can deny themselves the access so in a roundabout way it's their fault anyway.
But a lot (generalizing here) don't like giving up access "in case they need it". I haven't worked backend in ages, but years ago there was one developer that went to the ops guys and said "can I just ssh to production I need to check some env vars to debug my software" (or something to that degree). Ops team was good and it was a hard no - "just add some logging, you can deploy a new release quickly enough".
Not only. I'd say the fact that something was stolen might be the engineers fault (depending on how exactly the laptop was compromised). But the amount that could be stolen like that is just ludicrous.
If you download a typosquatted package because you don't check what you type or your AI assistant got fooled I'd consider it my fault in such a case.
"A loss of X dollars is always the responsibility of an executive whose financial responsibility exceeds X dollars." - Weinberg’s 'First Principle of Financial Management' and 'Second Rule of Failure Prevention’ - 'First-Order Measurement', Quality Software Management, Volume 2, Gerald Weinberg