• 6 Posts
  • 255 Comments
Joined 11 months ago
cake
Cake day: August 4th, 2023

help-circle


  • I was the unofficial “security” guy where I worked as a software engineer. (Web apps, mostly.) We had a scanning tool (Burp Suite Pro, for those who want to know) that we ran against our apps on a regular basis to find any security issues. I was almost always the guy who did triage and remediation of any issues that came up. And when I had fixed a hole, I’d put a summary of the issue and the fix on the internal wiki page where we tracked such things.

    For one particularly interesting vulnerability, I had to create my own implementation of a subset of the Java serialization API in order to remediate the vulnerability in a way that maintained backwards compatibility and didn’t inconvenience users. In the summary I wrote that the fix was “a hack” but it closed the vulnerability, which is all the PCI auditors would care about anyway. (If you don’t know what a PCI auditor is, don’t worry too much. They’re a regulatory thing that’s required if you’re a big enough business that process credit cards. They have to audit your security practices annually.)

    My boss pulled me into his office to tell me to change the wording. He was worried the auditors would see the word “hack” and think that… I dunno… I committed some kind of financial fraud in the process of making the code change or something? Or maybe that we’d failed to disclose a security breach?

    It didn’t sit right with me. For one thing, I’m the sort of person who wants to reclaim the positive connotations of the word “hack.” (And, honestly, using the word “hack” in a positive light never died.) But more importantly, if I were a PCI auditor and I heard that the boss had pressured a developer to alter their wording of the description of a remediation to make it sound better to PCI auditors, I’d probably pitch a shit fit at said boss.

    (And, honestly, the boss and the development team weren’t on great terms at the time for reasons. So it sat worse still than it would have otherwise.)

    But also, it wasn’t a hill worth dying on right then. I agreed to change my wording without raising a fuss. I decided if I ever got called to testify in court because there was a massive breach or something (I’m being hyperbolic here, but you get my point), I knew who to point the finger at.

    But it still stuck in my craw. And when I resigned a few months later, I went and edited my comment back to say “hack” on my last day and didn’t tell anyone.

    Actually, when I gave my resignation, my boss didn’t handle the process correctly with HR and they didn’t find out until way later into my notice period than they should have. As a result, they didn’t schedule an exit interview with me until way late. So I contacted HR about it and stayed late on my last day to voice how terrible the management was. (I was hoping to be the first of several to send such a message to HR.)

    When I returned to the same company/position 5 years later, the page was still present and had the word “hack.” One of the first things I did once I had access to the corporate wiki again was to check that page. I still work there today and it’s still in the pristine state it should be in.

    The boss in question also left and came back, but he’s been promoted up high enough in the ranks that he doesn’t concern himself with little old me and my security remediation reports. I imagine he’s probably forgotten about the whole thing.

    Plus, his boss was way worse, and it’s very likely it was that guy who demanded I change it and delivered the message through his underling. And the worse guy isn’t at the company any more, but that’s a story for another day.

    It’s small. And petty. But I feel satisfied with myself every time I think about it.



  • TootSweet@lemmy.worldtoShowerthoughts@lemmy.worldIs "food" a social construct?
    link
    fedilink
    English
    arrow-up
    5
    arrow-down
    2
    ·
    edit-2
    23 days ago

    “Food” is a social construct in the same way as every label we put on a thing is a social construct. “Chair” is a social construct. (The universe didn’t know what a “chair” was before humans started making and naming chairs.) “Tree” is a social construct. (Any physical thing you pick apart enough is particles (and I’m definitely oversimplifying here) and by giving it a human-made label like “tree”, we’re imposing something that wouldn’t otherwise be there.) “Particles” are a social construct! (They’re very much an abstraction of what’s actually going on. Even the math we use to understand things like quantum mechanics is just our way of thinking about something that may or may not “exist” but if it does, definitely isn’t the same as our “thoughts” about it.)

    All words are social constructs, but I think there’s at least one more layer at which “everything is a human construct.” Even before we give something a name, we’ve already made the decision to distinguish it from a “background” as a distinct “thing.” (A sufficiently alien mind might, if it encountered earth, consider all of earth “atomic” and “indivisible” to the point that the idea of “a human” wouldn’t make sense to it. It’s not like there’s any empty space between our skin and the soup of amosphere we constantly live in, so in what sense am I a separate thing from the rest of earth?)

    So, yeah, “food” is a social construct, but humans are very much removed from “reality” by an opaque ocean of social constructs.

    All that said, I wouldn’t say that “food” is a social construct in any way that, say, a “planet” or a “fork” or a “rock” or a “human” isn’t.



  • I can imagine a world in which I’d be willing to do so. But there’s no way in fuck that that world is ever going to happen.

    For sure it’d have to be as open source as it gets. With a solid user base that would maintain the device should the entity that made it end support. No dependency on a remote service that, if it was shut down, would cause problems. No DRM. No tracking. At least the option to disable all “phoning home”. No ads. Hardware off switches for any wireless connectivity interfaces. I’d have to be able to turn off basically all notifications. Decent data backup strategy options. As little vendor lockin as can possibly be achieved for such a use case. All that sort of stuff.

    The payoff for having it would have to be pretty great for me to be willing to get it if it required an invasive surgical procedure.

    And I sure as fuck wouldn’t be an early adopter. I’d definitely wait a good long while to see what issues early adopters developed.

    So, all that to say “realistically, no way in hell.” But in a magical fairly land where every product isn’t made specifically to enslave consumers… there’s a very very small chance I’d consider it.





  • When websites could theoretically track me.

    I keep my browser on “delete all my cookies/cache/local storage/history/everything (except bookmarks and addons, basically) every time I exit” mode. And I never log into anything without closing out of my browser entirely first to get rid of anything they could use to correlate “you visited this blog” with my specific Google (or whatever) account. When I’m done with whatever I logged in for, I close my browser entirely again.

    My phone browser doesn’t have a “delete everything on close” feature, so I just use the “delete all data on this app” feature liberally.