The Tragedy of the Bloomberg Code Issue
I approached the document with an open mind. When I opened my mail box last week, I didn't expect to get a 112 page magazine devoted to explaining the importance of software to non-technical people. It was a welcome surprise.
This morning I decided to try to read some of the issue. (It's been a busy week.) I opened the table of contents, shown at left. It took me a moment, but I realized none of the article titles mentioned security.
Next I visited the online edition, which contains the entire print version and adds additional content. I searched the text for the word "security." These are the results:
Security research specialists love to party.
I have been asked if I was physical security (despite security wearing very distinctive uniforms),” wrote Erica Joy Baker on Medium.com who has worked, among other places, at Google.
Can we not rathole on Mailinator before we talk overall security?
We didn’t talk about password length, the number of letters and symbols necessary for passwords to be secure, or whether our password strategy on this site will fit in with the overall security profile of the company, which is the responsibility of a different division.
Ditto many of the security concerns that arise when building websites, the typical abuses people perpetrate.
“First, I needed to pass everything through the security team, which was five months of review,” TMitTB says, “and then it took me weeks to get a working development environment, so I had my developers sneaking out to Starbucks to check in their code. …”
In Fortran, and I ask to see your security clearance.
If you're counting, that's eight instances of "security" in seven sentences. There's no mention of "software security." There's a small discussion about "e-mail validation," but it's printed to show how broken software development meetings can be.
Searching for "hack" yields two references to "Hacker News" and this sentence talking about the perils of the PHP programming language:
Everything was always broken, and people were always hacking into my sites.
There is one result for "breach," but it has nothing to do with security incidents. The only time the word "incident" appears is in a sentence talking about programming conference attendees behaving badly.
In brief, a 112 page magazine devoted to the importance of software has absolutely nothing useful to say about software security. Arguably, it says absolutely nothing on software security.
When someone communicates, what he or she doesn't say can be as important as what he or she does say.
In the case of this magazine, it's clear that software security is not on the minds of the professional programmer who wrote the issue. It's also not a concern of the editor or any of the team that contributed to it.
From what I have seen, that neglect is not unique to Bloomberg.
That is the tragedy of the Bloomberg code issue, and it remains a contributing factor to the decades of breaches we have been suffering.
Tweet
Comments
None of this is surprising - coders (like most people and myself) are lazy, and work harder (like most people) at doing less rather doing more. Even basic security requires work and effort, and better security requires consistency and continuos effort. The C-Suite is scared because they know the really can lose their jobs (e.g. Target) but haven't figured out that just like exercising and eating well - you have to do it everyday single day or it doesn't work.
There is no responsibility, not interest, no incentive to produce software which cannot be hacked by 14-year olds.
There is also no point in "being the odd man out" - your secure product will be dragged down into the abyss by all the bad software around it on the same network. A shiny beacon drowned by a sea of mud and failed apps.
Maybe the reason some intelligence services still use zero-days instead of jumping on the custom PHP software with the MS access backend from 1995 "proudly made by an unpaid intern" is because they want security researchers and incident responders appreciate their skill and declare it being "art".
That's an argument for Marc Stiegler's strategy in his Google Tech Talk from March 2010, "The Lazy Programmer's Guide to Secure Computing."
As a layman whose lifelong knowledge of coding is Basic, Logo, Lingo and Max, I actually found it very informative and helpful to finally understand the difference between Python and JavaScript and PHP and Ruby, and find out what SQL and node.js mean. I'm beyond fine that it didn't go into detail regarding security, wireless protocols, data gluts and other such messiness. That's why we hire security experts, telecom engineers, data scientists et al. ;)
Best regards and have fun deconstructing the world for us ignorants :)
That's exactly my point. If this magazine reflects "how software developers think," especially the idea that you "hire security experts" to handle security, that explains why we have such a problem in software security today.