<story><title>Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent</title><url>https://twitter.com/RedTeamPT/status/1110843396657238016</url></story><parent_chain><item><author>nabla9</author><text>&amp;quot;Engineer&amp;quot; conveys  image of   middle class white-collar job with relatively high status, good education and responsibilities. That  word  now used for everyone doing  programming related jobs inside office space for no good reason.&lt;p&gt;I think the word &amp;quot;tehnician&amp;quot; should be used to describe most grey-collar ICT jobs, including most programmers. Their responsibility and scope of their work is limited. Many programming jobs  are closer to blue collar factory level mechanic than engineer.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Grey-collar&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Grey-collar&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Technician&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Technician&lt;/a&gt;</text></item><item><author>admax88q</author><text>On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things &amp;quot;properly&amp;quot;.&lt;p&gt;You&amp;#x27;d be suprieed at how many incompetent engineers there are out there.  If &amp;quot;engineer&amp;quot; Alice in your story was actually competent they would never agree to implement the proposed &amp;quot;fix&amp;quot;. Its not a fix.  To pass it off as one would be malpractice for a real Engineer.</text></item><item><author>0xcde4c3db</author><text>Having been involved in meetings where &amp;quot;stop ship&amp;quot; was the phrase of the day, I&amp;#x27;d bet money that the following at least vaguely resembles a real conversation:&lt;p&gt;Engineer Alice: We should really fix this properly.&lt;p&gt;Manager: How sure are you that the proper fix won&amp;#x27;t break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line&amp;#x27;s revenue?&lt;p&gt;Engineer Bob: Uh, ten percent on a good day? Do you remember the last time we applied a &amp;quot;simple&amp;quot; hotfix to this function? I almost had to sleep under my desk.&lt;p&gt;Manager: And we can just prevent it with an extra regex rule in the front end code?&lt;p&gt;Engineer Alice: ... Yes. &lt;i&gt;irrepressibly existential sigh&lt;/i&gt;&lt;p&gt;Manager: How much QA effort to call this good?&lt;p&gt;QA Engineer: We can run through a cut-down version of the acceptance test suite in four or five hours.&lt;p&gt;Manager: And for the proper fix?&lt;p&gt;QA Engineer: Oh, hell, at least a week of stress testing to really be sure.&lt;p&gt;Manager: Add the regex rule.</text></item><item><author>danso</author><text>Of all the security post-mortems  I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.</text></item></parent_chain><comment><author>TeMPOraL</author><text>Yup. The reality of this industry is that most programmers are closer to the handymen you call to fix your faucet or lay floor tiles than to actual engineers. And we all have first-hand or second-hand  horror stories related to handymen.</text></comment>
<story><title>Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent</title><url>https://twitter.com/RedTeamPT/status/1110843396657238016</url></story><parent_chain><item><author>nabla9</author><text>&amp;quot;Engineer&amp;quot; conveys  image of   middle class white-collar job with relatively high status, good education and responsibilities. That  word  now used for everyone doing  programming related jobs inside office space for no good reason.&lt;p&gt;I think the word &amp;quot;tehnician&amp;quot; should be used to describe most grey-collar ICT jobs, including most programmers. Their responsibility and scope of their work is limited. Many programming jobs  are closer to blue collar factory level mechanic than engineer.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Grey-collar&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Grey-collar&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Technician&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Technician&lt;/a&gt;</text></item><item><author>admax88q</author><text>On HN its always big bad management who is the cause of every security problem or shoddy piece of engineering. If only that pesky management would screw off then we could do things &amp;quot;properly&amp;quot;.&lt;p&gt;You&amp;#x27;d be suprieed at how many incompetent engineers there are out there.  If &amp;quot;engineer&amp;quot; Alice in your story was actually competent they would never agree to implement the proposed &amp;quot;fix&amp;quot;. Its not a fix.  To pass it off as one would be malpractice for a real Engineer.</text></item><item><author>0xcde4c3db</author><text>Having been involved in meetings where &amp;quot;stop ship&amp;quot; was the phrase of the day, I&amp;#x27;d bet money that the following at least vaguely resembles a real conversation:&lt;p&gt;Engineer Alice: We should really fix this properly.&lt;p&gt;Manager: How sure are you that the proper fix won&amp;#x27;t break something else for $BIG_CUSTOMERS who are responsible for $OBSCENE percent of this product line&amp;#x27;s revenue?&lt;p&gt;Engineer Bob: Uh, ten percent on a good day? Do you remember the last time we applied a &amp;quot;simple&amp;quot; hotfix to this function? I almost had to sleep under my desk.&lt;p&gt;Manager: And we can just prevent it with an extra regex rule in the front end code?&lt;p&gt;Engineer Alice: ... Yes. &lt;i&gt;irrepressibly existential sigh&lt;/i&gt;&lt;p&gt;Manager: How much QA effort to call this good?&lt;p&gt;QA Engineer: We can run through a cut-down version of the acceptance test suite in four or five hours.&lt;p&gt;Manager: And for the proper fix?&lt;p&gt;QA Engineer: Oh, hell, at least a week of stress testing to really be sure.&lt;p&gt;Manager: Add the regex rule.</text></item><item><author>danso</author><text>Of all the security post-mortems  I’ve ever wanted to read, it’s sad I’ll probably never get to read this one and its tale of how a team of well-paid comfortable engineers got together and decided this patch was a good idea.</text></item></parent_chain><comment><author>pjmlp</author><text>Thankfully there are countries where Engineer is still a proper word, not something that you are allowed to call yourself after a 6 month bootcamp.</text></comment>