Bug hunters, software firms in uneasy alliance

TalkBack 9 of 20:

Next »

« Previous

• Thread View
• Flat View

The Definition of "Stupid"

The definition of "stupid" is "deliberate ignorance"...in my lexicon, anyway. I use it not to describe people who can't learn, but people who WON'T learn.

On the hacker side, I suppose that would apply to "security researchers" who won't give companies a chance to fix flaws before they go public with full disclosure. How can that possibly be an aid to security?

On the developer side, "stupid" applies to companies that betray the trust of hackers who responsibly report flaws in good faith. Two of the examples cited in the article are illustrative; they vary in degree, but not in essence. Microsoft's behavior (six months to a year to fix flaws) is abusive; Oracle's behavior (two years later the reported flaw is still not fixed) is unconscionable. In both cases, the companies are "stupid".

Right?

Not exactly. Companies aren't stupid; people are. A company is not a volitional entity, but the people who make up the company are. Yes, in the aggregate, it's the company that gets the reputation for the stupid behaviors of its people, and that's how we end up with preposterous statements like "Microsoft is stupid". That's absurd, because it implies that everyone who works for Microsoft is stupid, and that's just plain false. Microsoft makes some immensely useful products that are designed by some very smart people -- people who not only CAN learn but actually WANT to learn from their mistakes.

But there are obviously some real buttheads at Microsoft too. I don't think they're the engineers -- the creative people who actually would take the responsibility for fixing the flaws if they got the assignment. The buttheads are the management hacks who decide NOT to make the assignment in the first place. That's the repository of stupidity -- the real Dark Side of Microsoft...the part that tarnishes all the good that the rest of the company does. The same is true of Oracle.

It's not my intention here to invite either Microsoft/Oracle/XYZ apologists or Microsoft/Oracle/XYZ haters to pile on with their respective tirades, and that goes for any other company you plug into the XYZ slot. The fact is, their arguments with each other are pointless. The apologists are essentially defending the creative people who would take responsibility if the buttheads gave it to them, and the haters are essentially attacking the buttheads. But they don't differentiate, because they associate whatever they're defending or attacking with "the company". Hence the apparent argument, but there really isn't any argument; they're both right.

It's seldom true that any company is either monolithically stupid or uniformly enlightened, because companies are neither stupid nor enlightened. People are. And when a company does something stupid like leaving security flaws unfixed for months or years on end, it means the company has some very stupid people in a position of authority. Like a festering sore on a dog's butt, it tends to make the whole dog stink.

Posted by: slingzenarrowzuvowtrayjissforchin   Posted on: 09/06/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now
• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now