Comment by lowdest - Hacker Neue

lowdest Jan 30, 2025 parent

Hundreds of thousands. My employer alone probably has 1000.

pinoy420 Jan 30, 2025

No. I don’t think so. I think if you took many engineers and sat them at a computer and asked them to stand up a whole dev staging prod system they wouldn’t be able to do it.

I certainly would not, or it would take me a significant amount of time to do properly. I have been a full stack dev for 10 years. Now take that one step further to someone whose only interaction with a development is numpy, pandas, julia, etc…

You are, in typical HN style, minimising the problem into insignificance.

This is /not/ a “stick it behind an aws load balancer and on one of their abstracted services that does 99% of the work for you” - that would be less difficult.

E: love how this is getting ratioed by egotistical self confessed x10 engineers no doubt. Some self reflection is needed on your behalf. Just because /you/ think you would be capable, does not mean that the plethora of others would be able to.

What likely happened here is an ingress rule was set up wrongly on iptables or equivalent.. something many of your fellow engineers would have no clue about. An open dev database is rather normal if you want something out of the door quickly, why would you worry about an internal accessible only tool’s security if you trust your 10 or so staff. Have a think about the startups you have worked in (everyone here is a startup pro, just like you are - remember!) and what dire situation your mvp was in behind its smoke and mirrors PowerPoint slide deck.

Yes this was disastrous for PR. No it is not a problem solved in its entirety entirely by learned engineering experts like yourself.

Oh here. A comment from ClickHouse saying there is a legitimate reason why this will have been configured this way and happened https://www.hackerneue.com/item?id=42873446

MobiusHorizons Jan 30, 2025

I would consider it table stakes for an intermediate level engineer at a big company (which would have well defined processes for doing this safely) or a senior at any other company (on the assumption some of that infra has to be set up from scratch). If 10 years of experience hadn’t taught me this yet, I would personally be concerned how I’m spending my energy. I am roughly at the 10y mark, and I would estimate I have been competent enough to build a public facing application without embarrassing public access issues on my own for at least 4 years. Even before that, I would have known what to be scared of / seek help on for at least 7 years. I guess I could be more unusual than I think, but the idea that at 10 years anyone would be ok not knowing how to approach such a routine task is baffling to me.

pinoy420 Jan 30, 2025

HN is a bubble. The expectation that your colleagues are /experts like you/ is unrealistic. To stand something up like this, which is entirely on bare metal - this is a task many would find challenging if they are entirely honest with themselves and put their egos to the side. Your typical swe thinks that nothing is impossible.

There was a recent comment which said along the lines of “I used to watch figure skating, seeing them race around and spin, and think no big deal. It was only when I went on ice that I realised how difficult and impressive what they were doing was” - this is exactly the trap SWEs are most guilty of. — /this/ is what you learn as a staff level.

ipaddr Jan 30, 2025

You are talking to the ice skaters. They expect you to do up your laces. Setting a password on a database is a something I would expect of any company capable of asking for a credit card.

MobiusHorizons Jan 30, 2025

everything you say is true, but I don't think any of it actually applies to being able to safely deploy user facing systems. I would certainly not trust myself to do all possible aspects of setting up a user facing system completely from scratch (ie nothing but a libc on linux or whatever) I would not trust myself to write correct crypto, for example. But I have a good sense of what I can trust myself to build relatively safely. And of course i'm not claiming that "knowledge of where to trust myself" is by any means flawless. But Even in college I made applications for people that were exposed to the public internet. But I was very aware of what I felt I could trust myself to do and what I needed to rely on some other system for. In my case I delegated auth to "sign in with google" and relied on several other services for data storage. There were features that I didn't ship because I didn't trust myself to build them safely, and I was working alone. Now I would not necessarily expect every CS student to be able to do this safely, but a healthy understanding of one's own current limitations and being willing to engineer around that as a constraint is pretty achievable, and can get you very far.

adrianpike Jan 30, 2025

Depending on your perspective, that's either very concerning or a great business opportunity for this decade's Heroku to enter the fray.

pinoy420 Jan 30, 2025

This is definitely not something hosted on a P/SaaS.

lowdest OP Jan 31, 2025

Yes, I'm aware that most devs can't do it. I'd guess 1 in 10 can.

>An open dev database is rather normal

Not open to the internet it's not! Internal network, perhaps.

>someone whose only interaction with a development is numpy, pandas, julia, etc

This person should be aware of their limitations and give the task to someone who knows what they're doing.

AdieuToLogic Jan 30, 2025

> I think if you took many engineers and sat them at a computer and asked them to ...

There are many in the software engineering field which could not satisfy a request of this nature, for any reasonable form of "asked them to".

Filligree Jan 30, 2025

It sorta sounds like their AI would've done it better, yeah...

pinoy420 Jan 30, 2025

I don’t understand this comment? Is it unusual to request something like this? OP’s comment was saying that all 1000 or so (and hundreds of thousands of others) of his colleagues would be able to do this if asked?

I don’t know if you are in agreement with me or not

AdieuToLogic Jan 30, 2025

I am agreeing with your premise of asking a random s/w technician to deploy an app fairly securely would be problematic and then generalized it to include many tasks related to s/w engineering.

So we're good. :-)

This item has no comments currently.

Preferences

Keyboard Shortcuts

Story Lists

Navigation

Miscellaneous