Secure development means no hackers

Actually I've worked with hackers for decades and some have suggested that I was one myself, long ago and far, far away when compilers were a luxury and punch cards were a step up from paper tape.

I know that when push comes to shove hackers willoften ignore strict programming rules and just get the job done. They get bored with entering passwords and documenting their work. They sometimes hide easter eggs in the projects they work on, even if they work for Microsoft. They might even leave a back door or two in a program they are particularly fond of.

Then there are the classic examples of software which only the creator can understand or fix. Actually most programmers could understand the code but it would take an inordinate amountof time which, in today's climate, is the same thing as being unusable.

I hope no real hackers think I am confusing them with Crackers (the bad guys). I'm referring to the good old classic hackers I grew up with in Boston decades ago and, who, with the best of intentions, sometimes cut corners and did some amazing things.

But those were the good old days when a good hack could mean the difference between a successful company and a failure. Today a good hack can lead to problems when you try to maintain secure code.

Today programming is often a major team project and everyone must be a team player. None of the hackers I know play very well with others.

Am I wrong? Is my generation passed and there are no more hackers willing tobend the rules to get a job done more elegantly? Are no more easter eggs and backdoors being left behind? If so, then I guess all I can say is, Never Mind. (GRIN)

But I suspect there are still people with the hacker mindset out there, some of them in programming jobs. My whole point was that what's fun about programming probably isn't the same thing as what's secure.

John McCormick

I hadn't thought this would be a contentious topic but I guess I should post at least one simple example of hacker mentality.

Too many programs are designed and created based on assumptions about what the user will and won't do.

Although it doesn't take a hard core hacker to make this mistake, it is a kind of hacker assumption that anyone running a program will have some skill or be trying to get software to work rather than to fail.

If programmers fail to anticipate dumb user mistakesor intentional attacks, then the software probably has security flaws.

Being too comfortable with technology can leave you blind to the problems others will encounter or the damage they may unintentionally do.

Remember, people really have driven hackers quietly mad by looking for the "any" key, I've seen people struggle to find it, and staple floppy disks to file folders, and write their passwords on a piece of tape attached to the bottom of their desk drawr.

Overestimating the skill of end users, 21 year-old Unix administrators just out of technical school, and such, is a big mistake and one many hackers make.