-
I think one of the reasons people always give simplistic examples of tests is that testing is very difficult to do right. At least as difficult as coding and maybe more so. I have never seen any value to unit testing and it objectively halves (or more) velocity and doubles (or more) the code to maintain. I do feel there is significant value in code review (properly done its the reviewee that finds the bugs not the reviewers), Testing In Production methodologies, Fuzz testing, and BADD
-
I think one of the reasons people always give simplistic examples of tests is that testing is very difficult to do right.
While I use testing as my example example, my argument applies to instructive examples in general. See using addition as an example of how Functional Programming is Better.
I do feel there is significant value in code review (properly done its the reviewee that finds the bugs not the reviewers), Testing In Production methodologies, Fuzz testing, and BADD
While I think unit testing is very useful, I agree that other testing techniques are way underused. I’ve written about oracles before, which is pretty similar to BADD.
-
-
karstensrage
1 year ago
|
link
| on:
Geek Squad employees search your hard drive for chance at FBI bounty
I had to take my Mac Book into Apple to get the video card repaired. I was so paranoid that someone would look at /copy my HDD (proprietary software and private keys) that I took it out and replaced it with a blank drive. With the new Mac’s the HDD is not removable so aside from the other downsides, no tech is ever going to get something with my private keys on it. My porn is pretty vanilla so I’m not that worried about it, but my keys cause me far more anxiety if any rogue tech got a copy.
-
-
I do use FDE, still not going to open up my HDD to a tech and give it to them.
-
-
-
lmm
1 year ago
|
link
| on:
Experts, True Believers and Test-Driven Development: how expert advice becomes a religion
The thing is, figuring out all the exceptions is not free. And often the exceptional cases are rare enough that the benefit is minimal.
unit tests aren’t very helpful in testing a cryptographically secure random number generator.
Bollocks. That’s a perfect use case for them.
unless you can write a unit test to determine awesomeness.
Is that supposed to be hard?
-
What would a “unit test” for a cryptographically secure random number generator look like? IIRC you run a battery of statistical tests against A LOT of data from the RNG to get a probability that the RNG is good e.g. https://en.wikipedia.org/wiki/Diehard_tests
-
In my eyes the point of unit testing is a low effort method to catch obvious failures. If you’re only looking for obvious failures in an RNG you don’t need to do huge amounts of work.
ITHare has a good article on RNG, and briefly discusses testing.
-
-
-
Don’t forget these are typically pseudo-random number generators.
ie. Given a particular seed, you always get exactly the same sequence of bits out of them.
Suddenly that makes it really obvious how you could do some tests…
Also there are typically several substeps and data structures involved, all of which are very amenable to unit testing.
Or let’s consider the traditional “hard” variety.
A hardware random number generator.
No unit tests for that eh?
Here is reference for one of them…. https://software.intel.com/sites/default/files/managed/4d/91/DRNG_Software_Implementation_Guide_2.0.pdf
Quite a bit of code in there.
How do you unit test it?
Well, you create a shim that allows you mock the machine code instructions that actually touch the hardware.
And then you control the mock to return every interesting value, or status return and verify your code can handle it.
Often your driver has to enable certain lines, and initialize and configure the hardware. Does it?
Often it has to load / store certain memory addresses, or use specific instructions? Does it?
Sometimes it is suppose reseed after every N pseudo random bits…. Does it?
-
-
-
Here’s a long essay on testing RNGs. [PDF]
-
-
What did “Can anyone say OpenSSL?” have to do with anything? I was with Zed until that point. Are people glassy eyed about OpenSSL? AFAICT there are forks and other attempts at cleaning things up, and a lot of eyes are on it. But my concern even with Heartbleed is that “with enough eyes all bugs are shallow” doesn’t apply with crypto/SSL/TLS because it takes a very special kind of eyes to do that stuff. Hindsight is always 20/20 but at the end of the day we are all human (I think).
That comment seemed out of left field. Can anyone explain?
-
OpenSSL is usually considered an example of under-designed software where people keep adding layers upon layers of cruft instead of refactoring bad foundations or rethinking strategies that have obviously spiralled out of control.
-
-
This sounds a lot like Baseline Acceptance Driven Testing/Development
https://medium.com/@tinganho/baseline-acceptance-driven-development-f39f7010a04#.8fqlj5ykh
-
The implementation also leaves a lot to be desired, as it’s left up to the whims of the site owner to decide what password strength means. One site’s “good” is another site’s “get outta here with that Fisher-Price toy password”. It’s frustrating.
So, with Discourse, rather than all that, I decided we’d default on a solid absolute minimum password length of 8 characters, and then verify the password to make sure it is not one of the 10,000 most common known passwords by checking its hash.
How is that not equally the whim of the site owner?
-
-
I FINALLY deployed my reporting application (yay me), am working on getting some packaged stuff up on debian, and learned why my current resume is so devops heavy and why I can’t answer algorithm questions in interviews.
The basics of why the deployment is such a big deal is that I’m so fast with development that stuff piles up. Devops is not my strong suit so it takes longer. I have to research what to do, how to do it, then do it. With development its just a tiny bit of how, then just do it.
I also found a bug that made me feel the same way I feel when faced with algorithm questions in interviews. But this was my bug and I wanted to fix it (unlike interview questions). So the way I approached it was with inputs and tons of trial and error with working code and working tests. I finally got it down. Originally the tests had to be slowed way down to compensate for the bug. Now that its “fixed” its so fast that the testing knocks the server over before knocking the application over.
-
Aside from the lacking of credibility as posted http://blog.easydns.org/2016/02/22/the-us-government-has-no-credibility-to-compel-anybody-to-weaken-security/. There is absolutely no indication that the FBI or any other TLA government institution is either capable or willing to use the information they are collecting to “protect the American public.” With all the data they ARE collecting they are doing a piss poor job of anything. No matter what happens with that phone, those 14 dead are not coming back.
-
karstensrage
2 years ago
|
link
| on:
The Sky Is not Falling (another response to the end of dynamic languages)
There was a study done recently that seemed to indicate that DT languages had more errors statistically than ST languages.
http://www.computerworld.com.pt/media/2014/11/lang_study.pdf
From the conclusion:
The data indicates functional languages are better than procedural languages; it suggests that strong typing is better than weak typing; that static typing is better than dynamic; and that managed memory usage is better than un- managed. Further, that the defect proneness of languages in general is not associated with software domains. Also, languages are more related to individual bug categories than bugs overall.
-
I admit to submitting this primarily because my immediate reaction to it was disbelief and annoyance. That probably means that it’s a good discussion topic, right?
Let’s break it down:
I will not produce harmful code.
“Harmful code” is not always obvious when you write it. If you’re working in a legacy system, you can produce “harmful code” purely by accident.
The code that I produce will always be my best work.
Likewise, impossible. If you’re working on a team with a legacy system, and you have deadlines, you have to do what you have to do in order to get things out: removing side effects and refactoring a vast, sprawling class in decade-old core logic is not usually an option.
I will produce, with each release, a quick, sure, and repeatable proof that every element of the code works as it should…
Er, no you won’t. Tests are not proofs.
I will make frequent, small, releases so that I do not impede the progress of others.
Yes, very important–unless you’re doing a refactor or library upgrade that requires a big-bang release.
I will fearlessly and relentlessly improve the code at every opportunity. I will never make the code worse.
Deadlines again: if you are working against a short deadline, and must deliver a feature, it is definitely possible to make the code worse while meeting business goals.
I will do all that I can to keep the productivity of myself, and others, as high as possible. I will do nothing that decreases that productivity.
Short term or long term? How does this jive with the previous rules?
I will continuously ensure that others can cover for me, and that I can cover for them.
Not really sure how this one pertains to programming: assignments and hiring are not usually in my power, so I can’t control whether there is someone who has the time to learn my organizational knowledge.
I will produce estimates that are honest both in magnitude and precision. I will not make promises without certainty.
This is impossible. There are entire disciplines of estimation. Vast arrays of books. None of them work.
I will never stop learning and improving my craft.
Finally, something valid! This is the most important and powerful rule, and the only one that is not tangled up in business dependencies or otherwise outside our control as developers.
-
I will make frequent, small, releases so that I do not impede the progress of others. Yes, very important–unless you’re doing a refactor or library upgrade that requires a big-bang release.
This assumes people are impeded by the frequency of releases. Often times I’m impeded by people releasing often with backwards breaking changes, which make more work for me. I think people should be a lot more thoughtful about releases, rather than just quick about them.
But yeah, I agree with you. This “Oath” is total bullshit. As you point out, a lot of these things are “well, it depends”. If you look at the ASCE Code of Ethics, I think it captures reality much better. It’s about trying to do the best in the situation you are in and acting like a professional.
http://www.asce.org/code-of-ethics/
Consider this one:
Engineers shall build their professional reputation on the merit of their services and shall not compete unfairly with others.
Compared to the author’s:
I will produce estimates that are honest both in magnitude and precision. I will not make promises without certainty.
One is about trying to perform your best and treating those around you well. The author’s is about trying to find some objective way to act. I think the world is too fuzzy for this Programmer’s Oath.
-
I admit to submitting this primarily because my immediate reaction to it was disbelief and annoyance.
That is Uncle Bob’s chief export, yes. Frankly I find unpacking his delivery to find the valuable advice carefully hidden within to be net-negative effort for value.
-
I will produce, with each release, a quick, sure, and repeatable proof that every element of the code works as it should…
Er, no you won’t. Tests are not proofs.
An interesting topic. Unit tests typically prove things about particular inhabitants of a type, but not for all inhabitants.
assert(add(2, 3) == 5)If this test passes (and
addis pure), it proves thataddreturns 5, given 2 and 3, but it doesn’t prove thataddalways returns the sum, for all numbers.-
Unit tests typically prove things about particular inhabitants of a type, but not for all inhabitants.
It gets even worse. As functions don’t necessarily need to be pure,
add(2, 3)might be5on the first three calls and something else on the following. Or do some time based calculation, so it only proves that at the time of execution the assertion holds.
-
-
Not really sure how this one pertains to programming: assignments and hiring are not usually in my power, so I can’t control whether there is someone who has the time to learn my organizational knowledge.
Coming a bit more from the Sysadmin side of the house, I see no problem with this as a goal. On an ongoing basis you should ensure that what you have basic documentation, and if possible that someone other than you has used each system and has a rough understanding of how it fits.
Perfection is unlikely here, but in my previous job it only took me 20 minutes to handover as almost everything was already either documented or in configuration management.
-
Completely agree! As a goal, it’s a good one. However, the place where the action can really be taken here is at the organizational level. If your organization has everyone working separately on Deep Magic projects, or doesn’t hire enough good developers to keep the average talent up in the face of attrition, all you can do is document your work and hope someone cares enough to read it.
That’s not how the post is framed, though: it’s “The Programmer’s Oath,” not “The Software Development Firm’s Oath.”
-
-
I will not produce harmful code.
“Harmful code” is not always obvious when you write it. If you’re working in a legacy system, you can produce “harmful code” purely by accident.
Certainly, but by this logic the Hippocratic Oath doesn’t make sense for doctors either, since doctors can do harm accidentally. Professional oaths like these are understood to include an implicit “to the best of my knowledge and abilities.”
The code that I produce will always be my best work.
Likewise, impossible. If you’re working on a team with a legacy system, and you have deadlines, you have to do what you have to do in order to get things out
Depending on the constraints you’re operating under, “getting things out” may actually be your “best work.”
I will produce, with each release, a quick, sure, and repeatable proof that every element of the code works as it should…
Er, no you won’t. Tests are not proofs.
Not in the modern mathematical sense of proofs, but in the more general English usage of “evidence or argument establishing or helping to establish a fact or the truth of a statement,” it certainly is.
I will produce estimates that are honest both in magnitude and precision. I will not make promises without certainty.
This is impossible. There are entire disciplines of estimation. Vast arrays of books. None of them work.
That has not been my experience. I’ve found estimates produced by a mature team of senior developers to be pretty reliable. But “honest” doesn’t mean perfectly accurate, and if you can’t promise without certainty, then just don’t promise.
You’ll have noted by now that most of my responses have something in common. Namely, you seem to be reading each of these points in the most literal and restrictive way possible. But unlike code, human language typically doesn’t work like that.
-
“…you seem to be reading each of these points in the most literal and restrictive way possible…”
This is positioned as an Oath. That is, one of the strongest affirmations and most binding contracts that we have. Lying under oath is a crime; breaking a legal contract is not. As such, oaths should be read literally and restrictively. The idea that we should take an oath to take actions over which we have no control is ludicrous–but that’s how the goals are presented.
-
Then you would of course agree that anyone who has taken the courtroom oath to “tell the truth, the whole truth, and nothing but the truth” is obligated from that day forward to never use hyperbole, tell a story that didn’t actually happen, etc. Because after all, the oath didn’t specify that it applied only to the courtroom, therefore it literally applies at all times. And it didn’t make exception for tales that everyone understands to be fictional, therefore it literally excludes all parables and fictions.
Well established legal oaths don’t stand up to the sort of ultra-literalism that you seem to be proposing.
To be clear, though, I do think Uncle Bob’s proposed oath would benefit from a rewrite. I just don’t think that the reading you’re giving it is a fair one.
-
-
-
is relatively clear
Perhaps for some, but I found the Oath as clear as a foggy day. He uses precise language in imprecise ways. Given it’s a programmer’s Oath, “proof” has a pretty precise meaning in programming. But would he consider a demo a proof? Or just tests? Or? I dunno.
He also uses imprecise language in ways where I don’t actually have any idea to determine if I’m abiding by it. What is “harmful code”? Is “Stuxnet” harmful because it purposfully breaks things for the good of some other nation states? Is Uber harmful because it’s putting people out of jobs that lack the ability to retrain in other fields? Should I not work for Uber? A lot of programming is based around putting laborers out of jobs.
I do like the idea of a programmers oath (although I like the idea of a “Code of Ethics” better). Maybe the next revisions will capture programming values a bit better.
-
-
-
-
-
-
I will produce, with each release, a quick, sure, and repeatable proof that every element of the code works as it should…Er, no you won’t. Tests are not proofs.
He did not mention tests, he was specifically talking about proofs. I was thinking of Isabelle or Coq proofs that the code does what the specification says. Which is certainly time consuming, esp. as then you have shifted the problem a bit to make sure the specification works.
-
-
-
-
If you read his blog he outright states that tests trump encapsulation. He shows a few examples of how he would rip apart objects to get into them and “test” them. It may very well be that he believes that constitutes “proof” of correctness.
-
-
-
-
-
Struggling to work on RADIUS module (FreeRADIUS). Struggling because I realized that I’m suffering burnout and extreme frustration. The burnout is due to every effort I put in seems to be a complete waste of time. On side project this is exemplified by countless efforts that have gone absolutely nowhere. @work this is exemplified by putting in a lot of effort to think about and solve problems despite a completely dysfunctional working environment.
The frustration is due to the perception of very unbalanced effort. For this RADIUS project I have to admit the FreeRADIUS mailing list has been exemplary in terms of fast response. However I ran into an issue with VPN server (ASA 5505) where multiple Reply-Message’s are not handled by IKEv1. Until this point I have never dealt with RADIUS, VPN’s or ASA 5505’s. With help I got the 5505 configured locally, I figured out how to enable enough debug to log what I was seeing and posted on reddit, StackOverflow, Cisco Support Forum, and email to the person that helped me configure the ASA 5505 in the first place. This specific instance is not the frustrating part, its a death by a thousand cuts that’s been going on for longer than I care to admit.
So after getting the module ready, I guess I will be faced with looking over what source code I can glean from Cisco’s documentation about open source they use. It feels very unbalanced but I realize that I need to suck it up. I just am having a difficult time doing that right now.
-
Without a really good crystal ball how do you know what future-proofing you are going to need? It’s really hard from your post to determine if this problem you’ve identified today was completely obvious to everyone but you. Personally I watch out for things like cross cutting and leaky abstractions so whatever terrible choice that were made N units of time ago, are encapsulated well enough that “fixing” them doesn’t require a whole re-write.
-
-
Which is why future proofing is impossible, regardless of the amount of money you throw at the “task” of “future proofing”. Which by the way – since you had this breakthrough – how many hours a week are you going to spend attacking this problem of “not enough future proofing”?
-
-
-
I’m going to repost a good comment from teraflop on MetaFilter here because y'all seem to be weirdly negative in this post.
Sigh. This made the rounds on Hacker News yesterday. To head off some common complaints:
- They’re talking about deprecating plaintext HTTP, not removing support for it.
- There are good reasons for this. When they say “browser features”, what they’re mainly talking about are privacy-sensitive things like geolocation, or access to your microphone and webcam. For obvious reasons, these features require the user to explicitly provide permission. But if they’re used on an http:// site, you have no idea who you’re granting permission to. That code could have been modified by your ISP, or your government, or whoever set up the wi-fi at the coffee shop you’re sitting in, or just any random person on your local network.
- This is not a hypothetical problem; ISPs (including Comcast) have already demonstrated that they’re willing to hijack your plaintext connections to inject ads.
- HTTPS is becoming cheaper and easier to set up. This move is being done in conjunction with the Let’s Encrypt project, which aims to make SSL certificate setup free and effortless. If you don’t want to wait for that to take off, you can already get free certificates from StartSSL.
- Yes, the CA architecture has problems. No, nobody’s come up with anything else that works as well. Mozilla isn’t doing this unilaterally; Chrome has already announced similar plans in the last few months.
- For development purposes, “localhost” will continue to be treated as secure. If that isn’t good enough, creating your own internally-trusted CA is probably a lot easier than you’re imagining.
- The fact that they’re talking about this now doesn’t mean it’s going to happen soon. Browser vendors are very serious about doing slow, methodical, careful rollout plans, even for much tinier compatibility issues than this one.
Anything else?
-
“For development purposes, “localhost” will continue to be treated as secure. If that isn’t good enough, creating your own internally-trusted CA is probably a lot easier than you’re imagining.”
My development environment has many machines with private ip’s (192.168.0.0/16). I don’t like the argument that its “probably a lot easier than your imagining” because what you are doing is de legitimizing my complaint that my browser is now making me jump through a non-trivial infrastructure change. Just because you personally don’t see a problem with it, doesn’t speak to anyone else.
In my mind the only and obvious way to address this it to make it OPTIONAL and give users the ability to turn it off.
-
-
-
When they say “browser features”, what they’re mainly talking about are privacy-sensitive things like geolocation, or access to your microphone and webcam.
This is flatly not true. They are specifically talking about limiting new CSS properties and the like to HTTPS, not because of privacy concerns specific to those features, but as a way to manipulate people into using HTTPS.
-
After thinking about this a little longer, it’s the manipulation that really rubs me the wrong way about this. Software–especially free software–should seek an honest relationship with its users. This is the opposite of that. They’re saying: we’ve tried to convince you that HTTPS is important, but clearly many of you have decided its importance is outweighed by its implementation difficulty. So rather than consider that maybe our arguments are not as compelling as we think they are, we’ve decided that we’re going take something unrelated that we know that you care about–the ability to (for end users) see and use websites the way they were intended to be seen and used, or (for site authors) the ability to use the same features as every other website on equal footing–and hold it hostage until you accede to our demands.
Moreover, Mozilla is making this decision unilaterally. It has appointed itself to make these decisions for its users because it believes it knows better than those users. But it is accountable to no one. It could have gone before the relevant standards bodies and advocated for the official deprecation of HTTP. That would have been the honest and accountable way to try to effect the change it wants to effect. Instead it is attempting to use its position in the market–a position which gives it power over its users and over site authors–to do an end-run around the standards process.
-
Funny, to me it looks like consumers are manipulated into using http as many sites don’t support https at all :)
Additionally users are presented with no warnings when browsing over http (though browsers can show many for various issues with https). Presenting no warnings for http promotes a false sense of security. I think this manipulates consumers (most who don’t understand the problems with http anyway) into acquiescing to an insecure transport.
I for one would love to see pressure applied to server operators who don’t offer https.
-
-
-
-
-
Gonna work on an integration with Symantec VIP. All evidence points to this effort being a waste of time but a very wise person said “take solace in the fact that even if it’s for naught, your brain may make a connection down the road, that it wouldnt have otherwise.”
I’m trying to figure out how to minimally affect things while still making client authenticated TLS connections for SOAP calls to VIP. Ive been wrestling with how difficult the choice was for me to require client authenticated TLS REST calls and now I’m on the other side of that. Wish me luck.
-
This week is primarily about RSA conference. Not the conference per se, but all the people that come for it. So far Monday, Tuesday and Wednesday are booked and I am irrationally happy about that. Hopefully some interesting things will come of it.
-
Have people forgotten RSA’s involvement with NSA backdooring already? In my mind, this makes RSA irredeemably tainted. Why would people still attend their conference?
-
No I haven’t forgotten but as far as I am concerned no one is not tainted and the conference has everything going on in the Enterprise security world. Keep your friends close and your enemies closer.
-
no one is not tainted
Please be more positive and less cynical. Of course that there are people that are doing far better in the world than those who promote NSA backdoors because they were bribed. It’s up to those people to shame RSA into bankruptcy for what they’ve done. RSA has done exactly the opposite of what its whole purpose of existing as a company is.
If people like you just think, “everyone is shit anyways” (paraphrased), then that’s how things will stay: shit.
Can you or your buddies do anything to start a different conference that is not affiliated to RSA? Pycon is one such community-run non-corporate conference. It’s taken many years to become what it is, but it has turned out quite well, and it has principles which have resulted, as I have heard it, in the only tech conference where women face bathroom lines.
-
-
-
-
Decided to take a break for while and train for an upcoming century. Its a tough one so as long as its not raining I’m going to try for the metric and if I feel good, maybe more.
-
Just finished up a pre-alpha integration with PingFederate as an IdP Adapter. It was fairly tough only because the documentation is sparse and the examples are pretty basic/old. Made a few false starts but once it got going it was done over this last weekend. That’s going on the back burner until I hear back from integration partner. Just blew away some work on a reporting dashboard that I stupidly did in place and am going to try and resurrect that. Then I’m going to continue on the Rules Engine track to implement some behavioral rules. Not sure how much I can get in this week but thats my plan.
-
Just finishing up a prototype POC for my next feature. I’m using Drools which is RETE rules engine. There is an experimental branch on 5.6 that implements a Fuzzy Logic belief system that matches how I conceptualize the way to do what I want to do. Next I’ll be considering ways to integrate the POC into the service I run and how to deploy it.
Semantically what I am trying to achieve is ways of expressing sentiment about things in code and distancing myself from meaningless numbers. For example, I am “suspicious” of this spam rather than scoring it as .30
-
I tried to update a customer to some new stuff and get them off old servers. Everything has to connect over SSL and the old servers are still not updated to mitigate all the known attacks so far. This particular customer’s clients are PHP and use OpenSSL for the connection. Unfortunately its an old PHP (5.4.x) and an old OpenSSL (0.9.8b).
The first thing I considered was asking the customer to update PHP and OpenSSL. I tried it myself on my MBP and couldnt figure it out so bail on that. I asked for SSH access to the customer’s machine and did some tests with openssl s_client -msg -debug to see how and why it wasn’t working. The old versions of OpenSSL always start with SSLv2 ClientHello UNLESS you specify -no_ssl2 or -tls. (Looking at OpenSSL changelog seems this was changed in 0.9.8n). Looking at the source for PHP, I was able to figure out that the only way to set that flag was to open a stream socket wrapper with tls:// as the scheme, BUT then you have to write the HTTP protocol yourself. I found a library to write HTTP protocol, Snoopy, and modified it to use the tls:// scheme and some other stuff I needed. The client’s test site is working correctly against the new servers.
This week I’m going to shore up stuff to use Snoopy in the case of really old OpenSSL situations.
The question of ethics or morals seems to come up occasionally. The smog-gate issue, self driving cars killing people, etc. I’m a programmer so I feel both sides of this issue e.g. While my animal brain wants blood for the programmers that wrote the code for these things, my thoughtful brain would never want to be blamed for something “out of my control.” The banality of evil by Hannah Arendt is a good read, it talks about how normal people do terrible terrible things. While I think you can point to high profile individuals like Uncle Bob, Bret Victor, etc. that would have the luxury of authority and context to be “ethical.” I think your general run of the mill programmer would not. Also this ethical conundrum is not isolated to programming. Other fields that seem to have issues are Medical and Financial off the top of my head.
At a prior job many years ago, I was shocked at the terrible practices used to “secure” a password. It was some home-grown pseudo hash that was just terrible and trivial to break. After I had updated that code to use industry standard techniques, a request came in from LEO to crack the password of a device used in a case for a drug dealer (drugs are bad, mmmmkay). I happily cracked the password and got a letter of thanks. I was young. Today I would probably refuse on moral grounds but I wonder, given the same situation of negligently bad password securing practices, what I would do.
“Margin Call” in an underrated film that delas oh-so-briefly, but, speaking from experience, meaningfully and realistically, on issues of ethics and morality, as seen through the lens of the (corporate side) of the Very Large Financial Institution, and is well worth a watch.
I’ve seen that one actually, it’s really good! I also really liked a similar German documentary about the ethics behind modern investment banking from the perspective of someone who worked at Deutsche Bank.