Was saying this 3x in this thread necessary?

Yes.

We are overpaid for incredible working conditions and devs basically became capricious divas, despite the fact 90% of them are plumbers, and many not very good ones.

If you had any professional doing the same, wasting so much resources as us, changing part of the tech stack every month, debating vocabulary on twitter ad nauseam instead of coding, and whining about how their first world problem should be the focus right now rather than doing their job, they would get laughed at.

But we were incredibly lucky that IT is the most amazing productivity cheat code humanity has come up with so far, so that all this BS was accepted as the cost of doing business.

Well, here is the wake up call.

No, we are not paid to rate the best cappuccino of the valley, converting the most stable software of your org to Elm nor write a commit hook so that nothing can be pushed before the diversity committee validated the change set.

We are paid to solve problems.

If you don't solve problems, when the hard times come, and they always do, you become part of the problem.

On top of this, I have inside knowledge that some extremely common libraries that implement SAML were built not by reading and understanding the spec, but simply by looking at sample XML documents in the wild and writing code that handled it.

Multiple exceedingly obvious vulnerabilities have been the result. One fun one was: looking at an XML signature in the document, verifying it, then ignoring the assertion it was claiming to sign and just trusting the assertion at the document root.

I tried to write a standards-based implementation and gave up. The standard is enormous, and consists of three parts:

    1. The definitions of what each XML tag means in a vacuum
    2. Patterns on how to assemble those XML tags into a document that means something useful
    3. Protocols that exchange these documents back and forth to accomplish some authentication objective

Half the problem comes from the fact that it's meant to do anything and everything, and so you can theoretically just mix and match all the above parts to get what you want. But that also means that it's exceedingly simple to mix and match stuff in ways that are subtly (or not so subtly) insecure. The other half comes from the fact that the standard is so damned complicaed in order to handle everything under the sun that it's damn near impossible to wrap your head around it all. So people just glance at the spec occasionally and just write something that handles documents they see in the wild and hope for the best, with predictable outcomes.

The whole thing is a tire fire.

Note, I last worked with it about a decade ago so I may have gotten some of the characterizations wrong.