2 ms·
In my experience, non-technical stakeholders can have disproportionate authority over technical decisions. For example, if a security best practice results in s
by shaggyfrog 11y ago
In my experience, non-technical stakeholders can have disproportionate authority over technical decisions. For example, if a security best practice results in slower logins, the development team could get immediate pushback to speed up the process, even at the risk of weaker security.
Risk can be difficult to quantify, and if the focus is on chasing the short-term, you might be told to damn the torpedoes and get the product launched.
- iofj 11y agoIn every programmer's experience, security can have a disproportionate amount of influence. For instance, they are unwilling to do any real development, yet have the authority to demand their stuff be used. There is no reason any authentication process has to use more than a single request + single response (and a single request and immediate reply from the auth server). The usual concerns like replay attacks, allowing third parties to relay data for the auth server can all be solved using encryption. In 15 years of working as a developer, I have encountered one company that actually does this both correct and fast. Security departments demanding that user authentication happen over an LDAP+Kerberos connection, for example, are commonplace and this is stupid and very slow, for no good reason.