5 ms·
How did no one within the company catch it? Aren't security products developed by at least somewhat security-minded people? Is it all just a sham?
by blfr 11y ago
How did no one within the company catch it? Aren't security products developed by at least somewhat security-minded people? Is it all just a sham?
- fl0wenol 11y ago>Is it all just a sham? Yes. There's hardly anything* local to a client worth paying money for that will make you more secure. *--> hedging for a miraculous product I just don't know about
- tptacek 11y agoNo, security products are not typically developed by people who understand secure programming, even at companies that employ teams of people to do vulnerability research. The people who build security software are the same as the ones who build everything else.
- sarciszewski 11y agoCompanies that produce "security products" don't give a damn about secure development. They do give a damn about infographics and sales presentations citing "sexy-sounding" research projects.
- ProAm 11y ago> They do give a damn about infographics and sales presentations citing "sexy-sounding" research projects Sort of like the startup community?
- sarciszewski 11y agoNot too different. Most antivirus is based on a flawed premise, and most hackers know this. http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf http://www.sevagas.com/IMG/pdf/BypassAVDynamics.pdf
- blfr 11y agoI don't mean secure programming, just people who would poke their product a little over lunch.
- justin_oaks 11y agoI can confirm this is the case for my company. The software we produce can be classified as security software, yet nobody is trained in secure programming or even basic security principles (e.g. validate all input, defense in-depth, etc). I'm by far the most security-minded developer on a team of about 20 developers, but everything I know is because I'm interested in the realm of security.
- fweespeech 11y ago> Is it all just a sham? Yes, unless you are so computer illiterate as to regularly download old viruses by accident. > How did no one within the company catch it? I doubt they do any reviews of their code beyond QA/"Does it work?" > Aren't security products developed by at least somewhat security-minded people? No. Pretty much the people who test for vulnerabilities [i.e. actual security-focused programmers] are more expensive than the average Windows desktop programmer. Now just imagine what companies that process your credit cards look like...
- zAy0LfpBZLC8mAC 11y agoWhere did you get the idea that antivirus software is a security product?