3 ms·
My first thought is: so now I am relying on a company that basicly provides me free services for security audits of other companies, some of which I pay for the
by wjnc 11y ago
My first thought is: so now I am relying on a company that basicly provides me free services for security audits of other companies, some of which I pay for the services they deliver. (Last one is a stretch.) Of course, I rely on many free things, but it's the second order aspect here that troubles me.
Is there an indication of the complexity of the bugs they are finding? Are they among those that should be caught be QA?
- ploxiln 11y agoIt's a new kind of incompetent-but-too-big company: "too big for google to not give you free expert security review". Well, it's just for companies that can make google's stuff look bad when they enable users to be badly infested with malware. The magnitude of it in this case is pretty funny ... can you imagine Comodo "security suite" or whatever just 3 months ago? A special secure browser without secure origin policy, a local poorly secured vnc server, a scanning and parsing engine that continually exposes itself to un-trusted input but has ASLR disabled ... Most of these are not really complicated, they're bad feature ideas. But mass-market security products are feature-driven, not security-driven. So it makes sense that they suck at security.