3 ms·

Good article, I can't help but think this is the real problem though: > and Bob’s demand that you explain the vulnerability is met with your impatient demand t

by orf 11y ago

Good article, I can't help but think this is the real problem though: > and Bob’s demand that you explain the vulnerability is met with your impatient demand to “just do it". Maybe rather than say "Just do it" you could say "Any user can delete our entire database and steal all of our data". I think Bob would understand why this is a bit more important than his current tickets, and by not doing it when told about it any fallout would be his problem. He might hate you for giving him the task but it would be done.

djrogers 11y ago
> you could say "Any user can delete our entire database and steal all of our data". See the problem is that all/most vulnerabilities wind up with this sort of description, which can lead to Bob building up an immunity to it.
- orf 11y ago
  Not really though, some do and they should be patched, but only a small subset of vulnerabilities end up with a complete backend compromise. Things are fucked, but not that fucked.