4 ms·

That you would deny someone employment at your company based on their lack of bcrypt knowledge -- knowledge which can be gained in five minutes on Google, which

That you would deny someone employment at your company based on their lack of bcrypt knowledge -- knowledge which can be gained in five minutes on Google, which candidates don't have access to during an interview -- is evidence of how broken our hiring processes are. If you want secure systems, audit them.

tensor 10y ago
Auditing isn't enough in my experience. Most audits are just focus on paper security. They'll run nessus and some other automated tools, do no filtering and have your developers actually check any results, and then go through an extensive box checking exercise that is incapable of handling any app specific context. In the worst case, they may recommend outdated or harmful practices that will actually lower security. For example, complex password rules and rotations instead of strength checking and password managers. This leads to users just writing things down since they can't memorize ever changing passwords. Or they may force you to install antivirus on systems that don't need it, even though antivirus systems have been shown to be full of security flaws that actually weaken system security when installed into privileged or sensitive subsystems. Paper security is distinct from genuine security. They overlap certainly, but paper security is not enough to make you secure.
- deleted 10y ago
  [deleted]
overcast 10y ago
People get denied employment all the time. Exceptionally good programmers, who are unable to answer those silly whiteboard questions valley companies take pride in dumping on interviewees. At least basic ideas concepts, like not storing plain text passwords, are real world things. Not masturbatory chest pumping exercises to see if a recruit is able to write a hash table, or implement a binary search tree from scratch.

4 ms·

That you would deny someone employment at your company based on their lack of bcrypt knowledge -- knowledge which can be gained in five minutes on Google, which

by sillysaurus3 10y ago

tensor 10y ago
Auditing isn't enough in my experience. Most audits are just focus on paper security. They'll run nessus and some other automated tools, do no filtering and have your developers actually check any results, and then go through an extensive box checking exercise that is incapable of handling any app specific context. In the worst case, they may recommend outdated or harmful practices that will actually lower security. For example, complex password rules and rotations instead of strength checking and password managers. This leads to users just writing things down since they can't memorize ever changing passwords. Or they may force you to install antivirus on systems that don't need it, even though antivirus systems have been shown to be full of security flaws that actually weaken system security when installed into privileged or sensitive subsystems. Paper security is distinct from genuine security. They overlap certainly, but paper security is not enough to make you secure.
- deleted 10y ago
  [deleted]
overcast 10y ago
People get denied employment all the time. Exceptionally good programmers, who are unable to answer those silly whiteboard questions valley companies take pride in dumping on interviewees. At least basic ideas concepts, like not storing plain text passwords, are real world things. Not masturbatory chest pumping exercises to see if a recruit is able to write a hash table, or implement a binary search tree from scratch.