4 ms·

My only concern is that a rating system may leave people to have a false sense of security when using software. Some very exciting steps in the right direction

• moron4hire 10y ago
  I would say, given the general behavior of most users, people already have a false sense of security. Though maybe not. Maybe security isn't as big of a deal as we think. It's not like the world is ending. So many people are so incredibly insecure that you'd think more would come out of it and people would be incentivized to become more secure. There is a sense in which we are as secure as is cost effective.
  • raesene9 10y ago
    The problem is the externalities of insecurity. The company who is insecure doesn't suffer all the consequences of a security breach, so they don't spend as much money to mitigate it. If software security was similar to say building/fire safety or food safety where serious cost/legal consequences were attached to failures, we'd likely see more spending...
    • moron4hire 10y ago
      That's exactly what I said, "we are as secure as is cost-effective".
• haasn 10y ago
  This is my biggest worry too. It's easy to turn on ASLR and PIE and SSP and whatnot and still have tons of obvious bugs in your actual business logic. I'm sort of worried that these automated metrics are too easy to game, and that all it will teach companies do is to use different compiler settings without actually caring about, say, hashing their passwords or authenticating their cookies.
  • jrowley 10y ago
    I agree - in the worst case scenario they attempt to game the system and actually make their code more obfuscated and unsafe.