4 ms·

So what's your analysis of why the external teams are ineffective?

• tptacek 17y ago
  They're not.
  • davi 17y ago
    OK, so Microsoft finds lots of bugs by this technique (according to you), but then this guy says that he finds still more bugs, with (according to him) pretty primitive methods. And then the guy says, '"I found bugs, lots of bugs. That was both surprising and disappointing." And it also made him ask why vendors like Microsoft, Apple and Adobe, which have teams of security engineers and scores of machines running fuzzers looking for flaws, hadn't found these bugs long ago.' So given your assertion that these teams are very effective at what they do, why do you think this guy is very easily (according to him) able to find additional bugs? There's a mismatch between what you're saying and the gist of this article. I'm not saying you're wrong -- far from it. I'm looking to you for a resolution to the discrepancy.
    • jballanc 17y ago
      This guy is in the security business. If you think your software is secure, he's out of work. If he creates the impression that he didn't even have to try that hard to find these vulnerabilities, then you get paranoid and want to hire him. To be clear, I'm not saying the vulnerabilities weren't real, but to buy his story about them being "easy" to find, well...
      • tptacek 17y ago
        I tend towards the "Charlie is just better than most of us" view of the world, too.