4 ms·
Exactly -- "if they are". Are they? How can you, as a manager, know? How can you make 100% sure that every developer to ever work on the code always does the ri
by dagss 10y ago
Exactly -- "if they are". Are they? How can you, as a manager, know? How can you make 100% sure that every developer to ever work on the code always does the right thing?
Then consider the downside and cost of filtering the input, vs. the downside and cost of injection attack times a probability of 0.01% of a developer messing up -- and a policy, however idiotic it may seem to the individual developer, may make sense on a business level.
- eyelidlessness 10y agoI was responding to the premise. I was not responding to not the premise. Shrug.
- dragonwriter 10y agoA manager can just add easily create a policy about prepared statements as create a policy about mangling text to "protect" user input that is being put into SQL queries. And neither is easier to monitor. Adding the second as an additional policy because of uncertainty about compliance with the first is silly -- it bus you nothing where the first is complied with and gets you another monitoring problem. Better to just expend the same additional effort you'd expend monitoring the second policy to just improve monitoring the first policy.
- dagss 10y agoIt seems like you are ready to declare "second line of defense" as a silly thing in principe? Sometimes adding a second line of defense at 90% efficiency is cheaper than increasing the first line from 90% to 99%.