3 ms·
> It's mostly about perfectly rational cost/benefit analysis. I disagree. Looks at any exploit database. A large percentage of the exploits on any typical day
by throwaway729 10y ago
> It's mostly about perfectly rational cost/benefit analysis.
I disagree.
Looks at any exploit database. A large percentage of the exploits on any typical day are the sorts of mistakes that a well-educated developer wouldn't make, or that best practices and modern tooling would prevent.
That's not even a cost/benefit problem, because in many cases there's no additional cost to doing things the right way. It's a culture and education problem[1].
[1] by which I do not mean traditional university education, fwiw.
- Silfen 10y agoI'm not so sure we do disagree :) At the risk of splitting hairs... there are costs associated with finding developers who have this education and/or fostering a company culture where security best practices are important. If software companies were seriously punished for compromising PII, then I imagine we'd see a change.
- bbcbasic 10y agoMaybe engineers are making a rational cost/benefit analysis too. In that perfectionism doesn't pay more or lead to promotion. Actually it can be harmful to call things out in a corporate environment.