2 ms·
I've always said consider any product, even a security product, insecure by default until proven otherwise by careful inspection by people who know how to find
by nickpsecurity 10y ago
I've always said consider any product, even a security product, insecure by default until proven otherwise by careful inspection by people who know how to find flaws. This was the recommendation of those that invented information security. It was best approach then. It's still the best approach.
- bmh_ca 10y agoOr monetize the contrapositive. Eg bug bounties.
- nickpsecurity 10y agoBug bounties don't prove anything. They're actually popular among peddlers of insecure software. Only thing that proves something is someone who can find vulnerabilities in the system got enough access and time to find something if it's there. They might be paid or not. It's the level of review and who is reviewing that matters most.