3 ms·
Have you actually found much value from these reports? Most people I talk to tell me they're full of garbage.
by Eridrus 9y ago
Have you actually found much value from these reports? Most people I talk to tell me they're full of garbage.
- zinssmeister 9y agoNoise is a problem and we are in this fight to improve exactly that.
- Eridrus 9y agoThere is clearly noise, but is there any signal at all? I wouldn't be surprised if there was no signal to be found.
- zinssmeister 9y agoThere is a lot more signal than noise, especially they way we aggregate the security reports. CSP can be deployed in report only mode, which provides a great way to detect how your policy has to come together.
- Eridrus 9y agoI guess in my mind signal == attacks, but I guess there's also value in having reports when your policy broke things if you don't have other methods for detecting that, or if your integration tests disable CSP.