4 ms·

Not trying to be rude at all but that's a bit of a dream world. In all of human history the very second someone invents a lock, someone else starts figuring out

Not trying to be rude at all but that's a bit of a dream world. In all of human history the very second someone invents a lock, someone else starts figuring out how to break it. This is extremely unlikely to change, mostly because it's fun and rewarding. I'd agree the biggest issue in Computer Security is culture but it's not that too many people learn what security is, it's the complete and utter disregard that the majority of developers show for the basics. Combine that with a general attitude of Security experts looking down at non-experts (I think this is getting MUCH better thankfully) and it's no wonder most systems are like Swiss cheese and full of wholes.

stronglikedan 9y ago
> it's the complete and utter disregard that the majority of developers show for the basics I'm not sure that can be pinned squarely on the developers. IME, it's often their management that wants to cut corners. Since proper security takes many steps, it makes it an easy target for management to negotiate some of those steps out of the project. I'm sure there are a few developers that don't do it correctly out of sheer laziness, and many that don't do it correctly out of ignorance, but for large projects with many developers (e.g., banking websites, etc.) I would think that most of the developers want to do it correctly, but management thinks it costs too much. Besides, there's no real ramifications for management to consider anyway (which is, IMO, the crux of the problem, but also another problem unto itself).