2 ms·
Cognitive dissonance appears to be a very big problem with security - people not aggressively auditing their systems, rationalizing away concerns, etc.
by mannykannot 8y ago
Cognitive dissonance appears to be a very big problem with security - people not aggressively auditing their systems, rationalizing away concerns, etc.
- kazagistar 8y agoAgreed, but a lot of automatic security scanning is really heavy on false positives, which can be extra obnoxious for people.
- CJST_ 8y agoI think this has a lot to do with certain developers not knowing much about security and not wanting to go down the rabbit hole of potential threats and concerns. In my experience a lot of people from project managers to developers would just rather ignore things they don't really understand (especially if it's not causing an immediate problem).
- sgarman 8y agoEspecially true because customers rarely want to pay for it and when there are issues you just sweep them under the rug and move on. Developers are the last people we should look to blame / change if we want better security.
- mannykannot 8y agoI did not mean to suggest that it is exclusively or even primarily a developer problem, though developers do also have a role, for example in following best practices.