4 ms·

So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about. >He back-pocketed cr

• pvg 8y ago
  So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about. It's pentesting not penthieving. That's like saying military training is useless because they don't actually kill people.
• throwawaymath 8y ago
  > So you basically admit that pentesting is useless, because they have to follow the rules which the blackhats won't even think twice about. He didn't say that at all. Your thesis here is that preventative discovery has no utility if it does not perfectly simulate real world conditions. That's a pretty extreme position; I don't think you'll sell many people on it. > It should be assumed that any data on the pwned server is now accessible to attacker, just like in any real world scenario. I think you'll have a hard time finding companies who are okay with security professionals taking sensitive data for themselves just because they're reporting a vulnerability.