5 ms·
>"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want
by jaclaz 8y ago
>"Never trust the client" is a lesson every developer learns at some point. Incredible how an entire company missed that, but I'd put this down to "bosses want this out by DATE? Alrighty..."
Can you clarify?
It sounds like the responsability for having designed an insecure app is of the people that asked the programmer/sofware house to write it[1]?
[1] and as said very likely paid good money for it ...
- Zanni 8y agoNever trust the client of a client-server system (not the client that hired the programmer). The server needs to own the truth. He was able to hack the app because the wallet was stored locally.
- jaclaz 8y agoYep, I know, it was the reference to the little time allowed that struck me: >but I'd put this down to "bosses want this out by DATE? Alrighty..."
- csmattryder 8y agoI've seen far too many projects where security/usability/accessibility is compromised because a project manager with limited technical qualifications decides that a time-frame is much more important than these features, and the programmers just have to get XYZ built to release for the date. I've even been a part of some of those projects.
- softawre 8y agoIsn't it up to you to make absolutely sure that PM knows what they are risking by pushing that deadline? Maybe they understand the tradeoff already. If they don't, make sure they do.
- ams6110 8y agoSadly, when you tell that type of PM things that he doesn't want to hear, you get pegged as "not a team player" and either marginalized or sometimes fired.