4 ms·

Honestly, I feel this position is morally bankrupt. When someone pays for your product, gives you sensitive information, or interacts with you in any way, they

Honestly, I feel this position is morally bankrupt. When someone pays for your product, gives you sensitive information, or interacts with you in any way, they have a set of expectations. When purchasing medicine at a pharmacy, they expect to receive something that has a chance of making them better. When they deposit money into a bank, they expect that the bank will try to have the money there when they want it later. When they drop their car off at a mechanic, they expect the mechanic will try not lose the car. Anything less is called a scam. So when someone purchases a product, they expect that appropriate measures have been taken to ensure that they will not be hurt by that product. The average consumer doesn't know about proper electrical grounding, the interactions of their prescription medications, or XSS. They shouldn't have to, they're paying to not have to. "security people" overvalue security in relation to _your_ bottom line. In truth, they aren't just there for you, they're also there to advocate for the people who will actually be hurt when your garbage security gets circumvented.

ascar 8y ago
He said it's overvalued, not that it's irrelevant. In your example you expect the mechanic to lock your car and keep the keys safe, but you don't expect it to be put in a walled in area with armed guards and full-time surveillance. The latter is what IT security can quickly lead to.
- some_random 8y ago
  That's absolutely true, but the position he was endorsing was >Meanwhile 4 put of 5 webshops we check have critical vulnerabilities and half the owners don’t care because “it just costs money to fix it and things have been fine so we’d rather spend more on Adwords” Waiting until you get owned to actually patch up critical vulnerabilities in order to save money is negligence.

ascar 8y ago

He said it's overvalued, not that it's irrelevant. In your example you expect the mechanic to lock your car and keep the keys safe, but you don't expect it to be put in a walled in area with armed guards and full-time surveillance. The latter is what IT security can quickly lead to.

some_random 8y ago
That's absolutely true, but the position he was endorsing was >Meanwhile 4 put of 5 webshops we check have critical vulnerabilities and half the owners don’t care because “it just costs money to fix it and things have been fine so we’d rather spend more on Adwords” Waiting until you get owned to actually patch up critical vulnerabilities in order to save money is negligence.