3 ms·

I think drawing the line at the OWASP top 10 is reasonable.

• tptacek 8y ago
  Ok, but if you're drawing the line at the vulnerabilities that have gotten the most promotion and documentation and not the ones that have the most impact or prevalence, isn't your standard cosmetic? For instance: you've let developers off the hook for SSRF.
  • cthor 8y ago
    Isn't OWASP top 10 based on impact and prevalence?
    • wglb 8y ago
      In terms of ranking not in terms of seldction
    • tptacek 8y ago
      Clearly not; SSRF isn’t in the top 10, but log misconfiguration is. The OWASP Top 10 is fashion, really, nothing much more.