4 ms·
This sort of thing is exhausting if you have to keep it up unsupported. Being the negative nancy that keeps pointing out the holes in other peoples' grand plans
by thrower123 8y ago
This sort of thing is exhausting if you have to keep it up unsupported. Being the negative nancy that keeps pointing out the holes in other peoples' grand plans earns you no kudos.
- pixl97 8y agoDepends who you are leaking the holes to. Negative Nancy probably makes a living selling said flaws to foriegn governments these days because no one will listen to them.
- debatem1 8y agoA team I used to work with closely had a process where if a development team didn't think an issue was important enough to fix and release the security team was encouraged to find other buyers for the vuln. It was actually a pretty great way to both keep people on the same page and keep your security folks tethered to reality.
- closeparen 8y agoWhich is why security should be primarily a software development team offering high-quality, safe-by-default libraries and services. Instead of "you idiots failed to consider authorization" it becomes "here are the onboarding instructions for our authorization system, and here's your language's client."
- debatem1 8y agoIf you're unsupported it's both exhausting and pointless. If you're lightly supported, IMO it's generally better to fight the long fight for stronger support than to spend political capital on specific bugs or design flaws.