Just because a test doesn't catch all attacks doesn't mean that performing the test is security theatre. It's a bit like saying that ASLR and stack canaries ar

Just because a test doesn't catch all attacks doesn't mean that performing the test is security theatre. It's a bit like saying that ASLR and stack canaries are security theatre because they can be defeated by information leaks.