3 ms·
An unfortunate part is that 2.1.2, 2.1.3, 2.1.4, 2.1.7 and 2.1.11 are all issues I've fought of favor of previously (many.. many times), and one of my best asse
by technion 7y ago
An unfortunate part is that 2.1.2, 2.1.3, 2.1.4, 2.1.7 and 2.1.11 are all issues I've fought of favor of previously (many.. many times), and one of my best assets in that fight an "appeal to authority" by positioning documents like this.
- tptacek 7y agoSo, as a full-time practitioner in the space with multiple decades of experience, one among many that read and comment on HN, I'm just going to say that ASVS has essentially no currency whatsoever in serious application security practices (like, the practices run by clueful tech companies with large security teams, or NCC Group and any of its constituent companies, or, as far as I know, other large-ish consulting practices like Bishop Fox or Gotham). I appreciate that the documents are helpful as appeals to authority to win dumb arguments and am not saying you shouldn't do that! But it is weird for me to hear that people outside my field take ASVS especially seriously.