2 ms·
Aren't you professionally paid to fix these kinds of problems? You would be out of work if every developer and product manager put exhaustive pen testing on it
by say_it_as_it_is 7y ago
Aren't you professionally paid to fix these kinds of problems? You would be out of work if every developer and product manager put exhaustive pen testing on its to-do list prior to launch.
First to market is your bread and butter, tptacek.
- bresj 7y ago(disclaimer: I'm one of the creators of this very unnamed service) The XSS-issue that was found by Tim was indeed a very fundamental problem which shouldn't have been in there. We are very happy he disclosed the information with us so we could fix it directly. We hired a couple of professional hackers to audit our service but launched simultaneously. Biggest lesson for us: finish the audit first, launch afterwards :-)
- say_it_as_it_is 7y agoI'm going to give your tech team the benefit of the doubt that it would have responded to information quickly if it had that information. Lessons learned here: pay your pen testers quickly because their findings can affect the reputation of your company, don't launch without responding to audit results, don't bullshit people working in high tech industries about what was happening simultaneously, don't blame tech staff for business decisions
- tptacek 7y agoIt used to be; it isn't anymore. If you gave me the choice between giving up my company and ending browser Javascript cryptography, I'd have to think about it.