3 ms·
This particular issue reeks of "roll your own" when a lot of out-of-box token based solutions would just do a better job. The best lesson to learn about securi
by munk-a 7y ago
This particular issue reeks of "roll your own" when a lot of out-of-box token based solutions would just do a better job. The best lesson to learn about security in software is that if you're doing it and you don't have a PhD you're doing it wrong.
The benefits of leaning on a third party for common logic should be carefully reviewed on a case-by-case basis unless that software is related to security, in which case, please do lean on a third party.
- ghh45654 7y ago>The best lesson to learn about security in software is that if you're doing it and you don't have a PhD you're doing it wrong. fuck, I need to tell that to all top CTF teams that their members should stop competing and leave their jobs and focus on PhD It may be a little bit offensive, but did you even graduate?
- munk-a 7y agoSorry, I was a bit hyperbolic - let me clarify. I didn't mean that educational experience is a critical portion - more that working in the security field is a lot more theoretical than most and requires a much higher investment of time to start to comprehend. People without degrees absolutely can be security experts, and people with degrees can be utterly clueless - but if you're working on a webapp and given a week to write a login system then it almost certainly will be vulnerable. So it's less specifically required that people have PhDs and more... this stuff takes time to fully understand, I know a lot of pitfalls on the topic but I wouldn't say I'm an expert - I just know enough to know that I don't know.