3 ms·

So much of main line security practice is cargo cultism. There is so little use of actual research and data on how compromises actually happen. Somebody just ge

by api 6y ago

So much of main line security practice is cargo cultism. There is so little use of actual research and data on how compromises actually happen. Somebody just gets the idea something is good for security and it sticks. No rationale needed.

userbinator 6y ago
There's a lot of dogmatic cargo-culting elsewhere in software too, but it tends to get a lot more force behind it just because it's "for security".
zamalek 6y ago
If you're pasting passwords into fields from a password manager, even if you paste it into the wrong place there is almost no chance of a real compromise. You have unique passwords everywhere, so a perpetrator would have to guess which of your hundreds of websites it is for.
dangus 6y ago
Related to this, every security team I’ve ever interacted with barely knows how to work a computer and mostly operates off of commercially purchased scanning tools and security agents. My theory is that security is the least desirable part of the entire software engineering stack - it’s boring, has a lot of blame and liability potential, and it’s a cost center. Heck at least infrastructure folks get to brag about things like cost optimizations. As a result it seems to me that security attracts the kind of people who view it as a way to wear a digital uniform and badge.
- sl1ck731 6y ago
  I recently started a CISSP course and discovered this. I was so excited to finally be getting into security and the next thing I know I'm 3 hours into recordings about pointless jargon and control taxonomies. I know there is a place for the latter at least, but it isn't something I want to do everyday.
  - SCHiM 6y ago
    Pivot to OSCP instead. CISSP will have you learn the required strength of a light bulb to light the alley behind the office. OSCP will introduce you to overflowing a buffer and pwning a remote service... I know which one I find preferable to learn :)
tjpnz 6y ago
I've experienced this first hand as a developer. Our team was working on revamping an e-commerce platform and we had developed a CRUD API for the shopping cart. Everything was going smoothly until a manager decided to take issue with our use of HTTP DELETE for removing items from the cart. The person in question wasn't technical but pointed to a document which expressly prohibited the use of the DELETE verb across all applications developed by the company citing an unspecified security risk. Wasn't around long enough to dig deeper into that, but probably wouldn't have gotten far given how partial the company was to superstition.

by api 6y ago

userbinator 6y ago

There's a lot of dogmatic cargo-culting elsewhere in software too, but it tends to get a lot more force behind it just because it's "for security".

zamalek 6y ago

If you're pasting passwords into fields from a password manager, even if you paste it into the wrong place there is almost no chance of a real compromise. You have unique passwords everywhere, so a perpetrator would have to guess which of your hundreds of websites it is for.

dangus 6y ago

Related to this, every security team I’ve ever interacted with barely knows how to work a computer and mostly operates off of commercially purchased scanning tools and security agents. My theory is that security is the least desirable part of the entire software engineering stack - it’s boring, has a lot of blame and liability potential, and it’s a cost center. Heck at least infrastructure folks get to brag about things like cost optimizations. As a result it seems to me that security attracts the kind of people who view it as a way to wear a digital uniform and badge.

sl1ck731 6y ago
I recently started a CISSP course and discovered this. I was so excited to finally be getting into security and the next thing I know I'm 3 hours into recordings about pointless jargon and control taxonomies. I know there is a place for the latter at least, but it isn't something I want to do everyday.
- SCHiM 6y ago
  Pivot to OSCP instead. CISSP will have you learn the required strength of a light bulb to light the alley behind the office. OSCP will introduce you to overflowing a buffer and pwning a remote service... I know which one I find preferable to learn :)

tjpnz 6y ago

I've experienced this first hand as a developer. Our team was working on revamping an e-commerce platform and we had developed a CRUD API for the shopping cart. Everything was going smoothly until a manager decided to take issue with our use of HTTP DELETE for removing items from the cart. The person in question wasn't technical but pointed to a document which expressly prohibited the use of the DELETE verb across all applications developed by the company citing an unspecified security risk. Wasn't around long enough to dig deeper into that, but probably wouldn't have gotten far given how partial the company was to superstition.