4 ms·
As someone who has spent their entire career in infosec, one of my most important rules is “security should break your company”. The alternative is, someone els
by freehunter 6y ago
As someone who has spent their entire career in infosec, one of my most important rules is “security should break your company”. The alternative is, someone else will break your company for you. If you can’t produce a document that explains what this server does and every external interaction it could possibly have, you’re failing. Be extremely conservative in what you accept.
If you’re allowing basically anything in, eventually the wrong person with the wrong code will get in. And that might very well be the last day you have a business.
- miguelmota 6y agoI agree that in general Postel's law is bad practice but I think that it also makes sense under certain contexts. For example, if you have an email input field, it's better to trim spaces from the user input before sending it to the server instead of showing an error that there's spaces needing to be trimmed. In this example the input field is liberal in what it accepts and conservative in what it sends to the server.
- noobermin 6y agoThat might be the issue, what is "liberal" and "conservative" needs to be quantified. Taking Postel's law or any law/adage to an extreme is a bad idea.