4 ms·
There's a genuine security fatigue issue (much like event fatigue) that comes from false positives. Unfortunately that doesn't reduce the value of the scanning
by cik 6y ago
There's a genuine security fatigue issue (much like event fatigue) that comes from false positives. Unfortunately that doesn't reduce the value of the scanning - the onus is on the false positives.
At the very least, running and pruning scans should happen on projects so that at least we can have the conversation. It's like PCI (as an example, not an ideal); PCI isn't perfect, but at least it encourages a conversation about security. Today we're at the point where almost every single organization at least discusses security; but I remember when PCI first came out. I can't tell you have many times people used to ask why it was problematic to store passwords in plain text.
It this the best step forward, probably not. Is it a step forward, absolutely.
- nurettin 6y agoAutomated proof of vulnerability is valuable. Kafkaesque pattern matching, is not.
- Closi 6y agoThese warnings are disorientingly and illogically complex in a surreal or nightmarish way?
- nurettin 6y agoYou did find a mild way of putting it.
- cik 6y agoThat's only true based on a certain level of care, which sadly is not always the case. Say you have a codebase that wasn't built well. Let's say your code scanner finds you at the very least the text "-----BEGIN R/DSA PRIVATE KEY-----*-----END R/DSA PRIVATE KEY-----". In my codebases that'll find nothing, but for many people, they just found SSH keys committed in plaintext. The same is true for any 1k/2k (++etc) string. It highlights what could be a private key and worth at least looking at. Neither is proof of a vulnerability. Both I will gladly, always 100% validate.
- nurettin 6y ago* will match {cipherkey} so I do not want it.
- 411111111111111 6y agoWhich is of no issue of they're just there for easy mocking etc. I agree with the parents point, if there is value in such tests, it's so miniscule that it dwarfs the added effort to filter out all the false positives if the developers aren't total newbies. And if they are, code reviews by more experienced developers should be a given, making it redundant as well.