3 ms·
+1. I got asked to focus on CWE top 25 in a node app. Problem is, half the top 25 are not applicable to node (buffer overflows etc, which matter in memory unsaf
by hsbauauvhabzb 6y ago
+1. I got asked to focus on CWE top 25 in a node app. Problem is, half the top 25 are not applicable to node (buffer overflows etc, which matter in memory unsafe languages).
Uncontexualised security is bad security. Frequency of bugs is not a good indicator of severity.
- not2b 6y agoMore than half of them are still relevant, so you can cut it down to 15 or so and look at those.
- hsbauauvhabzb 6y agoThanks for that captain obvious. I’m more worried that my client was focusing on fake security rather that stuff that actually matters.