3 ms·
> However security by obscurity is a layer of defense... In your example it would be the layer of defense. But then we still have to wonder who is the attacker
by 6510 5y ago
> However security by obscurity is a layer of defense...
In your example it would be the layer of defense. But then we still have to wonder who is the attacker? The assumption made on the web page is that the developer is the attacker. The obscurity then becomes a major issue rather than the defense.
Yes, we will have to pay what it costs and we will have to add extra developers. We all know the difference?
I could write any government app or software but it would be a slow process, it would be hostile to further development and the security of it would be laughable. But from the GUI you wouldn't notice the difference. Mine might actually be nicer.
- deleted 5y ago[deleted]
- ldoughty 5y agoI didn't explain possible attack vectors because it depends what the vulnerable code exploit does.. does it dump ENVs, and you have a secret there? Does it leak DB credentials? If it's infrastructure code, does it tell someone what IP addresses can attempt SSH? I hoped by saying "a layer of defense" indicated that there was more layers
- 6510 5y agoThe developer is the attack vector. We give him some hand money, put a gun to his head and instruct him to make a backdoor.