2 ms·
I have some doubts. For example, if they are just outputting the scan results from some tool with a high false positive rate, how is that helpful? It's a waste
by onetimeusename 4y ago
I have some doubts. For example, if they are just outputting the scan results from some tool with a high false positive rate, how is that helpful? It's a waste of time and money for the government. Bug bounty programs have the same issue that probably most bugs found are trash results from a scanning tool.
On the other hand, a custom built tool that tries to find the most serious known vulnerabilities with a low false positive rate would probably be a good thing for the government to run.
- fao_ 4y agoI'd imagine part of the job of the people working there would be to limit the number of false positives.
- doubled112 4y agoCould be, but it is certainly not how it works at my org.
- ygjb 4y agoWhat scale does your org function at?
- pessimizer 4y agoSo if they use a bad tool, it would be bad, but if they use a good tool it would be good?
- hsbauauvhabzb 4y agoThere are no good tools. Just a bunch of shady vendors.
- onetimeusename 4y agocorrect. fortunately, the sales person from the security vendor, the media, and the public officials are aware of this constraint.