4 ms·

Nobody gets promoted for writing the safest software. Safety is one of those concerns that has no real upside in an organizational context.

• 0xmarcin 4y ago
  This, I once found and reported a security issue in the code. The prize that I got was to late Friday evening spend of fixing the issue while deploying all 20+ microservices. Most of the "business" people either think security is not very important or are not able to appreciate the work.
  • deleted 4y ago
    [deleted]
  • HatchedLake721 4y ago
    Honest question, what do you expect to happen after you find issues/bugs in the code you maintain?
    • 0xmarcin 4y ago
      Something like "Wow! great that you find it!" or "God job, remind me about this when we will be doing yearly salary review" or "Get this fancy tshirt"... What I instead encounter was "Fix it! It's your problem now..." EDIT: Companies that really care about security have both external and _internal_ bug bounties. Internally you usually don't win money, but e.g. fancy tshirt, amazon voucher and you get placed into internal security wall of fame. At least you feel appreciated...