3 ms·
> Every piece of code you write is security-sensitive. No, not every application is CRUD, not every application is interactive and no, not every application se
by bayindirh 3y ago
> Every piece of code you write is security-sensitive.
No, not every application is CRUD, not every application is interactive and no, not every application serves users and communicate with outside world in a way allowing to be abused during its lifetime.
This doesn't mean it gives me the freedom to write reckless code all over, but the security model of an authentication module and a mathematical simulation is vastly different.
> there is no way that truly safe C++ can be written at any product-scale.
I agree to disagree here, because of my own experience.
- pjmlp 3y agoLike every other job in the world has a concept of liability,that will eventually arrive on computing world at scale.
- bayindirh 3y agoThe assumptions you make are almost palpable at this point. Simulation precision and accuracy already carries tons of liability. Talking like I or we don’t care about consequences is disturbing, esp. with the experience you have.
- pjmlp 3y agoWell your responses look like you don't care, as if you had any clue about my experience as well, unless the sightseeing from that high altitude cloud is giving mirages. Any cybersecurity law that requires citzens votes for adoption, will certainly get my signature.
- bayindirh 3y agoIf running static analyzers, testing for memory leaks, running end to end tests which takes days, adding strong bounds checking, and failing fast and with great noise as soon as something does not look right is not caring, you’re right. I don’t care. All this is done for a code which has no network access, no kernel level work, even doesn’t accept any input after parsing the input model and making sure that it’s well formed with no loose ends. Imagine what I’d do if it does any kind of authentication or user affecting work.
- pjmlp 3y agoCall me surprised. OK, fair enough.