3 ms·

Go look at the OWASP Top 10. Things like injection attacks are mostly solved problems if one writes the code properly. So why have they been one of the top 10

Go look at the OWASP Top 10. Things like injection attacks are mostly solved problems if one writes the code properly. So why have they been one of the top 10 worst vulnerabilities for nearly a decade? Because people don’t know about them and how they work. Maybe we need more than two week JavaScript boot camps.

nine_zeros 3y ago
Most companies I've worked at don't give two shits about backend complexity, let alone owasp level security. They'd buy some compliance tool and be done. This industry doesn't care too much about quality.
- deafpolygon 3y ago
  > This industry doesn't care too much about quality. Generally because there's just no consequences for it. Got compromised and lost millions of customer data to a hacker? An "Oops, we're sorry." is enough and everyone moves on.
BoorishBears 3y ago
This is inadvertently an advertisement against the value of college (and I say that as someone who didn't go to college, but does see some value in it) Someone without college wouldn't have been distracted into thinking injection attacks boil down to needing to teach people better. Not because they inherently 'know better', but the entailment wouldn't even have a chance to register. That leaves leaves them free to think in a different direction than that... maybe on the clear misalignment between the cost of vulnerabilities and cost benefit of underfunding software development: which translates to hiring fewer people, overloading them on tighter deadlines and poorly defined scope, and just generally increasing the chance they will code "improperly". _ Now there are people who went to college and know better than to fall for that entailment, but this might demonstrate why people are losing faith in the system: Education isn't the end all-be-all it sometimes is billed as to younger folks, and the real world is not as linear as a college syllabus. Imagine a company culture where everyone has the same line of thought you just did? Those are the companies spending millions of random CYA security trainings and still letting any potential improvements to product management languish. Essentially "beatings will continue until morale improves".
- subjectsigma 3y ago
  > Imagine a company culture where everyone has the same line of thought you just did? What is this strange intellectual posturing you are doing? If you wanted to say you think I’m an idiot, just say it without spending 300 words to subtly imply it. Look, unlike your comment, mine doesn’t require you to imagine any hypothetical worlds. I don’t have to imagine a hypothetical world where cybersecurity professionals are undervalued and undereducated, I see it every day. People doing extremely dumb shit because they don’t know better. At least they’re “free to think in a different direction”! They don’t need handholding. They don’t need to hire a “consultant” for $300/hr to read NIST documents for them. They need education, whether that’s college or some other model I don’t care.
  - BoorishBears 3y ago
    Your comment was about a need to change education. > cybersecurity professionals are undervalued and undereducated, I see it every day. Which is more effective at changing that situation? - changing the education system - increasing the cost of laissez-faire hiring practices If a breach cost 100x as much, does the value of qualified professionals go up or down? Do incentives to upskill go up or down? Do oversight and vetting of hires go up or down? You can educate professionals until you're blue in the face: if the cost of hiring people who are underqualified doesn't change, the industry will even settle for unqualified people. If anything you'll just devalue the ones you educated even further: Their time and effort isn't free, meanwhile there's no increase in demand for them because you didn't change the cost of hiring someone dumber. You just took their time without giving them a way to actually get a return on it... unless thanklessly fighting to apply their newfound knowledge in a system that already undervalues them is your idea of a return. _ Of course, you're free to draw whatever pivot/conclusion/aberration/perceived slight you want from here: my father is a PhD, my mother holds a doctorate and they're both from the 3rd world. I've experienced what higher education can do for people better than most, there was no posturing.
    - subjectsigma 3y ago
      In my line of work (government contracting) undervaluing of cybersecurity is a direct consequence of ignorance. You have no idea how many times I’ve given the same scare brief to a decision maker who on Slide 1 said “We are already safe, we don’t need this crap” and on Slide 200 is clamoring to hire more people. But they can’t find any; qualified professionals are few and far between, and too expensive for GS scale.

nine_zeros 3y ago

Most companies I've worked at don't give two shits about backend complexity, let alone owasp level security. They'd buy some compliance tool and be done. This industry doesn't care too much about quality.

deafpolygon 3y ago
> This industry doesn't care too much about quality. Generally because there's just no consequences for it. Got compromised and lost millions of customer data to a hacker? An "Oops, we're sorry." is enough and everyone moves on.

BoorishBears 3y ago

This is inadvertently an advertisement against the value of college (and I say that as someone who didn't go to college, but does see some value in it) Someone without college wouldn't have been distracted into thinking injection attacks boil down to needing to teach people better. Not because they inherently 'know better', but the entailment wouldn't even have a chance to register. That leaves leaves them free to think in a different direction than that... maybe on the clear misalignment between the cost of vulnerabilities and cost benefit of underfunding software development: which translates to hiring fewer people, overloading them on tighter deadlines and poorly defined scope, and just generally increasing the chance they will code "improperly". _ Now there are people who went to college and know better than to fall for that entailment, but this might demonstrate why people are losing faith in the system: Education isn't the end all-be-all it sometimes is billed as to younger folks, and the real world is not as linear as a college syllabus. Imagine a company culture where everyone has the same line of thought you just did? Those are the companies spending millions of random CYA security trainings and still letting any potential improvements to product management languish. Essentially "beatings will continue until morale improves".

subjectsigma 3y ago
> Imagine a company culture where everyone has the same line of thought you just did? What is this strange intellectual posturing you are doing? If you wanted to say you think I’m an idiot, just say it without spending 300 words to subtly imply it. Look, unlike your comment, mine doesn’t require you to imagine any hypothetical worlds. I don’t have to imagine a hypothetical world where cybersecurity professionals are undervalued and undereducated, I see it every day. People doing extremely dumb shit because they don’t know better. At least they’re “free to think in a different direction”! They don’t need handholding. They don’t need to hire a “consultant” for $300/hr to read NIST documents for them. They need education, whether that’s college or some other model I don’t care.
- BoorishBears 3y ago
  Your comment was about a need to change education. > cybersecurity professionals are undervalued and undereducated, I see it every day. Which is more effective at changing that situation? - changing the education system - increasing the cost of laissez-faire hiring practices If a breach cost 100x as much, does the value of qualified professionals go up or down? Do incentives to upskill go up or down? Do oversight and vetting of hires go up or down? You can educate professionals until you're blue in the face: if the cost of hiring people who are underqualified doesn't change, the industry will even settle for unqualified people. If anything you'll just devalue the ones you educated even further: Their time and effort isn't free, meanwhile there's no increase in demand for them because you didn't change the cost of hiring someone dumber. You just took their time without giving them a way to actually get a return on it... unless thanklessly fighting to apply their newfound knowledge in a system that already undervalues them is your idea of a return. _ Of course, you're free to draw whatever pivot/conclusion/aberration/perceived slight you want from here: my father is a PhD, my mother holds a doctorate and they're both from the 3rd world. I've experienced what higher education can do for people better than most, there was no posturing.
  - subjectsigma 3y ago
    In my line of work (government contracting) undervaluing of cybersecurity is a direct consequence of ignorance. You have no idea how many times I’ve given the same scare brief to a decision maker who on Slide 1 said “We are already safe, we don’t need this crap” and on Slide 200 is clamoring to hire more people. But they can’t find any; qualified professionals are few and far between, and too expensive for GS scale.