2 ms·
I'm not saying professional auditors are useless, just that they will never reach the feedback you get from peer reviews and are not a replacement for peer revi
by realusername 3y ago
I'm not saying professional auditors are useless, just that they will never reach the feedback you get from peer reviews and are not a replacement for peer reviews anyways.
We're not in the 90s anymore and it's time to acknowledge that the software world and even the world in general has changed. Knowledge is now spread and the most knowledgeable devs aren't working at an audit firm and might not even hold a computer degree!
- mratsim 3y agoThe people who found the bug in glibc worked at an audit firm. Peers aren't enough. Finding vulnerabilities require training and an adversarial mindset that is rare. There is a reason why in cryptography people say "don't roll your own crypto"