5 ms·
To be fair, I would also be alarmed, albeit not by OTP. "sign an electronic document" and "built with COTs libraries in a single sprint" is essentially begging
by smarx007 2y ago
To be fair, I would also be alarmed, albeit not by OTP. "sign an electronic document" and "built with COTs libraries in a single sprint" is essentially begging for a security review. Signatures and their verification are non-trivial, case in point: https://news.ycombinator.com/item?id=42590307 https://news.ycombinator.com/item?id=42590307
- talkin 2y agoNobody said you shouldn’t do any due diligence. But 1 sprint vs 2 months of review really smells like ‘processes over people’. ;)
- normie3000 2y agoA more positive view would be that the security team may have had different priorities to the product team.
- robertlagrant 2y agoTwo months of review after the work would be a lot more useful than before.