2 ms·
Only place I accept implicit trust is inside a single program. Even on same machine one should think is trusting other processes warranted.
by Ekaros 2y ago
Only place I accept implicit trust is inside a single program. Even on same machine one should think is trusting other processes warranted.
- nonrandomstring 2y ago> inside a single program Cool, but hey get this... I'm interviewing next week some guys working in API security. and the discussion notes so far are terrifying. People do all this work to build secure networks and OS, and then someone says "Hmm we need an API for <fashionable reason>", and next thing a junior dev exposes all the top level functions of a program running with high privileges as URL handlers. So maybe even _within_ your app it's not too paranoid to think "what if someone got an entry point into this function?" and at least put a "NEVER EXPOSE" comment there :)