2 ms·
I have had a developer look me dead in the eye and say "this is not a security concern, because I can't see how this can be exploited". Security by obscurity f
by namaria 2y ago
I have had a developer look me dead in the eye and say "this is not a security concern, because I can't see how this can be exploited".
Security by obscurity from self. It was very hard to explain to that person what was wrong with that line of reasoning.
- D-Coder 2y ago> It was very hard to explain to that person what was wrong with that line of reasoning. "So... you're the smartest person in the world?"
- lazide 2y agoIt’s very hard to argue with someone who asserts ‘what I don’t know can’t hurt me’, because usually they’ll refuse to know anything that will hurt them. Like that there are things they don’t know, that can hurt them.
- immibis 2y agoBut... You have to see things that way or else literally everything becomes a security concern.. Extra whitespace before a semicolon? I don't see how it can be exploited, but with the mindset you imply, I have to treat it as a security concern. But removing the whitespace is also a security concern.
- namaria 2y agoYes, general computers are fundamentally unsafe. We should always think about threat models, vulnerabilities, blast radii, defense in depth. What we should never do is dismiss something as a non-concern because we don't know how it could be a problem. Especially when someone is trying to point out something we're doing is extensively documented as a security concern. In that case it would be quite obtuse to claim in a public discussion that the person pointing it out is wrong because you don't understand the issue, and yet I have lived through that.