5 ms·

There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we

There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?

ams6110 13y ago
You'd need some pretty iron-clad liability waivers... if you miss something, you're opening yourself up for a "malpractice" sort of scenario.
- metarev 13y ago
  Liability can be addressed with non-reliance disclosures. Bigger issue is a market problem. People who need the help the most do not know they need it.
- steve-howard 13y ago
  But then, you'd basically be getting paid for maybe kinda helping secure software.
DanBC 13y ago
That feels a bit like "We found these vulnerabilities. You should pay us. It would be a shame if anything happened to your website"
- smsm42 13y ago
  If you do it right, it won't. Many security audit companies are asked to do test audits, and I've seen security audit contracts starting with responsible disclosure of vulnerabilities. Of course, certain amount of trust is necessary so the sides have to behave in a way that is conductive to the establishment of the trust.
  - jarofgreen 13y ago
    > I've seen security audit contracts starting with responsible disclosure of vulnerabilities. But was that "We found a hole, here it is." "Thanks! Your good at that" "I know, want to hire us?" or "We found a hole. Pay us and we'll tell you." Because those are very different approaches.
pointyhats 13y ago
There are loads of companies already doing this, at least in the UK. They find the holes and you fix them.
- porker 13y ago
  List please? I've tried Googling and not found them.
- diminoten 13y ago
  The space is dominated by security oriented companies. Bugs are oftentimes not security issues though.
olalonde 13y ago
I guess one of the reasons is that it's much easier to fix those problems than to find them.
zprit 13y ago
Cigital does exactly this and more. We've even got a plugin for Eclipse that will provide suggestions on secure coding for Java. Info about the QA/Security Consulting: http://www.cigital.com/services/ http://www.cigital.com/services/ Secure coding plugin - http://www.cigital.com/products/secureassist/ http://www.cigital.com/products/secureassist/
adelevie 13y ago
Looks like Code Climate is providing an automated service like this for Rails apps: https://codeclimate.com/security-monitor https://codeclimate.com/security-monitor

ams6110 13y ago

You'd need some pretty iron-clad liability waivers... if you miss something, you're opening yourself up for a "malpractice" sort of scenario.

metarev 13y ago
Liability can be addressed with non-reliance disclosures. Bigger issue is a market problem. People who need the help the most do not know they need it.
steve-howard 13y ago
But then, you'd basically be getting paid for maybe kinda helping secure software.

DanBC 13y ago

That feels a bit like "We found these vulnerabilities. You should pay us. It would be a shame if anything happened to your website"

smsm42 13y ago
If you do it right, it won't. Many security audit companies are asked to do test audits, and I've seen security audit contracts starting with responsible disclosure of vulnerabilities. Of course, certain amount of trust is necessary so the sides have to behave in a way that is conductive to the establishment of the trust.
- jarofgreen 13y ago
  > I've seen security audit contracts starting with responsible disclosure of vulnerabilities. But was that "We found a hole, here it is." "Thanks! Your good at that" "I know, want to hire us?" or "We found a hole. Pay us and we'll tell you." Because those are very different approaches.

pointyhats 13y ago

There are loads of companies already doing this, at least in the UK. They find the holes and you fix them.

porker 13y ago
List please? I've tried Googling and not found them.
diminoten 13y ago
The space is dominated by security oriented companies. Bugs are oftentimes not security issues though.

olalonde 13y ago

I guess one of the reasons is that it's much easier to fix those problems than to find them.

zprit 13y ago

Cigital does exactly this and more. We've even got a plugin for Eclipse that will provide suggestions on secure coding for Java. Info about the QA/Security Consulting: http://www.cigital.com/services/ http://www.cigital.com/services/ Secure coding plugin - http://www.cigital.com/products/secureassist/ http://www.cigital.com/products/secureassist/

adelevie 13y ago

Looks like Code Climate is providing an automated service like this for Rails apps: https://codeclimate.com/security-monitor https://codeclimate.com/security-monitor