3 ms·
Regardless, government site or not, who currently does care about security? Most code I have seen widely in production is using old sql injection vulnerable co
by gxela 13y ago
Regardless, government site or not, who currently does care about security?
Most code I have seen widely in production is using old sql injection vulnerable code. No sanitization and no proper session handling.
You would think that people would care about something like security with all the privacy concerns.
I wish I had better words to say this, but I had just woke up and out the door to breakfast.
- viraptor 13y agoI keep thinking whether it would be a good idea or not to hold companies responsible for security issues affecting their users. If you fail to secure passwords, why shouldn't there be a fast-track way to sue? Almost any physical service provider I can think of already is responsible for damages. Your plumber fails - in most cases the company is insured and will fix at no cost and will be responsible for damages. Your mechanic fails - there's likely a clause in their agreement that allows you claim for the damage caused. Even if your payment card is misused, the bank is expected to reverse the charges. Why are the internet service providers excluded from this treatment? Sure, it's possible that this kind of danger would be then aimed at separate developers working in those companies too... but I'm not sure it's a bad thing. It would be easier to resist stupid requirements (I won't do it, because it would bring legal issues on me) and even the comments on SO would be different too ("if you do this, you will be sued", rather than "this is not a secure way to do it").