17 ms·

Automated security audits are useless until we have some fancy AI

• jerf 13y ago
  Testing can only prove the presence of bugs, or in this case, exploits... but it can prove the presence of exploits, and that is valuable data. (At least, it can prove it reasonably well; false positives are a problem, but, well, that's life.) Absence of exploits may not prove you're safe, but presence certainly proves you aren't, and if your friendly pet automated scanner can find it, so can everybody else's automated scanner. I'd be comfortable saying "this can give you a false sense of security"; useless is far too strong.
  • borski 13y ago
    My guess is homakov was being sarcastic / kidding.
  • homakov 13y ago
    You're mostly right, but along with working scanner people should hire an auditor to fix real bugs. Or it is just useless, spending a lot of money annually for scanner forgetting about real vulns.