4 ms·
Just because a company is big, or even a government agency does not mean they have the skill. I've worked for both, and the real security expertise (when they b
by Spearchucker 12y ago
Just because a company is big, or even a government agency does not mean they have the skill. I've worked for both, and the real security expertise (when they bother) is usually brought in through consultants. The apathy around security in both the public and private sectors is astounding. I keep hearing that it's difficult to get right. It's not. It does take some up-front thought though (security is not a bolt-on/refactor thing, it needs to be built in from the start), and a LOT of work. I know because I've gone through it (https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-4117-af17-c923ff855456 https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-411...).
- munin 12y ago> I keep hearing that it's difficult to get right. It's not. ... > and a LOT of work ????????
- Spearchucker 12y agoDifficult (intellectually challenging) != hard work (back-breaking, sweat-inducting).
- shard 12y agoThat's cherry-picking non-intersecting definitions though. Difficult can also be work that involves a lot of physical or mental effort, not necessarily confined to just intellectually challenging. Hard work can also refer to work that requires mental effort or mental stamina, and does not only refer to highly physical labor.
- Spearchucker 12y agoThat is indeed cherry-picking, and was my intent. Bluntly, most devs I ask about their lack of ability in the security space think they're not smart enough to get it right, so don't even bother to try.