News for hackers. Stuff that matters.

A comment on The Correct Way to Validate Email Addresses. Parent comment

Re:The Correct Way to Validate Email Addresses by mgkimsal on Thursday September 08, 2016 @10:48AM (#12453479)
Take that one 'request' - possibly initiated by a jr-mid level developer - and stack it up against the 500 other todo items in the pipeline. You can make those arguments about "statistically increases the risk of people picking weaker passwords " - unless this increases a bottom line or comes out of someone else's budget, this sort of 'bug' is going to be really low down on the totem pole for all the reasons I mentioned, and a few others.

You can says "the process is broken" but it's also that same process that got people where they are, puts food on their table, pays for the lifestyle, and precious few people are willing to ever rock the boat at any company for anything.

[ Parent | on HN ]
Re:The Correct Way to Validate Email Addresses by WorldMaker on Friday September 09, 2016 @11:27AM (#12463082)
Which gets back to some of the cargo cult thing too. It's not uncommon in a large enterprise to smack up against things like "Years ago we paid a highly trained Security Consultant a large amount of money to develop our Security Guidelines, who are you and where are your security credentials to tell us to do things differently?"

Even worse when that "Security Consultant" is still a retained coworker with a fiefdom to maintain by war at all costs, a wizened old greybeard whose seniority will always trump yours, and/or your boss.

[ Parent | on HN ]