Re:Coding Flaw Exposes Voter Details for 6.5M Israelis
by vkou on Tuesday February 11, 2020 @03:50PM
(#22302691)
> i'm sorry but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext (and for something related to politics above that) hasn't ever set foot in a computer science class.
I've set foot in ~20 computing science classes, out of a ~134 credit-hour degree, and only one optional class ever mentioned that this sort of thing would be a bad idea.
It also didn't actually rigorously teach best practices, only mentioned a laundry list of security blunders that you probably want to avoid, without proscribing any solutions. We also were not tested on this.
And this degree wasn't in some middle-of-nowhere community college.
Also, as anyone who has ever set foot in a computer science class ought to know, these kinds of failures aren't the fault of any one person. One person may be undereducated, ignorant, lazy, stupid, or just in a hurry to ship. It's the entire organization's responsibility to provide checks and balances that prevent this sort of thing from hitting production.
I've set foot in ~20 computing science classes, out of a ~134 credit-hour degree, and only one optional class ever mentioned that this sort of thing would be a bad idea.
It also didn't actually rigorously teach best practices, only mentioned a laundry list of security blunders that you probably want to avoid, without proscribing any solutions. We also were not tested on this.
And this degree wasn't in some middle-of-nowhere community college.
Also, as anyone who has ever set foot in a computer science class ought to know, these kinds of failures aren't the fault of any one person. One person may be undereducated, ignorant, lazy, stupid, or just in a hurry to ship. It's the entire organization's responsibility to provide checks and balances that prevent this sort of thing from hitting production.