Re:SoftBank’s $375M bet on pizza went bad fast
by sillysaurusx on Saturday February 15, 2020 @05:49PM
(#22338574)
The only part that matters is the penetration test bit. And it's out of your control as a rank-and-file engineer.
Those who don't accept this are like doctors who don't accept that washing their hands is the important part, not the care and emotional sensitivity that goes into treating a patient.
Re:SoftBank’s $375M bet on pizza went bad fast
by eropple on Saturday February 15, 2020 @06:00PM
(#22338630)
That's not true. Testing is reinforcement of that competence and that good design, it does not replace it. Relying on penetration tests to secure your systems has an implicit dependency on the completeness of those tests--and putting armor over the bullet holes isn't how you keep a plane in the air.
Re:SoftBank’s $375M bet on pizza went bad fast
by sillysaurusx on Saturday February 15, 2020 @06:05PM
(#22338662)
A pentest reports findings, and then regardless of how incompetent the programmers are, they are required to fix them. Then a retest happens, which verifies that the findings were fixed.
I've seen a trading application go from "typing ' will result inn SQL injection" to "basically bulletproof" due to this process.
Devs can become remarkably competent when their smugness is wiped away by finding some crucial vulnerabilities they overlooked.
I know it's tempting to believe that the design part matters, but it's also tempting to believe that a doctor's emotional support matters just as much as washing your hands.
Do a stint in the pentest industry. It's eye-opening. (Look into my eyes. I've seen things. Terrible... things...)
And when it is done, I will endeavor to hit it as absolutely hard as I can to break it. I will advocate for regular penetration tests and audits, and I will throw an absolute goddamned fit when they don't happen. (My current company retains very little personal information and we still put ourselves through a pretty rigorous security audit at least once a year. A measure of "do thou likewise" is fair.)
The fun part is I don't even call myself an "engineer", because I'm not and I can't be with the tools and practices I have at my disposal. I'm a software developer, just like about 99.9% of this industry. I just happen to care a little, and I just happen to try to do better.