News for hackers. Stuff that matters.

A comment on Third High Severity CVE in Log4j Is Published. Parent comment

Re:Third High Severity CVE in Log4j Is Published by TedDoesntTalk on Saturday December 18, 2021 @03:53PM (#29608397)
Even with an audit and 100% unit test coverage, and static code analysis, vulnerabilities slip through. Software is not perfect and you do not have a silver bullet.
[ Parent | on HN ]
Re:Third High Severity CVE in Log4j Is Published by klyrs on Saturday December 18, 2021 @03:58PM (#29608436)
I'd agree if this was the first CVE. But that got some attention to log4j, which quickly exposed two more CVEs. There's no such thing as perfect, but these problems almost certainly would have been caught by a competent security audit.
[ Parent | on HN ]
Re:Third High Severity CVE in Log4j Is Published by TedDoesntTalk on Saturday December 18, 2021 @04:25PM (#29608669)
Has any of your software been through a security audit? Mine has. It’s 99.9% OWASP coverage with some automated fuzzing with almost no imagination applied by the auditors. You’re assigning far too much ability to auditors.
[ Parent | on HN ]
Re:Third High Severity CVE in Log4j Is Published by klyrs on Saturday December 18, 2021 @04:33PM (#29608738)
Upthread, I mentioned that I've been party to it three times. And yes, auditor skill and methods vary.
[ Parent | on HN ]