News for hackers. Stuff that matters.

A comment on Stealing checks worth millions and pwning a bank. Parent comment

Re:Stealing checks worth millions and pwning a bank by curiousllama on Monday May 16, 2022 @05:12PM (#31403195)
Think a bit more. Why have QA? If there are bugs, the SWEs should have caught them with their test suite. Think even more. Why bother with a test suite? The code should be written correctly the first time. (this is sarcasm)

People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.

[ Parent | on HN ]
Re:Stealing checks worth millions and pwning a bank by blueflow on Monday May 16, 2022 @05:21PM (#31403262)
It works like this in every other engineering discipline. Except for software, were we somehow pretend that these level of bugs are something normal.

Even the avionics and carmakers get software right, why cant we?

[ Parent | on HN ]
Re:Stealing checks worth millions and pwning a bank by paulryanrogers on Monday May 16, 2022 @11:49PM (#31405837)
Other engineering fields don't do independent third party testing?

Do they deploy multiple times daily? Deal with vague sometimes contradictory client requirements? Do their tools and platforms change daily?

[ Parent | on HN ]
Re:Stealing checks worth millions and pwning a bank by thomjrob on Monday May 16, 2022 @07:59PM (#31404464)
What? Avionics and carmakers definitely don't get software right...
[ Parent | on HN ]
Re:Stealing checks worth millions and pwning a bank by curiousllama on Tuesday May 17, 2022 @12:30AM (#31406046)
Funny you mention carmakers. Wouldn’t a crash test be the carmaker equivalent to a penetration test?
[ Parent | on HN ]
Re:Stealing checks worth millions and pwning a bank by blueflow on Tuesday May 17, 2022 @10:46AM (#31411488)
crash tests verify what the designers already predicted. You don't blindly construct a car and then crash-test it to safety in a trial & error manner.
[ Parent | on HN ]