Re:Our security auditor is an idiot. How do I give him the i...
by jiggawatts on Sunday June 18, 2023 @08:19PM
(#36385892)
My favourite is the nineteen meetings it took to convince a security team to approve the use of unencrypted HTTP for the certificate revocation list endpoint.
No amount of RFC references, live demos of “see, www.google.com does it with HTTP also” would tick the checkbox.
“We have a security standard, sir.” over and over, for months.
No amount of RFC references, live demos of “see, www.google.com does it with HTTP also” would tick the checkbox.
“We have a security standard, sir.” over and over, for months.