A mistakenly published password exposed Mercedes-Benz source code

Re:A mistakenly published password exposed Mercedes-Benz sou... by realusername on Wednesday January 31, 2024 @12:39PM (#39206805)

I'm not saying professional auditors are useless, just that they will never reach the feedback you get from peer reviews and are not a replacement for peer reviews anyways.

We're not in the 90s anymore and it's time to acknowledge that the software world and even the world in general has changed. Knowledge is now spread and the most knowledgeable devs aren't working at an audit firm and might not even hold a computer degree!

[ Parent | on HN ]

Re:A mistakenly published password exposed Mercedes-Benz sou... by mratsim on Wednesday January 31, 2024 @02:33PM (#39208234)

The people who found the bug in glibc worked at an audit firm.

Peers aren't enough. Finding vulnerabilities require training and an adversarial mindset that is rare.

There is a reason why in cryptography people say "don't roll your own crypto"

[ Parent | on HN ]