News for hackers. Stuff that matters.

A comment on 14 Years of SQL Injection and still the most dangerous vulnerability. Parent comment

Re:14 Years of SQL Injection and still the most dangerous vu... by eli on Thursday August 22, 2013 @11:59AM (#6257944)
Sure, probably true. But I would assume most people who write insecure code do so because they don't know how to do it the right way, not because "must be secure" wasn't in the requirements doc.
[ Parent | on HN ]
Re:14 Years of SQL Injection and still the most dangerous vu... by dragonwriter on Thursday August 22, 2013 @01:39PM (#6258620)
If security (operationalized properly) was part of the requirements against which it was evaluated prior to release, insecure code wouldn't be released.

("Must be secure" is a much higher level requirement than anything that is testable, but a high level requirement is meaningless except to the extent its operationalized into lower-level requirements that are testable -- or analytically provable, but that's even harder.)

[ Parent | on HN ]