> Security is a Non-Functional Requirement. NFRs don’t bring any competitive advantage and cost money. In short, they divert the budget from business requirements to /dev/null. That’s at least how most business departments see it.

(blog.frankel.ch/running-untrusted-code)

remember when @MechMK1 asked when we would have secure coding and I said never? This guy summarizes it perfectly.

Security is a non-functional requirement Costs money, costs time, increases the complexity, so almost every shop don't employ security during design, and those who employ some security only does that by the force of regulation.

it's like the security systems for cars: they only got into production because government mandates it. down here in Brazil, just recently cars must have airbags to be sold. I don't know when cars were mandated to have airbags for you guys... it's not mandatory, so it's not implemented.

that's why the VW Bus was still in production here, even if the car have no way to be secure, and the windshield is inches away from your forehead and the bumper is a few inches farther...

Had a little chuckle at how the "State of Javascript" survey user data got leaked. Though probably I should be more sad over how this could have happened in the first place.

@AlphaD At least the way they handled it was applaudable. Much better than I would have normally expected.

@nobody yea agreed, it's hard to admit to something like this when they could have just easily kept silent about it

@ThoriumBR Security also happens to be a bit of an emotional topic for some devs, sometimes sysadmins as well.

Being told "You have a vulnerability in your code" or "Your infrastructure is vulnerable" is sometimes understood as "Are you too fucking stupid to do your job properly?"

So some devs or sysadmins get very defensive and actually defend their insecure program or infrastructure as "actually being secure", because they don't like admitting that what they made isn't flawless

Completely unrelated, I play way too much Tarkov. I recently went for a walk after sunset, saw someone move past a parked car and my literal first instinct was to say "Silver car, solo, 25 ahead"

Honestly, I love going on hunting trips on Woods. Just get comfy in a bush, watch the main street with the Armasight Vulcan MG 3.5x night vison scope on your SV-98 and wait. 200m down the street is the Bridge car extract. Two dead bodies on the ground already. One more approaching. Does he realize what is going on? One shot, one more dead body. He didn't. 3 PMCs and 4 scavs later, head to the exfil yourself. Easy money.

@MechMK1 Oh... Should I not say things like "Are you stupid?" in my bug reports?

I've never said that, but I have mentioned that I'm just bug hunting in my spare time at work, and that I don't have much experience with the technologies, and still managed to find a PoC after a few hours...

@FireQuacker I have had some moments, unironically, where I made remarks that could be considered offensive. Things like "Vulnerabilities like this should not occur in recently-developed software" or "This is a more basic vulnerability, which should have been recognized by an experienced developer"

How to say things without saying them

"Welp, I guess everybody makes rookie mistakes every now and then ;)"

If you put an emoji on the end of a sentence, it keeps people from being offended. Pretty sure that's how it works.

@FireQuacker I've been working with that assumption too for a very long time. I really hope it is actually true.

"I'm impressed by the retro coding quality of your team! This is the sort of bug that I thought got eliminated from the Internet 10 years ago."

@nobody It better be or you're bad at interacting with people :P

See, I included an emoji so you can't get offended

@FireQuacker I know for a fact that I am bad at interacting with both people and computers so you couldn't have offended me there anyways.

I once called a dev "Mr Thread"...

he made a multi thread software without semaphores

@FireQuacker "I banged your wife ;)"

"And your sister ;)"

No, she did that for me

;)

wtf did I just walk into

The imaginary relationships, existing solely for the purpose of a joke, are magnitudes more interesting than my real relationships, which can best be summed up as "and then she ghosted me"

I'm playing the game "cope or rope" every single day :D