Ultimate Streisand effect - I have literally never heard of this app that seems geared towards drug users; and yet I learn about it from it's incompetance.
How do people release public API's without THE MOST BASIC OF SECURITY CHECKS. Really? You can add a friend without any checks and even send messages as someone else? Christ.
A) Who funds these guys?
B) How can I get a piece of that seemingly-easy-as-hell-to-get pie?
I triggered executive-level uproar just yesterday by pointing out what should have been obvious security issues in an API we were about to be asked to integrate with. I was not the first technical person to look at the document we were given, and in fact I was the only one to look at it who couldn't actually read it in detail (it was in Chinese, I only speak English, but the identifiers were in English), but nobody else had spotted the problem.
I'm not a roving security consultant, so my sample size is limited, but I have seen little evidence that even basic security awareness is part of the toolkit any substantial number of developers have.
I was a security specialist at a large software company for a couple of years, and I did some developer training.
I'm not a roving security consultant, so my sample size is limited, but I have seen little evidence that even basic security awareness is part of the toolkit any substantial number of developers have.
Agreed, and I think that's when a (good) CS education makes the difference, by helping you grasp how t design and code for security, which are fundamental concepts that a lot of "junior" developers have no clue about. And then you see the same basic attack vectors creeping up all the time...
I have no CS education. I don't have any degree, or even a high school diploma. Most of those around me have had CS or related degrees, many from quite well-regarded programs, but there has been no apparent correlation to security awareness. To the extent they have an edge, it's in mathematical analyses and algorithm design/implementation[0], which are of limited direct use in most day-to-day things like noticing "this endpoint uses plain HTTP", "this isn't an HMAC, also serial numbers aren't secret keys", or "a 4-digit PIN is not a secure password".
[0] And even then, I've wondered more than once what the hell goes on in CS programs when I've found myself explaining concepts like entropy and the difference between speed and scalability.
I can definitely see a developer's concerns being brushed aside as a "business decision" on the grounds that growing their userbase or adding new features is more important to the startup's survival than security at that time.
It's actually a pretty damn good line, and I think it's really, fantastically hard to know when your ethical responsibility as an engineer starts to outweigh your obligations as an employee.
Comments
Ultimate Streisand effect - I have literally never heard of this app that seems geared towards drug users; and yet I learn about it from it's incompetance.
How do people release public API's without THE MOST BASIC OF SECURITY CHECKS. Really? You can add a friend without any checks and even send messages as someone else? Christ.
A) Who funds these guys?
B) How can I get a piece of that seemingly-easy-as-hell-to-get pie?
I triggered executive-level uproar just yesterday by pointing out what should have been obvious security issues in an API we were about to be asked to integrate with. I was not the first technical person to look at the document we were given, and in fact I was the only one to look at it who couldn't actually read it in detail (it was in Chinese, I only speak English, but the identifiers were in English), but nobody else had spotted the problem.
I'm not a roving security consultant, so my sample size is limited, but I have seen little evidence that even basic security awareness is part of the toolkit any substantial number of developers have.
I was a security specialist at a large software company for a couple of years, and I did some developer training.
My experience matches yours.
Agreed, and I think that's when a (good) CS education makes the difference, by helping you grasp how t design and code for security, which are fundamental concepts that a lot of "junior" developers have no clue about. And then you see the same basic attack vectors creeping up all the time...
I have no CS education. I don't have any degree, or even a high school diploma. Most of those around me have had CS or related degrees, many from quite well-regarded programs, but there has been no apparent correlation to security awareness. To the extent they have an edge, it's in mathematical analyses and algorithm design/implementation[0], which are of limited direct use in most day-to-day things like noticing "this endpoint uses plain HTTP", "this isn't an HMAC, also serial numbers aren't secret keys", or "a 4-digit PIN is not a secure password".
[0] And even then, I've wondered more than once what the hell goes on in CS programs when I've found myself explaining concepts like entropy and the difference between speed and scalability.
I can definitely see a developer's concerns being brushed aside as a "business decision" on the grounds that growing their userbase or adding new features is more important to the startup's survival than security at that time.
It's actually a pretty damn good line, and I think it's really, fantastically hard to know when your ethical responsibility as an engineer starts to outweigh your obligations as an employee.