Yep, exactly my thoughts. Unfortunately very few developers really think (about related but not completely adjacent code) when they implement stuff (and that’s when they are even “allowed to” by the task requirements) and even fewer have true knowledge of security and common pitfalls and whatnot to avoid such issues.
And even when you have those you still need good practices and code reviews where the rest of the slip ups is caught.
You’re correct. And I don’t think we are armchair coding. We know proper security is so hard that even experienced developers can write code vulnerable to something like a timing attack. But sending secure data to unvalidated input isn’t a minor slip up that could happen to anyone. They are either unaware of or not bothering with good practices.
Yep, exactly my thoughts. Unfortunately very few developers really think (about related but not completely adjacent code) when they implement stuff (and that’s when they are even “allowed to” by the task requirements) and even fewer have true knowledge of security and common pitfalls and whatnot to avoid such issues.
And even when you have those you still need good practices and code reviews where the rest of the slip ups is caught.
You’re correct. And I don’t think we are armchair coding. We know proper security is so hard that even experienced developers can write code vulnerable to something like a timing attack. But sending secure data to unvalidated input isn’t a minor slip up that could happen to anyone. They are either unaware of or not bothering with good practices.