Comments on: But That’s Impossible!

By: no way

no way — Thu, 17 Nov 2011 18:17:13 +0000

as a developer on more of the security side than most..

about 30% of what veracode is saying is rather retarded.

By: ZeroDay Labs blog » Stay Cool, Nobody is Calling Your Baby Ugly

ZeroDay Labs blog » Stay Cool, Nobody is Calling Your Baby Ugly — Fri, 21 Oct 2011 17:48:25 +0000

[...] questions wanting to understand the situation better, the other folds his arms and fires back with responses like this. What’s the difference? One is acting defensively while the other is [...]

By: PB

PB — Wed, 27 May 2009 10:00:52 +0000

Oh hahhaa I forgot “We’re running that service on a higher port number.” Security obfuscation for the win!

By: Motoma

Motoma — Tue, 26 May 2009 20:00:48 +0000

“If the client’s are dumb enough to do ___ then they deserve what they get.”

By: veye0l8tr

veye0l8tr — Sat, 23 May 2009 06:22:51 +0000

How about “That’s a problem with the vendor software not our security”, to which my response was “If it’s a problem with the vendor software you are using then it’s a problem with your security”

or another one I hear often “how many people actually know how to do that?” to which my response is “Anyone that has an interest in breaching your security, with internet access and the ability to read.”

The script kiddie arguement mentioned above is another common thread, I usually end up explaining that Uber-hackers document methods and script kiddies can follow instructions.

By: Erich

Erich — Thu, 21 May 2009 21:53:17 +0000

“We’re certainly not in focus. Who’s gonna attack OUR minor website?”

Later on wondering, why the website is spreading malicious code to any visitor so google marks it as dangerous.

By: Timsta

Timsta — Thu, 21 May 2009 09:41:17 +0000

“The application must be secure. All our competitors use it!”

By: MikeP

MikeP — Wed, 20 May 2009 15:28:27 +0000

My own favourite: “Yeah, but who has the time to figure that out? We’re just xxx.”

By: saari

saari — Wed, 20 May 2009 05:48:56 +0000

This stuff doesn’t bother me, it’s the fundamentally broken by design issues and basic social engineering that bother me. See OAuth session fixation.

By: links for 2009-05-19 (Jarrett House North)

links for 2009-05-19 (Jarrett House North) — Wed, 20 May 2009 02:01:07 +0000

[...] But That’s Impossible! (Veracode Blog) Responses to security audits range from the funny to the sad. (tags: security) [...]