|
Kent Sharkey wrote: Because cookies are meant for sharing?
Tell that to my kid... you risk to get bitten if you approximate your hand to the cookies plate.  
M.D.V. 
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
In a new survey of over 165 developers, AppSec and DevOps professionals, application security automation company ShiftLeft finds that 96 percent of developers believe the disconnect between developer and security workflows inhibits developer productivity. After all, think of all the development you can do to clean up after a security issue
Shockingly, the news report comes with a sales pitch.
|
|
|
|
|
Kent Sharkey wrote: In a new survey of over 165 developers,
Just... WOW.
165...what a representative sample 
On the other hand... No sh1t, Sherlock. Doing things right requires skills and good plans. That slows down things, yes... but only for a while. Once you get used to is way more natural and needs very few time.
That's why security should be taught from the very beginning, instead of so many "Learn XXX in 21 days" there should be more "Learn how to use XXX right"
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
Can't help but think that in this case 96% of those developers aren't really productive - producing insecure code shouldn't be regarded as productive, but counter-productive.
"If you don't fail at least 90 percent of the time, you're not aiming high enough."
Alan Kay.
|
|
|
|
|
I was yesterday told to remove that null check I had added after experiencing a crash in a fuction I was reviewing, caused by a reference in a composite parameter structure being null, but this reference was used without checking.
The guy making the call to this function where I had added the null check requested the null check to be removed, as he now had fixed that structure with the null pointer - it would always be non-null from now on. So please remove the null check in the function - it isn't needed, now that the pointer is not null any more!
The function in question is a general directory browsing wrapper; it might be called from dozens of places. The pointer in question referred to "onChange" actions. This case was our first where there was no onChange handler. So the proper "fix" is not to refrain from calling an onChange when the pointer is null, but to reqiure all callers to provide an onChange handler even if there is no need for it; make it as a NoOp function them!
I haven't removed the null check yet. I think it is crazy to spend resources on making code less robust, more vulnurable to irregular parameters. This guy making the demand is younger than me, but higher in the hierarchy, so I may have to give in to his demands. But it hurts my professional soul doing it.
|
|
|
|
|
I feel your pain, having found myself in similar situations in the past. In one case, not being allowed to fix an obvious potential null reference in C++ code, because no bug had been raised.
How an end user is supposed to raise a specific bug on an issue that will cause the application to ungracefully terminate is beyond me. It simply meant that when the bug reared its ugly head, some other dev would have to spend hours tracking it down.
I'm all for change control processes, but no so fixed they don't allow obvious preemptive bug fixes to be applied.
"If you don't fail at least 90 percent of the time, you're not aiming high enough."
Alan Kay.
|
|
|
|
|
With support for WinUI 3.0, the cross-platform Uno development environment is an important alternative to Xamarin Because nothing says 'future-proof' than picking the latest shiny thing
Still, it does look nice. And hey - Webassembly hasn't been hacked to death. Yet.
|
|
|
|
|
No application ever written, or that will ever be written, is future proof.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
Facebook Research unveils new lightweight prototype that's just 9mm thick. "I wear my sunglasses at night. So I can, so I can, keep track of the visions in my eyes"
|
|
|
|
|
I wonder which film story will be the first jumping to the real life...
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
From now on people with sunglasses are added to the 'look-out-for-danger' list...
 - Can you tell what he is looking at?
"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012
|
|
|
|
|
Leave it to the ingenuity of digital criminals to dispense with the need for a physical credit card and instead devise a way to gather the same data through online transactions. Beware of websites with icons!
I knew they were up to no good.
|
|
|
|
|
One thing must be said: they are elephanting creative. But... Why the fvck should an image be able to run code? Is something I can't understand yet.
And...
Quote: Cyberthreat security firm Sophos recommends keeping plugins up to date with the latest security patches and also advises online merchants to change the default Wordpress username in settings from "admin" to something harder for hackers to determine.
As if the latest version of plugins were always clean and had no risks...
Changing default passwords for someone giving a service should be a MUST
Normal users are bothered with password policies, but they allow the default settings to stay? Really?
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
Had to look that up, too. There's a StackOverflow question on the favicon trick from 2011, btw...
The attack does not run in your browser, but on the server. When the browser requests favicon.ico, some code inserted into that file is run. For more details, see
https://blog.sucuri.net/2019/07/the-strange-case-of-the-malicious-favicon.html[^]
That is: as a user of that web site, you have no chance to detect it, and hence no chance to protect yourself. Great.
Oh sanctissimi Wilhelmus, Theodorus, et Fredericus!
|
|
|
|
|
Microsoft is making available its learning content, certifications, and job-seeking tools to try to help the estimated 25 million people worldwide whose jobs have been impacted due to the coronavirus pandemic. "He who can, does. He who cannot, teaches"
|
|
|
|
|
Kent Sharkey wrote: "He who can, does. He who cannot, teaches"
Don't forget: write articles about best practices or things like that.
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
AWS releases the AI code and app analysis tool its teams have been using to reduce computing infrastructure costs. 'It really looks like you could be calling more Amazon(tm) services here'
"$0.50 to run CodeGuru Reviewer over each 100 lines of code
CodeGuru Profiler pricing is based on the total number of sampling hours, charged at $0.005 per hour. "
Well, I know how it's going to save me money...
|
|
|
|
|
I thought you were joking with the prices... 
Kent Sharkey wrote: Well, I know how it's going to save me money...
Yeah, I think there will be a lot of people ignoring it.
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
To "run CodeGuru Reviewer" will cost us about $20,000 (does it review PHP too?)... So obviously it WILL BE a great saving...
"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012
|
|
|
|
|
Since providing useful information is apparently too hard for ZDNyet to do, it only works with Java/JVM and AWS serverless stuff.
Amazon CodeGuru - Amazon Web Services
...which is a bit of a pity since my AWS app is C#. The code review tool is insanely priced if you want to do anything beyond looking at new code in PRs; but at 12 cents/server/day the profiler would have been a bargain if it returned useful data.
Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius
Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies.
-- Sarah Hoyt
|
|
|
|
|
The rise of the DevOps model means that app environments are moving faster and running on a larger scale than they did a decade ago. In a word: duh
|
|
|
|
|
Kent Sharkey wrote: are moving faster and running on a larger scale than they did a decade ago.
and don't forget being abandoned or screwed up even faster.
M.D.V. 
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
The new engine won't show ads and won't collect or profit from user data—instead, it will charge its users a subscription fee. It will be missed (very soon)
|
|
|
|
|
Ars Technica wrote: The new engine won't show ads and won't collect or profit from user data—instead (at least until their existance is in danger), it will charge its users a subscription fee.
FTFY
Either is (as you said) going to dissapear soon, or they are going to get caught in the future and say "Oops (I did it again)"
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
I look forward to next month's article where they are found to be collecting and selling data about you, but claim it was simply a bug in their code.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
