Tag Info

New answers tagged

4

The particular site linked in that BBC article is not launching attacks. It simply is checking the HTTP headers of the website you enter and decides if the site is vulnerable or not based on if it can identify the version of open SSL it is using, the date of the certificate and a database of known vulnerable sites. It does this because this is all public ...


1

The core question, is it ethically wrong to make a change that the boss / client etc. does not want, yet would increase security, the answer is quite simple. Yes. It's wrong. Let me ask the question in another way: How would you react if I went and made unauthorized (by you) changes to your tax return? The change, in an of itself, is both legal, and ...


2

One big problem about fixing something when being told not to do so is that you might be wrong in some point: perhaps it's not a real bug / hole; perhaps it is but some other layer of the application prevents it from leaking perhaps it is a bug, it might lead to leaks, but your app isn't in the radar so it might not be discovered simply because nobody took ...


3

Every fix is a business decision. The business needs to make the call. You, as the one with the knowledge, need to properly inform and guide the business through the matrix of needs and costs. Optimally, there are policies and procedures in place to identify and incorporate fixes over time based on cost and priority, but unfortunately, not all do. As for ...



Top 50 recent answers are included