Yeah, the number of times I heard “that’s an edge case” when it came to security so we didn’t have to invest dev time was maddening. One of my old employers, if you know the right URL to call, you can just mass print whatever you want from the open internet. But because it’s an “internal application” it was deemed not a concern, simply because most of the people who are intended to use it wouldn’t know how to inspect network traffic.
So much security through obscurity, or worse the dev doesn’t know how to do it properly and doesn’t have time to learn it. So many completely open blob storage buckets allowing full read write, cors * * *, I’ll roll my own authentication, database with plain passwords. “No one should be able to get to there anyway”
Yeah, the number of times I heard “that’s an edge case” when it came to security so we didn’t have to invest dev time was maddening. One of my old employers, if you know the right URL to call, you can just mass print whatever you want from the open internet. But because it’s an “internal application” it was deemed not a concern, simply because most of the people who are intended to use it wouldn’t know how to inspect network traffic.
So much security through obscurity, or worse the dev doesn’t know how to do it properly and doesn’t have time to learn it. So many completely open blob storage buckets allowing full read write, cors * * *, I’ll roll my own authentication, database with plain passwords. “No one should be able to get to there anyway”
Boss wouldn’t even listen to using a nonce per call because the caller and target used different databases. Same back end, just different databases.