My security reviews and threat models force public documentation of security assumptions. Because I’m a bad person to my devs.
1 4Samuel
@samuel.fm
that is presumably like getting a small child to eat their vegetables
1 1Barry DorransTo be fair over the last 10 years it’s gotten a lot easier as they know the expectations and they’re thinking about the security implications of their apis.
But it’s kinda fun to explain it to a new dev or pm, and no, it has to be done before any preview release.
1 3Barry DorransThere are days when I wonder if what I do is worthwhile and then someone comes to me with questions they’ve prepared for and thought through potential security problems and solutions.
1 2Barry DorransBut the real fun is intern security reviews. Our interns write real code which can become part of the product so midway through they get a security review and I won’t give them answers, I give them research so they can figure it out. Usually works too, sometimes it’s too niche and I guide them.
2