ray

Life Coach, Conspiracy Theorist, and Absurdist. I do AppSec in my non-spare time for money. My opinions are now your opinions, but at least you are now right!

[ray @Raybeorn]

So I have a mastodon account now. I haven't really been using Twittter much lately. hit me up

https://t.co/fuk6iUxOZ8

[ray @Raybeorn]

@glumGPT @koronkowy Yeah lacey is cool

[ray @Raybeorn]

@Jo3Ram But yeah secure design decisions are key

[ray @Raybeorn]

@Jo3Ram OSS usually requires a lot of time to set up properly. Most need rotisserie gold solutions, just set it and forget it

[ray @Raybeorn]

@thatsjet @shehackspurple I have been using software for a long time, i can’t say that things have gotten worse but it hasn’t gotten better. The business incentives aren’t there

[ray @Raybeorn]

@thatsjet @shehackspurple What is this quality thing you speak of?

[ray @Raybeorn]

@shehackspurple I think it is dependent on the development culture. Some might need more security support others might need less

[ray @Raybeorn]

@Jo3Ram Its very rare where there is a product out there that surprises me

[ray @Raybeorn]

@glumGPT @BSidesPDX The badge is pretty cool tho. Gotta love the squach themes they always provide

[ray @Raybeorn]

@glumGPT @BSidesPDX I am but only on Saturday

[ray @Raybeorn]

@Jo3Ram I’ll hit you up next week and we can figure something out

[ray @Raybeorn]

@Jo3Ram Is it devs or security people or both?

[ray @Raybeorn]

@shehackspurple @sec_tigger @0xTib3rius @OWASPTop10 @owasp

[ray @Raybeorn]

@sec_tigger @0xTib3rius @shehackspurple @OWASPTop10 @owasp Hey avi, the data is there for anyone to look at? If so, then someone could make a top 10 vuln list if they wanted?

[ray @Raybeorn]

@0xTib3rius @sec_tigger @shehackspurple @OWASPTop10 @owasp Do you work with a lot of devs directly? I do, i prefer this approach better compared to the 2013 version which was calling out specific vulns. But i could be wrong

[ray @Raybeorn]

@0xTib3rius @sec_tigger @shehackspurple @OWASPTop10 @owasp It literally says top 10 web application security risks. No where does it say the top 10 vulns on their page ( with a quick ctrl + f search )

[ray @Raybeorn]

@0xTib3rius @sec_tigger @shehackspurple @OWASPTop10 @owasp That is why it doesn’t have 11 items on it

[ray @Raybeorn]

@0xTib3rius @sec_tigger @shehackspurple @OWASPTop10 @owasp It is literally a top 10 dude

[ray @Raybeorn]

@0xTib3rius @sec_tigger @shehackspurple @OWASPTop10 @owasp It’s an awareness doc for devs about things they should be concerned about. I think it kinda has just out grown being about vulns. When it was about vulns it wasn’t very helpful to people actually fixing shit. Plus who fucking cares.

[ray @Raybeorn]

@endingwithali I think just changing the admin password is enough. Most people should be fine.