Performing audits/pen tests with a public report is a maddening balance of being adversarial to the company paying you. It's incredibly stressful to the consultants involved, and at least when I was selling them didn't really pay much better. (Thread)https://twitter.com/dguido/status/1254260710470815744 …
-
Show this thread
-
Firms willing to do them are putting their reputation on the line, and the consultants doing them know that they are doing the same. And firms like Trail of Bits, which is an established high quality firm, could do perfectly fine never selling one of these again.
1 reply 0 retweets 3 likesShow this thread -
Especially now that the market is flush w/ firms who do them, operating at very different quality. It's hard for someone outside the industry to distinguish the quality of a report between two companies. This plays in heavily to the adversarial nature and the sales process.
1 reply 0 retweets 2 likesShow this thread -
But nonetheless ToB sees to be putting out more and more of these, and illustrating to competitors, newcomers, and students what a quality security audit looks like - not just in terms of technical findings, but public relations and client management.
1 reply 0 retweets 3 likesShow this thread -
And TBH I think it's only possible in a smaller firm. Owned by someone who has the right amount of.... principal? Or maybe spite? to do what is monetarily disadvantageous. And staffed by people who are so good, earning a reputation, that companies seek them out regardless.
2 replies 0 retweets 3 likesShow this thread
It certainly requires more nimble communication than most firms are capable of. Blockchain software is also unique: everyone has a copy of the code they run, and must trust it ultimately. You'll notice we have 10x the public reports for them vs typical software.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.