There is unreasonable amounts of leverage in both software and security by communicating the blessed path to do something and making it more easy and obvious to take the blessed path and harder, crufty, and scary to take the non-blessed path.
-
Show this thread
-
This can be as easy as forcing an engineer to type the word "unsafe" to do things that are unsafe. (And then you can audit for that, grep for it, discourage it in training, encourage people to push back in code reviews, etc.)
2 replies 3 retweets 33 likesShow this thread -
Corollary: DON'T MAKE THE SAFE PATH THE HARDER ONE. This includes e.g. safely_query_the_database() over query()
2 replies 13 retweets 60 likesShow this thread -
That should be query() versus unsafely_query_the_database_i_know_what_i_am_doing_and_this_will_not_blow_up_because_we_had_a_review_meeting_about_it()
3 replies 4 retweets 56 likesShow this thread
Replying to @patio11
mysql_real_escape_string >_> (It's not even the real one anymore)
10:04 PM - 8 Feb 2019
0 replies
0 retweets
0 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.