undefined | Better HN

0 pointsdanpalmer5y ago0 comments

This is something that a company with a mature security posture needs though. Yes it's hard, but that's the point.

There are many ways to work around this, having teams whos incentives are tied to finding issues, maybe in a different reporting chain or office or country to those writing the software is one way.

0 comments

UnpossibleJim5y ago

I think incentivizing and anonymizing issue finding by restructure sound like amazing ideas, to be honest. Having batch issues come in to the devs via bug tracking software and conversations be labeled with a user ID rather than name would make a world of difference; so would basic professionalism. An understanding that it isn't team against team. Sdets (and manual testers) are not adversaries to devs or management... Though, I think a lot of devs realize this but project management/producers have a harder time understanding this. This is where I think a basic understanding of coding and the development pipeline would help a lot.

But, here we are. In the real world =/

j / k navigate · click thread line to collapse

0 pointsdanpalmer5y ago0 comments

This is something that a company with a mature security posture needs though. Yes it's hard, but that's the point.

There are many ways to work around this, having teams whos incentives are tied to finding issues, maybe in a different reporting chain or office or country to those writing the software is one way.

0 comments

UnpossibleJim5y ago

But, here we are. In the real world =/

j / k navigate · click thread line to collapse