5 ms·

The joke is that Xbow only works because they have close to 100 employees operating the software

_pdp_ 1y ago
You are joking, but there was actually a very popular enterprise SAST tool that used to offer a "cloud" version of their software. It worked by having someone from their team manually download the zip file of your code, run it through their desktop software, and then upload the results back to make them visible in the web portal.
- ericmcer 1y ago
  That's a totally valid and useful way to validate an idea. After a few months of manual labor they will have a good idea of how/what to build and if it is even worth building.
  - ai-christianson 1y ago
    Classic thing that doesn't scale.
    - 0cf8612b2e1e 1y ago
      That seems like something that totally scales? Just requires some GUI automation (which can be quite finicky, so good to have a manual backup).
  - codys 1y ago
    Unless the lack of real time (or consistent time to) results drives down interest in the cloud version, or instead of driving down interest makes it appear as if people want something different than what they would want if the time to results was consistent/faster. Still could be worth doing a bit of manual work like this, but it's worth being cautious about drawing conclusions from it.
  - tptacek 1y ago
    It is if you can keep a baseline level of quality uniform across both your customers and each of your customers projects. It's less OK if the human-assisted output is a loss-leader you burn on the pilot project, the first couple projects, or high-profile customers. There's nothing fundamentally bad about having Oompa Loompa's behind the scenes, as long as you're honest about the outcomes you can provide. I agree, though: also a very sensible way to prioritize development work.
  - Steeeve 1y ago
    There's a reason Amazon's Mechanical Turk exists.
- deleted 1y ago
  [deleted]
- tptacek 1y ago
  I know who you're talking about, but also: this is the joke about basically every hosted SAST and DAST tool. I call it the "Oompa Loompa" model of security products.
guhcampos 1y ago
"XBOW is an AI-powered penetration testing platform that delivers human-level security testing at machine speed." At least they're not lying right? It's just people using computers.
- waihtis 1y ago
  yeah i think XBOW is fairly transparent about it, doesn't stop the online influencers from claiming "an AI is now the #1 hacker on Hackerone"

You are joking, but there was actually a very popular enterprise SAST tool that used to offer a "cloud" version of their software. It worked by having someone from their team manually download the zip file of your code, run it through their desktop software, and then upload the results back to make them visible in the web portal.

ericmcer 1y ago
That's a totally valid and useful way to validate an idea. After a few months of manual labor they will have a good idea of how/what to build and if it is even worth building.
- ai-christianson 1y ago
  Classic thing that doesn't scale.
  - 0cf8612b2e1e 1y ago
    That seems like something that totally scales? Just requires some GUI automation (which can be quite finicky, so good to have a manual backup).
- codys 1y ago
  Unless the lack of real time (or consistent time to) results drives down interest in the cloud version, or instead of driving down interest makes it appear as if people want something different than what they would want if the time to results was consistent/faster. Still could be worth doing a bit of manual work like this, but it's worth being cautious about drawing conclusions from it.
- tptacek 1y ago
  It is if you can keep a baseline level of quality uniform across both your customers and each of your customers projects. It's less OK if the human-assisted output is a loss-leader you burn on the pilot project, the first couple projects, or high-profile customers. There's nothing fundamentally bad about having Oompa Loompa's behind the scenes, as long as you're honest about the outcomes you can provide. I agree, though: also a very sensible way to prioritize development work.
- Steeeve 1y ago
  There's a reason Amazon's Mechanical Turk exists.
deleted 1y ago
[deleted]
tptacek 1y ago
I know who you're talking about, but also: this is the joke about basically every hosted SAST and DAST tool. I call it the "Oompa Loompa" model of security products.

guhcampos 1y ago

"XBOW is an AI-powered penetration testing platform that delivers human-level security testing at machine speed." At least they're not lying right? It's just people using computers.

waihtis 1y ago
yeah i think XBOW is fairly transparent about it, doesn't stop the online influencers from claiming "an AI is now the #1 hacker on Hackerone"