5 ms·
Sounds like a convenience feature for a dev that they forgot to remove before distribution, since it's this poorly hidden.
by lemagedurage 2mo ago
Sounds like a convenience feature for a dev that they forgot to remove before distribution, since it's this poorly hidden.
- sph 2mo agoIn computer security, never attribute to ignorance that which is adequately explained by malice.
- torginus 2mo agoDunno, if I were to backdoor a piece of my code, I would definitely put in an exploit instead of a deliberate bypass. Plausible deniability is important. A lot of the stuff I worked on already had glaring issues like that without me having to add it..
- hnlmorg 2mo agoYou’ve got the saying backwards: “Never attribute to malice that which is adequately explained by stupidity.” https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor
- psychoslave 2mo agoLooks like this time you interpreted the message in a malicious way.
- hnlmorg 2mo agoHow? Neither their comment nor mine have anything malicious in their tone nor content.
- psychoslave 2mo agoUnfortunately, explaining a joke won’t make it funny afterward I guess.
- hnlmorg 2mo agoAs someone who really doesn’t take themselves even the slightest bit seriously, if there was ever a chance that your comment was funny then I would have realised it was a joke. ;)
- deleted 2mo ago[deleted]
- jchw 2mo agoPretty sure the point was to invert it. :)
- hnlmorg 2mo agoYes, I got their point. My point is that’s the opposite of reality.
- naruhodo 2mo agoHis point is that in security, the opposite applies. The supposed "incompetence" is just plausible deniability for a malicious act.
- hnlmorg 2mo agoYes, and my point is that hasn’t been the case in my experience.
- natebc 2mo agoIt's because you (like me) aren't quite as paranoid as security people are. Personally I couldn't sleep at night if I was security people. It's really a matter of context. Security people tend to only be involved when things are already nefarious where as boring old normal people like us see get to see the mundane everyday mistakes so not just the nefarious bits.
- deleted 2mo ago[deleted]
- coldpie 2mo agoI'm a security people. I can say with confidence that a tiny, tiny, tiny, tiny fraction of these security issues are deliberate. Almost all of them are just dumb mistakes because making good software is really hard and really, really expensive and there is no market incentive to make good software. You don't need to get hired at the safe factory to build an elaborate back door into the production line if safes are actually just cardboard boxes, you know? It's possible the backdoor is deliberate, I have no idea in this particular case, but the more likely situation, absent more information, is that someone who is earning a middling wage just added the "feature" and didn't think about the security implications because no one cares about computer security.