Thank you for consistently being a source of reason in these types of posts. I come here often to look how the wider software community feels about security, and to see if people understand how dire the entire software security situation is.
And I'm usually unpleasantly surprised, but I can deal with it, I know most developers don't have the knowledge to deeply understand if something is really really bad or just a small problem. But now I'm finally at a point where I wonder if people will ever understand. We have critical vulnerabilities in widely used software coming out every other day, we get exploits for (on a technical level) very hard to exploit vulnerabilities in record speed, and yet non-security people still spout "full weaponized PoC or it isn't real" like it's 1999 (not that I was old enough to know that was happening at the time).
I don't understand why nobody believes that security people might know a thing or two. Is it just that it's so much more convenient to close your eyes and pretend that nothing is wrong? I wonder what needs to happen to allow us all to finally have a conversation about how we can make sure that the software that runs all aspects of our life gets more secure.
And I'm usually unpleasantly surprised, but I can deal with it, I know most developers don't have the knowledge to deeply understand if something is really really bad or just a small problem. But now I'm finally at a point where I wonder if people will ever understand. We have critical vulnerabilities in widely used software coming out every other day, we get exploits for (on a technical level) very hard to exploit vulnerabilities in record speed, and yet non-security people still spout "full weaponized PoC or it isn't real" like it's 1999 (not that I was old enough to know that was happening at the time).
I don't understand why nobody believes that security people might know a thing or two. Is it just that it's so much more convenient to close your eyes and pretend that nothing is wrong? I wonder what needs to happen to allow us all to finally have a conversation about how we can make sure that the software that runs all aspects of our life gets more secure.