91–100 of 108 posts
Earlier quoted context omitted.
I am a pretty cookie cutter developer. We just make glorified CRUDs and I have tried to convince the engineering director hundreds of times that "There is no use of encrypting and decrypting localstorage with a key thats sitting right inside the client code." Yet they keep insisting on it in the code-quality checklist.
I guess they think it results in some kind of security by obscurity... Maybe ward off lazy beginner hackers..
Earlier quoted context omitted.
I understand why someone might this this is a pay issue, but it's goes beyond that. Culturually, doing something "well"(quality oriented, mindful of end-users) vs. "got it done" (transaction, pragmatic way of looking at things) is the heart of why outsourcing to many different geographical areas (India included) often results in something different than expected. Also condemning every one in one part of the world as…
Everyone is saying it’s about pay, but India is a low trust country (so far as large datasets saying as much can be trusted). Anecdotally I have heard the same from my expat friends as well. I’m not saying pay has no influence, but saying culture has no influence makes no sense. Even if it was all about pay, wealthy Indians choosing to horde their wealth instead of distribute it (caste system, etc) is a cultural root…
> As recently seen with Intel, there seems to be a trend where developers will do this pointless client-side decryption. When the client has the key, it’s strange that anyone would think that would be secure. I stay and work in India. Yesterday, as part of a VAPT audit by a third party auditor, the auditors "recommended" that we do exactly this. I wonder if this directive comes as part of some outdated cyber security…
> As recently seen with Intel, there seems to be a trend where developers will do this pointless client-side decryption. When the client has the key, it’s strange that anyone would think that would be secure. I stay and work in India. Yesterday, as part of a VAPT audit by a third party auditor, the auditors "recommended" that we do exactly this. I wonder if this directive comes as part of some outdated cyber security…
You’re right, of course, but this reminds me of when Chrome didn’t obscure your passwords when looking at its autofill settings. The developers argued that it would just be security by obscurity -- if somebody has access to your computer when it’s unlocked, they can do anything they want, so obscuring your passwords does nothing. The counter-argument is, even if it’s not perfectly secure, that extra bit of friction b…
Are there any open source tools that scans the code and detects such gaffes
stupid question, can we not make a regex for searching API keys for particular APIs and do a brute force scan across the internet
Users in India wouldn't care that much about privacy of their data as much as the Western folks do. This reduces the importance of this whole episode and I don't think this news flashed across TV screens or caused a debate anywhere. India is a karma society. Karma doesn't mean upvotes. It means, you get what you destined for, or what you deserve. People take things in their stride and keep moving, while keeping their…
India is not a "karma" society, India is a 'jugaad' society where everyone does just enough to get by. The lack of civilizational will power to fix things which slightly harm the entrenched elite is very well known. (case in point - the recent stray dogs issue where the life of common man was put in danger because some rich animal welfare aunties protested against it).
Thankfully Indian gen Z at least accepts these problems. Look at the memes on the gen Z spaces. Internet has let them know that living standards can be much better and other countries have risen from similar poverty levels. So there's some hope.
You can't keep doing this 'india is not for beginners' forever.
Users in India wouldn't care that much about privacy of their data as much as the Western folks do. This reduces the importance of this whole episode and I don't think this news flashed across TV screens or caused a debate anywhere. India is a karma society. Karma doesn't mean upvotes. It means, you get what you destined for, or what you deserve. People take things in their stride and keep moving, while keeping their…
So basically you are saying that India is a society that is still soaked in an ideology that justifies the special privileges of temple staff and tells peasants that being a sharecropper in a rent for protection racket is their own fault, so hand it over, and moreso that you approve. You sound like every temple staff worker ever. Grow up.
In practice most of Brahmins have been peasant agriculturists, teachers and clerics for centuries, and temple priests have been deservedly pretty poor unless they also had inherited land.
The current PM of India is from what is considered as "other backward caste".
Just noting it, so that your overly reductive american journalism won't convince you that India is a feudalist society where 5% "temple staff" rule over the 95% peasants or whatever. The caste system is mostly limited to ritual avtism and some nepotism (which happens among boomers across all castes but younger ones don't care).
> As recently seen with Intel, there seems to be a trend where developers will do this pointless client-side decryption. When the client has the key, it’s strange that anyone would think that would be secure. I stay and work in India. Yesterday, as part of a VAPT audit by a third party auditor, the auditors "recommended" that we do exactly this. I wonder if this directive comes as part of some outdated cyber security…
I am a pretty cookie cutter developer. We just make glorified CRUDs and I have tried to convince the engineering director hundreds of times that "There is no use of encrypting and decrypting localstorage with a key thats sitting right inside the client code." Yet they keep insisting on it in the code-quality checklist.
It’s semantics in terms of actual difference to an attacker, but it’s a world of difference when explaining to executives.