this post was submitted on 21 Aug 2026
157 points (98.8% liked)
Technology
87550 readers
3475 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I'm a stickler for security but any time I mention concerns even to project owners and seasoned engineers I only get vacant stares. Don't trust anything cloud to keep your data safe. Nobody cares.
Yeah, the number of times I heard “that’s an edge case” when it came to security so we didn’t have to invest dev time was maddening. One of my old employers, if you know the right URL to call, you can just mass print whatever you want from the open internet. But because it’s an “internal application” it was deemed not a concern, simply because most of the people who are intended to use it wouldn’t know how to inspect network traffic.
So much security through obscurity, or worse the dev doesn't know how to do it properly and doesn't have time to learn it. So many completely open blob storage buckets allowing full read write, cors * * *, I'll roll my own authentication, database with plain passwords. "No one should be able to get to there anyway"
Boss wouldn’t even listen to using a nonce per call because the caller and target used different databases. Same back end, just different databases.