How are engineers who introduce XSS issues on production systems "ok" in 2021?
Makes me doubt the rest of your statement too. But mainly because I'm actually a Apple user myself so I know for a fact that neither the software nor the hardware people to be "top".
I can only assume they mean "ok" in the sense of "the large fraction of less-sophisticated engineers who only want to think about the happy paths in their code."
Github's co-pilot is a poor code generator, but it's a fair example of how bad a lot of public code is. I'm not sure private code tends to be much better in many orgs.
I work in QA at one of the BIG ones on hardware/software, and you would be scared how little top backend/frontend devs care about security, other than pluging in some common solution. I'm right now detecting vulnerabilities, I'm running test cases, writing reports with clear descriptions and screenshots of the holes in the system, and yet I'm pretty sure all of that will go into the managerial sewer because they don't want to take the costs of solving it. But I'm sure if I point to the company/project I'll be kicked out of my job.
I’ve worked on contracts for data integration projects for both financial and healthcare providers. There is a shocking lack of concern about code correctness, security, privacy, etc. And code quality? Pshaw, just pump out a solution, even if it’s a nasty hack instead of a well-considered solution.
Probably not. QA can't really stop devs from shipping buggy code (depending on release pipeline/processes). Of course a top-notch security team should have audited these services and the infrastructure around them, considering it's Apple...
Yup, My experience has been usually needing to give QA a list of strings with SQL / script injection. As well as Unicode strings with characters outside the BMP tho emojis now usually cover that case.
