[namaria]

I have had a developer look me dead in the eye and say "this is not a security concern, because I can't see how this can be exploited".

Security by obscurity from self. It was very hard to explain to that person what was wrong with that line of reasoning.

[immibis]

But... You have to see things that way or else literally everything becomes a security concern.. Extra whitespace before a semicolon? I don't see how it can be exploited, but with the mindset you imply, I have to treat it as a security concern. But removing the whitespace is also a security concern.

[namaria]

Yes, general computers are fundamentally unsafe. We should always think about threat models, vulnerabilities, blast radii, defense in depth.

What we should never do is dismiss something as a non-concern because we don't know how it could be a problem. Especially when someone is trying to point out something we're doing is extensively documented as a security concern. In that case it would be quite obtuse to claim in a public discussion that the person pointing it out is wrong because you don't understand the issue, and yet I have lived through that.

[D-Coder]

> It was very hard to explain to that person what was wrong with that line of reasoning.

"So... you're the smartest person in the world?"

[lazide]

It’s very hard to argue with someone who asserts ‘what I don’t know can’t hurt me’, because usually they’ll refuse to know anything that will hurt them. Like that there are things they don’t know, that can hurt them.