[delfinom]

Yep, I think my megacorp's cybersecurity department is just a bunch of checklist punchers that now just copy and paste any of our technical writeups into ChatGPT, and I am not even joking. Fucking infuriating.

They are doing the bare minimum for cybersecurity insurance requirements, thats it.

[rfgplk]

I know _for a fact_ that most companies don't care. There might be a select few out there that genuinely do, but most don't. I've literally reported numerous GLARING vulnerabilities to companies in various different industries, only for the vulnerabilities to remain unpatched for MONTHS. Few of the most comical examples, one major game studio was compiling their Linux binaries with FULL DEBUG SYMBOLS AND INFO plus they were shipping a 600M .sym file with practically full paths and all source info. Literally all the paths and function signatures to every single one of their functions was in there. I had to submit FOUR bug reports before they patched it (didn't even receive a bug bounty). The second one was with a major multinational telecom that was distributing routers that _had an open telnet port to the wide internet_ ... with a default password. And there were countless more. The telecom one I had to BEG them to ship me a new router, or to at least do an over the air update, because "they didn't understand what the problem was".

[nradov]

Shipping debug symbols isn't a security vulnerability. It might be sloppy, but we all know that security through obscurity doesn't work. Especially not with modern analysis tools and access to the executable code.

[zdragnar]

That's what it means to be a cost center. Anything over the minimum translates to wasted effort and inefficiency.