[jameshart]

This sounds like it’s just an app development role, not a security analysis position, so I’m not sure what your complaint is.

[orangelimesoda]

> just an app development role

Maybe this is part of the problem

[solid_fuel]

Professional app development requires an understanding of security.

[corndoge]

I think the evidence contradicts you at this point

[bostik]

That's quite an indictment of the common app development practices. (Not that I disagree with your point...)

And security is hard. Because it is by definition off the happy path, it is quite often at odds with MVPs and rapid release cycles. Then you add all the ways the users can use your product to attack/abuse others.

Any non-hobbyist app development does indeed require at least a decent understanding of security.

[orangelimesoda]

So you don't need to know anything about credit cards for someone to enter it into an app? I don't get the take (is it bad sarcasm?)

[devmor]

To be fair, for the vast majority of cases, no you don't.

It is extremely rare for companies to roll their own payment processing anymore, or even handle PCI scope at all.

[orangelimesoda]

Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data?

How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find?

Can I store your SSN in plain text in a text file? Why not?

The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket policy be for all these driver's license photos - there are so many???

[lmm]

> Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data?

> How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find?

> Can I store your SSN in plain text in a text file? Why not?

You wouldn't be touching any of those unless you work for a handful of providers where that's their whole business. Usually you add the dependency, use their widget, and that's it.

[devmor]

> Credit card entry

If you're handling credit card numbers yourself, you're in a shrinking subset of developer roles. I've spent the last 7 years of my career working at payment processors, so I do handle that stuff, but the majority of my industry has built an infrastructure that makes it so most developers don't have to think about that.

To your other examples, not everyone on the team needs to know these things up front. Someone in the review process does, and eventually that knowledge gets disseminated and more people know it to carry it forward in their career.

[oenton]

To your last question about bucket policies, clearly you just need to scope it down: arn:aws:sts::*:assumed-role/trustme*/*

(indeed that first wildcard means any account)