The simple fact of the matter is that both user and software designer are at fault. I design software and I know the pressure (external and self-generated) to add all sorts of cool new features. The problem is that unless time, money and care are spent to give each new feature and release a solid review before coding even begins, not to mention after it's "done" then security issues are much more likely to crop up. Expecting users to share the blame for software designers that didn't account for security from the get go is neither fair nor sensible.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/236/25992#25992