alt Hacker NewsThe thing is I cannot even imagine a way that bug could exist that is not outright negligence.
A unit test becoming prod data? That’s really all I’ve got and that’s pretty unforgivable.
Replies
I've integrated with production APIs that tell the client to encrypt sensitive data using an IV consisting of 16 null bytes.
Some people just follow a spec and don't stop to think what that spec is supposed to accomplish.
Correct. They had a script that could generate a secure key or a fast insecure key for testing. The script generated both at the same time.
Human error was selecting the wrong output file and promoting it forward.
It's not at all the kind of thing you want to see in a reliable, secure, mature process... There shouldn't be a step where a human even makes a choice there.
And it's exactly the kind of thing most companies are doing, most of the time, more often than we would like.
An awful lot of the world runs on spit and bailing wire and things too easy to automate yet, and the parts that don't cost more.
It's easier to imagine if it was malicious.