Conversation

Notices

1. Embed this notice
   abadidea (0xabad1dea@infosec.exchange)'s status on Monday, 20-Jan-2025 23:53:56 JST abadidea

   • Carlo Zancanaro

   @airtower @carlozancanaro Some customers are good and send everything that could be relevant, but most just want to right click on a source folder and make a zip and hear back from me in a month.

   I’ve had to argue with some customers that yes, I need to see some SOURCE CODE to conduct a source code review. They seemed to expect me to be telepathic.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Monday, 20-Jan-2025 23:53:55 JST Rich Felker

     in reply to

     • Carlo Zancanaro

     @0xabad1dea @airtower @carlozancanaro They want a free pentest for their source file hosting included with the source audit. 🤪 😈

   • Embed this notice
     Andrew Zonenberg (azonenberg@ioc.exchange)'s status on Tuesday, 21-Jan-2025 00:35:10 JST Andrew Zonenberg

     in reply to

     • Carlo Zancanaro

     @0xabad1dea @airtower @carlozancanaro I've had quite a few cases where the SOW said we were supposed to be doing X given Y, and then once work started we were told that there was no way in hell we were actually going to get Y.

     Sometimes it's like pulling teeth to get a *binary* much less source code. Which is fine if we're allowed to open the widget up and dump the flash, but if the ROE doesn't allow that...

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 21-Jan-2025 00:35:10 JST Rich Felker

     in reply to

     • Andrew Zonenberg
     • Carlo Zancanaro

     @azonenberg @0xabad1dea @airtower @carlozancanaro Master agreement needs terms that refusal to provide Y vacates the requirement for delivery of X but not for payment. 🤪