Conversation

Notices

1. Embed this notice
   Soatok Dreamseeker (soatok@furry.engineer)'s status on Sunday, 22-Feb-2026 06:21:13 JST Soatok Dreamseeker

   Me: "If this API is prone to misuse by a careless or clueless developer, that is a security issue that needs fixing."

   Me: "If the tests pass even if I change the logic of the source code, then the test doesn't actually cover it. I don't care what the code coverage metrics say."

   Me: "The threat model needs to state its assumptions as well as both risks both mitigated and not mitigated."

   Other projects, apparently: "Well this attack is outside our threat model so we're dismissing your report, but we'll eventually fix it as a defense-in-depth if we really must I guess."

   Step up your game.

   • Embed this notice
     SpaceLifeForm (spacelifeform@infosec.exchange)'s status on Sunday, 22-Feb-2026 07:40:21 JST SpaceLifeForm

     in reply to

     @soatok

     These days, when I hear that the problem is outside of their threat model, then I conclude that they are the threat model.

   • Embed this notice
     icrawler (icrawler@ioc.exchange)'s status on Monday, 23-Feb-2026 01:29:19 JST icrawler

     in reply to

     @soatok
     I feel you and admire your resolve for all these pro bono works you're doing.. Also your adventures ;) keep me moving forward and endure as well, so thank you.

     i.e. I recently discovered that some SDK includes a home grown crypto protocol that basically allows a related-key attack... (at that the 'crypto' part was missing in docs thus not easily findable via threat modeling process) It took weeks to persuade a responsible party to seek an independent consultation to confirm my finding , while an initial response was that they don't want to waste precious resources to beautify the code. And I didn't seek neither money nor fame, just wanted to make the world a better place ;)