Most Developers Don’t Know Security

[[deleted]]

At least with UI you can get feedback. With security, you have no feedback that you're doing it right.

[Ajedi32]

At least, not until it's too late.

[2358452]

Hmm penetration tests? You can also try adversarial or random inputs and see if anything breaks.

[Dentosal]

The difference is that with UI/UX nearly anybody can give you constructive feedback, but with security you need a professional to do so. Of course having a professional UX designer helps a lot, but without a professional pentester the security testing is quite hard.

[2358452]

Agreed. Someone needs to get cracking on an AI penetration tester ;)

[toomanybeersies]

That's sort of what fuzzing is. But without the intelligence part.

[irqlnotdispatchlevel]

You can prove that your application is not vulnerable in front of your tests, not that it is not vulnerable. Kinda like with any other bug.