,
4 tweets,
1 min read
Read on Twitter
There is unreasonable amounts of leverage in both software and security by communicating the blessed path to do something and making it more easy and obvious to take the blessed path and harder, crufty, and scary to take the non-blessed path.
This can be as easy as forcing an engineer to type the word "unsafe" to do things that are unsafe. (And then you can audit for that, grep for it, discourage it in training, encourage people to push back in code reviews, etc.)
Corollary: DON'T MAKE THE SAFE PATH THE HARDER ONE. This includes e.g. safely_query_the_database() over query()
That should be query() versus unsafely_query_the_database_i_know_what_i_am_doing_and_this_will_not_blow_up_because_we_had_a_review_meeting_about_it()
