• @froztbyte
    link
    English
    84 months ago

    “better late than never”

    if it already got force-deployed, start noting risks and finding the problem areas you can identify post-hoc, and speaking with people to raise alert level about it

    probably a lot of people are going to be in the same position as you, and writing about the process you go through and whatever you find may end up useful to others

    on a practical note (if you don’t know how to do this type of assessment) a couple of sittings with debug logging enabled on the various api implementations, using data access monitors (whether file or database), inspecting actual api calls made (possibly by making things go through logging proxies as needed), etc will all likely provide a lot of useful info, but it’ll depend on whether you can access those things in the first place

    if you can’t do those, closely track publications of issues for all the platforms your employer may have used/rolled out, and act rapidly when shit inevitably happens - same as security response

      • @froztbyte
        link
        English
        84 months ago

        whenever any of this dogshit comes up, I have immediately put my foot down and said no. occasionally I have also provided reasoning, where it may have been necessary/useful

        (it’s easy to do this because making these calls is within my role, and I track the dodgy parts of shit more than anyone else in the company)

        • @SurpriZe@lemm.ee
          link
          fedilink
          English
          24 months ago

          Hm, that’s good to have such authority on the matter. What’s your position?

          I’m struggling with people who don’t fully understand what this is all about the most.

          • @froztbyte
            link
            English
            54 months ago

            my position is “the hell with all this clown-ass bullshit”