0
votes
1answer
165 views

Making Agile and DevOps methodology compatible with PCI requirements [closed]

Would like to hear from those working in a PCI compliance environment and is practicing agile development and devops methodology, how you maintain compliance with PCI requirements. Specifically, what ...
23
votes
11answers
1k views

Should I accept to write unsecure code if my employer requests me to do so?

My employer asked me to implement a feature that would require storing passwords in clear text in a database (or using an obscure encrypt/decrypt function stored in a binary, which is a bit better, ...
0
votes
1answer
213 views

Legal Requirements for Software Makers

Since the Legal site of Stack Exchange isn't ready quite yet, I figured this would be the best place to ask this question. What are, if any, the legal requirements (or online resources for finding ...
3
votes
4answers
352 views

Are there laws to protect us from hackers who disclose vulnerabilities prior to alerting the vendor?

Take the example of the recent ASP.NET (and Java Server Faces) vulnerability disclosure at a Hacker conference in Brazil. It's my understanding that the poet tool was demonstrated before Microsoft ...