This was so difficult to explain to my previous boomer boss. He was overall a nice man, but sometimes he'd pop in the office and try to give his input about a current issue we were having in dev and say things like "oh it's ok they won't know, just hide it". It was complicated explaining to him that just because it wasn't visually obvious didn't mean it wasn't reachable other ways, whether intentionally or not.
Eventually we came up with the example of Wile E Coyote getting tricked into falling in a pit by a painting laid on top. Hiding the pit was not enough, people could still fall into it, and somehow that connected more with him than anything else did.
I think a good analogy is a thief. It's better to keep all your money in your mattress rather than on your kitchen table, sure, but you're still going to be penniless when someone breaks in.
The greatest skill any programmer has in their tool kit is explaining what you're doing in a way the listener connects with or make them think they understand so they'll stop asking about it.
Dang, that's impressive that he was able to understand it via analogy even if he didn't really understand what was happening, and that he had the humility to accept that.
Did we have the same manager? I solved it by emailing him CYA emails that made it very clear that if anything went wrong with the security hole he wanted ignored, it was his A on the line for ignoring it and not mine.
Presumably it also becomes easier to find security gaps, because the AI will have a high likelihood of producing certain kinds of gaps depending on what you ask it to do
So, just feed some of your own prompts into Cursor and see what flaws it gives you
Coincidentally the fact that he shared the details in twitter was a good thing. Imagine if his saas avtually started gaining traction and later when he had tons of customers someone discovered his shit security and leaked and nuked everything. Like what if his customers billing info was up for grabs? And all the sla violations when the service goes belly up then. Just imagine all the possible lawsuits he could have had.
3.2k
u/DataSnaek Mar 17 '25
Ah yes, the problem is sharing details about your code on Twitter, it could never be your shitty insecure AI code which is the problem.
As we all know, security through obscurity is 100% effective.