Builders vs breakers

In my humble opinion this pen testing is dead meme and this builders vs breakers thing is coming from the same source.


Improve security by implementing key security controls in applications and building these key controls so they are secure themselves . By doing "stupid human tricks" and demonstrating that controls are not implemented we are just demeaning the profession. Poking holes in key security controls such as input validation functions and authentication functions in network protocols and providing patches (if source code available) or at least suggestions is valuable and a worthy pursuit