Old school SAST advice from a senior dev came back to bite me

My old lead, Dave, told me back in 2018 that static analysis was a waste of time for our Rails app because we'd never catch real bugs. I listened to him because he had 15 years of experience and I was just starting out. Fast forward to 2022, we had a nasty SQL injection slip through that a basic tool like Brakeman would have flagged instantly. Cost us about 30 hours of emergency patching and a sweaty call with the client. I still wonder how many other issues we missed during those years of ignoring SAST. Has anyone else gotten bad advice from a senior person that set them back on security?

2 comments

2 Comments

lopez.simon1mo ago

Man, yeah that stings. I had a similar situation a few years back where a senior guy told me linters were just for style and wouldn't catch anything real. I listened because he had been doing it longer than me. Then we had a bug where a typo in a variable name caused data to get written to the wrong user profile. A basic linter would have flagged that variable as undefined before it even ran. After that mess, I started running Brakeman and RuboCop on every push, no exceptions. It wasn't perfect but it caught a handful of real issues in the first month alone. Now I tell any junior that tools are cheap insurance, and your mileage may vary on how much they help, but I'd rather have them and not need them than need them and not have them.

jana1191mo ago

So my buddy learned this the hard way too. He was working at this startup and a senior dev told him "we don't need linters, they slow down the build." My buddy listened because what did he know, right? A few weeks later they had a data leak where someone misspelled a variable name and it sent customer emails to the wrong address list. Not a huge leak but it got out and they had to send apology emails to everyone. After that his boss made linters mandatory on every single push and they caught three real bugs in the first week alone. Isn't it funny how we have to learn by watching things blow up first before we listen?