Taxonomy of In-the-Wild Exploitation

Interesting, and not just in the "memory safe languages will save the world" sense.

Most of my bugs are either in the category 'logic' or 'ux'. For the former, unit tests remain the best defense IMHO, but there's always that insidious class of data-driven logic bugs.

UX tends to be the most frustrating bug class. Like: there is a separate view in my app to allow users to do X. Yet, users insist on doing X by abusing feature Y, which gives a partial-but-sometimes-wildly-wrong result.

My solution to that is to obsessively monitor user action logs, and to modify the abused view to still give the right results (through an annotation) in case it detects the 'wrong' use case.

One day, I will figure out how to properly talk to customers...