Hacker News Reader

It's a bad audit checklist! If OWASP volunteers can't do a good one, they should just not do one at all. It's fine for them not to cover things that are outside their expertise.

View on HN

Which one would you recommend instead? Referring dev teams to NIST standards or the like doesn’t work well in my experience.

There doesn't always have to be a resource. Sometimes no resource is better than a faulty one. Cryptography is one of those cases.

Reply on news.ycombinator.com