Sorry sil for my previous post. Engligh isn't my mother tongue and although I rare use this as an excuse, I really made a mistake.
I think exactly like you. I hate scaring people because, like you said, they start acting in panic mode. They also start to look at you with doubts. So I am sorry for what I wrote, I didn't mean that at all.
But again, we do different things. While you are a pentester, I work more with developers. They may not be IT security experts, but most of them can handle some technical stuff. They may not know the difference between a bind and a reverse shell, but they know it's a shell.
When you show to a developer that, for example, you were able to get a shell on the server through SQL injection because they didn't validate user input, they get scared! They understand enough to be scared.
So I really meant that, once you can demonstrate to them the risks associated with their action, and they realize the impact of these risks (and therefore, their actions), then they become aware like you said (and some scared a bit I guess).
But you are right, if I go see a car mechanic and he tells me: "You are crazy driving this car with almost no breaks. See how close you came to kill your family!!!", I wouln'd like it. I would much prefer him to tell me: "You really need to consider fixing your break ASAP. Here's how we can do it".
Thanks sil for explaining me you point so nicely!
News Items and General Discussion About EH-Net : Change is Coming to EH-Net!!
