Coming this close on the heels of the security audit by NCC [1] is pretty embarassing for all parties.

[1]https://www.pingcap.com/press-release/tidb-ncc-group-securit...

hintymad 11 hours ago | parent | next [-]

> TiDB, the open-source distributed SQL database powered by PingCAP, today published the results of a rigorous source-code security assessment by NCC Group, one of the world’s leading cybersecurity consultancies.

It looks like you can assess the hell out of your source code, but your system can still leak if you don't secure your operations.

	▲	somat an hour ago \| parent [-]
		There was a quote from back in early web days that has stuck with me, Still relevant today. "good opsec will save you from bad crypto. but the converse is not true, good crypto will not save you from bad opsec"

▲

kobieps 12 hours ago | parent | prev | next [-]

From personal experience having worked with multiple "enterprise-grade" pentest vendors (including NCC), I think the entire pentest industry is overdue for a big shake-up.

▲

jacquesm 4 hours ago | parent | prev [-]

No particular opinion on NCC but a lot of that stuff is pay-to-play.