Re: Charging customers on security

On Tue, Sep 28, 2004 at 04:29:19PM -0400, Wesley Shields wrote:
> 
> Yes, and there is no excuse for not expending that effort.  Keeping the
> cost to a customer low is a sound business decision, but it quickly
> becomes outweighed by the number of bugs left open when not expending
> the effort to fix them because it will cost more money.

So what do you do when you are consistently outbid by developers
who make the code work, and don't care about security - and the PHB's
buy their services instead of yours?

There are plenty of excuses to not extend that effort. That is what
spawned this whole discussion - how do you persuade the PHB that
you actually are worth more money because your code will be secure?

> Personally, I'd rather pay more to know that the code was developed as
> best as it can possibly be developed than to pay less knowing there are
> some bugs.

What you'd rather do doesn't help when the person buying doesn't.

Jesper