Question
What is the difference between a flaw and a bug in software?
Answer
A flaw is a defect in the design; a bug is a defect in the implementation.
The distinction matters because the two are caught and fixed in very different ways:
| Flaw | Bug | |
|---|---|---|
| Where it lives | Architecture / design decision | Code / implementation detail |
| How it's found | Design review, threat modelling | Code review, testing, static analysis, fuzzing |
| How it's fixed | Redesign — often expensive, may require rewrite | Patch the offending lines |
| Example | "We store session tokens in localStorage" (XSS will leak them) |
strcpy(buf, input) with no length check |
Tip: Bugs you can find with a debugger. Flaws you can only find by thinking about the system. That's why threat modelling exists — testing alone won't catch design-level issues.
Go deeper:
Software bug — Wikipedia — the taxonomy of defects, from design errors to implementation faults.
Note saved — thanks!
Question
The threats facing a web application can be grouped by where along the path they strike — the user, the connection, or the server. What lands in each group, and why is that a useful map?
Answer
Three zones: the user is tricked or infected, the connection between user and server is intercepted or ridden, and the server is flooded or fed malicious input.
* Threats sorted by where along the path they strike — the fixer for each zone differs. *
Sorting a scary list of threats by location turns it into a map — and the location tells you who has to defend it, because each zone fails for a different reason.
| Zone | Threats | What they exploit |
|---|---|---|
| The user | Social engineering, spear phishing, malware | Human trust and the endpoint — no protocol flaw needed |
| The connection (user ↔ server) | Man-in-the-middle, session hijacking, session fixation, CSRF | Unauthenticated traffic and the browser auto-attaching cookies |
| The server | SYN flood, IP spoofing, SQL injection, XSS | The server accepting any connection and trusting its input |
Quick gloss on the application-layer ones that target the server (covered in depth elsewhere):
- SQL injection — unsanitised input changes the meaning of a database query (
' OR 1=1 --). - Cross-site scripting (XSS) — attacker-supplied script runs in another user's browser under your site's origin.
- CSRF (Cross-Site Request Forgery) — a third-party page makes the victim's browser fire an already-authenticated request to your site, abusing the cookies the browser sends automatically.
Tip: The zone names the fixer. User zone → awareness + endpoint security; connection zone → TLS everywhere + sane session/cookie handling; server zone → input validation, rate-limiting, and never trusting the network.
Note saved — thanks!