3 ms·

On front-end work: Learn basic front-end skills. You can go a long way with just bootstrap, jquery and some nicely resized stock photographs. There's plenty of

On front-end work: Learn basic front-end skills. You can go a long way with just bootstrap, jquery and some nicely resized stock photographs. There's plenty of nice themes around for free or only an insignificant amount of money. Consider that you'll probably be competing on this front for the most part. This and your rate. On hosting: A $5/month VPS running Debian is cheap and can handle a decent amount of traffic. On security: You don't need a security expert unless you're dealing with highly sensitive information. Follow the best practices on: https://www.owasp.org/index.php/Main_Page https://www.owasp.org/index.php/Main_Page Remember to sanitize all user input. Remember to be extra careful when you are serving user input to other users.

sdiq 11y ago
Thank you very much for your help. This would certainly go a long way in helping a self-taught 'amateur' like me.
dsacco 11y ago
Specifically regarding user input security: • Whitelist user input where possible, do not try to blacklist known dangerous characters. There are too many conflicting rendering ideologies for HTML between Chrome, Firefox and Internet Explorer for this to be feasible. For example, a language parameter's value in a POST request to change user settings should be whitelisted to things like "en" - there is no reason to allow "%0aSet-Cookie:%20", which could cause HTTP Header Injection. Absolutely do not try to be clever and sanitize specific tags like "<script>" • Thoroughly escape dangerous characters if they must be represented. Use a well-tested library for this, do not try to roll your own. • Do not allow user-input for filenames, especially if the file needs to be uploaded to a privileged directory (also avoid, where possible). OWASP is unfortunately an inconsistent guide at best. security.stackexchange and /r/netsec are better. Security is aggressively difficult. OP, if you have any more specific security questions you're welcome to email me and I'll help you out, free of charge. The absolute best thing you can do to help yourself with security right now as a self-taught programmer is to thoroughly familiarize yourself with: 1. The nuances of your chosen language, and 2. The best libraries for security, authentication and input handling in your chosen language and framework. For example, if you are a Ruby programmer you should immediately know about e.g. the dangers of passing user input to send() and how Ruby's REGEX functions a bit differently than other languages. You should also know the best authentication libraries off the top of your head and make use of them instead of trying to reinvent the wheel.

sdiq 11y ago

Thank you very much for your help. This would certainly go a long way in helping a self-taught 'amateur' like me.

dsacco 11y ago

Specifically regarding user input security: • Whitelist user input where possible, do not try to blacklist known dangerous characters. There are too many conflicting rendering ideologies for HTML between Chrome, Firefox and Internet Explorer for this to be feasible. For example, a language parameter's value in a POST request to change user settings should be whitelisted to things like "en" - there is no reason to allow "%0aSet-Cookie:%20", which could cause HTTP Header Injection. Absolutely do not try to be clever and sanitize specific tags like "<script>" • Thoroughly escape dangerous characters if they must be represented. Use a well-tested library for this, do not try to roll your own. • Do not allow user-input for filenames, especially if the file needs to be uploaded to a privileged directory (also avoid, where possible). OWASP is unfortunately an inconsistent guide at best. security.stackexchange and /r/netsec are better. Security is aggressively difficult. OP, if you have any more specific security questions you're welcome to email me and I'll help you out, free of charge. The absolute best thing you can do to help yourself with security right now as a self-taught programmer is to thoroughly familiarize yourself with: 1. The nuances of your chosen language, and 2. The best libraries for security, authentication and input handling in your chosen language and framework. For example, if you are a Ruby programmer you should immediately know about e.g. the dangers of passing user input to send() and how Ruby's REGEX functions a bit differently than other languages. You should also know the best authentication libraries off the top of your head and make use of them instead of trying to reinvent the wheel.