5 ms·

Securing data is a daunting state to be in; it's not a task, but a lifestyle. Out of 100 average web developers only a handful take security into account durin

Securing data is a daunting state to be in; it's not a task, but a lifestyle. Out of 100 average web developers only a handful take security into account during design and fewer still think and work through what's necessary to keep anything safe at all. It's no wonder that popping servers is so trivial and even high value targets with dedicated security teams and constant proactive threat response get pw0nd daily.

x5n1 11y ago
It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. You want a full-stack developer that also deal with security, as they say good luck with that. Knowledge in web development is always incomplete because there is simply not enough time to learn everything. So web developers and software developers are necessarily hackers. All of them. It is impossible for a software developer to be an expert because the domain of knowledge is beyond an individual's comprehension. So good luck adding security to the repertoire of already overworked people who are doing the jobs of 3 different people and usually earning a pittance for all the work they are doing. You want security, then hire a security expert to oversee the development and ensure security. Pay him or her 60,000-70,000 to ensure that. Otherwise forget about it, not going to happen. Your developer is already too busy as he or she is.
- CaptSpify 11y ago
  > It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. ?por que no los dos? I agree that the stack is crazy-huge these days, and shifting too much to solidly learn everything. We should still expect devs to try and integrate security through the entire thing though
  - x5n1 11y ago
    Sorry but your expectation will not be met. You might be able to get better security, like for instance avoid SQL injections but it's a question of whether you think security is an all or none game. That either it's totally secure or a few known well known attacks are usually mitigated. A few attacks, sure. Secure. I don't think so. The attack surface is too large and the timelines too short to ensure anything other than, it works. Just like we do QA you need security reviews that follow QA, a security team needs to review the code for just that security. Some of it can be automated, other stuff needs to be carefully studied. You can expect to add 20-30% to the final cost to account for something like this.
- vbezhenar 11y ago
  Security is easy. Do not trust user input. In any framework or library just identify user inputs and treat them carefully. Hard part is to remember that.
  - voltagex_ 11y ago
    No, no it's really not. https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 and that's only Web security.
    - vbezhenar 11y ago
      Almost all of those items are exactly what I wrote: do not trust user input.
      - voltagex_ 11y ago
        There has to be a middle ground between saying "security is simple" and "the sky is falling". I think stating things like "don't trust user input" risks things like https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.html https://kivikakk.ee/cryptography/2016/02/20/breaking-homegro... happening. Security is hard, programming is hard, we should all get better at both.
      - deleted 11y ago
        [deleted]
      - x5n1 11y ago
        Session fixation - a commonly-used session-based attack - can be prevented simply by giving a user a new session ID whenever they obtain a new level of permission on a site (for instance, after they successfully login).
  - Terr_ 11y ago
    Requirements from clients are also a form of untrustworthy input :)
_delirium 11y ago
It's not only the software developer side, but also the business side that doesn't take it seriously. Businesses currently see only the upside in aggregating ever-larger pools of crosslinked data. Schneier's article here is pointing out the downside: collecting big centralized pools of data is an accident waiting to happen, a giant pile of toxic waste stored in rusty drums, which businesses are happily piling more waste onto as fast as they can.
- craigmccaskill 11y ago
  More than that but there's no regulatory push (outside of maybe healthcare?) to require stringent handling of peoples data. If anything the opposite is true where the government wants people to build a specific backdoor for them. This is certainly one of the reasons I've become more aware recently of the amount of data certain companies have on me. Data breaches have the potential to be catastrophic and very few people are looking out for my best interests.
pbreit 11y ago
Shouldn't this be fairly standardized and easy by now?
- pdkl95 11y ago
  You can't standardize vigilance.
XorNot 11y ago
Part of this is our fault in implementing security libraries though. Let's face it: SSL has a terrible user experience when it doesn't work. While "just fail" is good practice, it's way too difficult to use in development across multiple languages compared to just using unencrypted traffic.

x5n1 11y ago

It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. You want a full-stack developer that also deal with security, as they say good luck with that. Knowledge in web development is always incomplete because there is simply not enough time to learn everything. So web developers and software developers are necessarily hackers. All of them. It is impossible for a software developer to be an expert because the domain of knowledge is beyond an individual's comprehension. So good luck adding security to the repertoire of already overworked people who are doing the jobs of 3 different people and usually earning a pittance for all the work they are doing. You want security, then hire a security expert to oversee the development and ensure security. Pay him or her 60,000-70,000 to ensure that. Otherwise forget about it, not going to happen. Your developer is already too busy as he or she is.

CaptSpify 11y ago
> It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. ?por que no los dos? I agree that the stack is crazy-huge these days, and shifting too much to solidly learn everything. We should still expect devs to try and integrate security through the entire thing though
- x5n1 11y ago
  Sorry but your expectation will not be met. You might be able to get better security, like for instance avoid SQL injections but it's a question of whether you think security is an all or none game. That either it's totally secure or a few known well known attacks are usually mitigated. A few attacks, sure. Secure. I don't think so. The attack surface is too large and the timelines too short to ensure anything other than, it works. Just like we do QA you need security reviews that follow QA, a security team needs to review the code for just that security. Some of it can be automated, other stuff needs to be carefully studied. You can expect to add 20-30% to the final cost to account for something like this.
vbezhenar 11y ago
Security is easy. Do not trust user input. In any framework or library just identify user inputs and treat them carefully. Hard part is to remember that.
- voltagex_ 11y ago
  No, no it's really not. https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 and that's only Web security.
  - vbezhenar 11y ago
    Almost all of those items are exactly what I wrote: do not trust user input.
    - voltagex_ 11y ago
      There has to be a middle ground between saying "security is simple" and "the sky is falling". I think stating things like "don't trust user input" risks things like https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.html https://kivikakk.ee/cryptography/2016/02/20/breaking-homegro... happening. Security is hard, programming is hard, we should all get better at both.
    - deleted 11y ago
      [deleted]
    - x5n1 11y ago
      Session fixation - a commonly-used session-based attack - can be prevented simply by giving a user a new session ID whenever they obtain a new level of permission on a site (for instance, after they successfully login).
- Terr_ 11y ago
  Requirements from clients are also a form of untrustworthy input :)

_delirium 11y ago

It's not only the software developer side, but also the business side that doesn't take it seriously. Businesses currently see only the upside in aggregating ever-larger pools of crosslinked data. Schneier's article here is pointing out the downside: collecting big centralized pools of data is an accident waiting to happen, a giant pile of toxic waste stored in rusty drums, which businesses are happily piling more waste onto as fast as they can.

craigmccaskill 11y ago
More than that but there's no regulatory push (outside of maybe healthcare?) to require stringent handling of peoples data. If anything the opposite is true where the government wants people to build a specific backdoor for them. This is certainly one of the reasons I've become more aware recently of the amount of data certain companies have on me. Data breaches have the potential to be catastrophic and very few people are looking out for my best interests.

pbreit 11y ago

Shouldn't this be fairly standardized and easy by now?

pdkl95 11y ago
You can't standardize vigilance.

XorNot 11y ago

Part of this is our fault in implementing security libraries though. Let's face it: SSL has a terrible user experience when it doesn't work. While "just fail" is good practice, it's way too difficult to use in development across multiple languages compared to just using unencrypted traffic.