4 ms·

It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. You want a full-stack

by x5n1 11y ago

It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. You want a full-stack developer that also deal with security, as they say good luck with that. Knowledge in web development is always incomplete because there is simply not enough time to learn everything. So web developers and software developers are necessarily hackers. All of them. It is impossible for a software developer to be an expert because the domain of knowledge is beyond an individual's comprehension. So good luck adding security to the repertoire of already overworked people who are doing the jobs of 3 different people and usually earning a pittance for all the work they are doing. You want security, then hire a security expert to oversee the development and ensure security. Pay him or her 60,000-70,000 to ensure that. Otherwise forget about it, not going to happen. Your developer is already too busy as he or she is.

CaptSpify 11y ago
> It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. ?por que no los dos? I agree that the stack is crazy-huge these days, and shifting too much to solidly learn everything. We should still expect devs to try and integrate security through the entire thing though
- x5n1 11y ago
  Sorry but your expectation will not be met. You might be able to get better security, like for instance avoid SQL injections but it's a question of whether you think security is an all or none game. That either it's totally secure or a few known well known attacks are usually mitigated. A few attacks, sure. Secure. I don't think so. The attack surface is too large and the timelines too short to ensure anything other than, it works. Just like we do QA you need security reviews that follow QA, a security team needs to review the code for just that security. Some of it can be automated, other stuff needs to be carefully studied. You can expect to add 20-30% to the final cost to account for something like this.
vbezhenar 11y ago
Security is easy. Do not trust user input. In any framework or library just identify user inputs and treat them carefully. Hard part is to remember that.
- voltagex_ 11y ago
  No, no it's really not. https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 and that's only Web security.
  - vbezhenar 11y ago
    Almost all of those items are exactly what I wrote: do not trust user input.
    - voltagex_ 11y ago
      There has to be a middle ground between saying "security is simple" and "the sky is falling". I think stating things like "don't trust user input" risks things like https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.html https://kivikakk.ee/cryptography/2016/02/20/breaking-homegro... happening. Security is hard, programming is hard, we should all get better at both.
    - deleted 11y ago
      [deleted]
    - x5n1 11y ago
      Session fixation - a commonly-used session-based attack - can be prevented simply by giving a user a new session ID whenever they obtain a new level of permission on a site (for instance, after they successfully login).
- Terr_ 11y ago
  Requirements from clients are also a form of untrustworthy input :)

by x5n1 11y ago

CaptSpify 11y ago

> It has nothing to do with web developer and everything to do with the insane state of web development and software development in general. ?por que no los dos? I agree that the stack is crazy-huge these days, and shifting too much to solidly learn everything. We should still expect devs to try and integrate security through the entire thing though

x5n1 11y ago
Sorry but your expectation will not be met. You might be able to get better security, like for instance avoid SQL injections but it's a question of whether you think security is an all or none game. That either it's totally secure or a few known well known attacks are usually mitigated. A few attacks, sure. Secure. I don't think so. The attack surface is too large and the timelines too short to ensure anything other than, it works. Just like we do QA you need security reviews that follow QA, a security team needs to review the code for just that security. Some of it can be automated, other stuff needs to be carefully studied. You can expect to add 20-30% to the final cost to account for something like this.

vbezhenar 11y ago

Security is easy. Do not trust user input. In any framework or library just identify user inputs and treat them carefully. Hard part is to remember that.

voltagex_ 11y ago
No, no it's really not. https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 and that's only Web security.
- vbezhenar 11y ago
  Almost all of those items are exactly what I wrote: do not trust user input.
  - voltagex_ 11y ago
    There has to be a middle ground between saying "security is simple" and "the sky is falling". I think stating things like "don't trust user input" risks things like https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.html https://kivikakk.ee/cryptography/2016/02/20/breaking-homegro... happening. Security is hard, programming is hard, we should all get better at both.
  - deleted 11y ago
    [deleted]
  - x5n1 11y ago
    Session fixation - a commonly-used session-based attack - can be prevented simply by giving a user a new session ID whenever they obtain a new level of permission on a site (for instance, after they successfully login).
Terr_ 11y ago
Requirements from clients are also a form of untrustworthy input :)