4 ms·
But web developers should know how SSL works anyway. Otherwise your probably not a great developer. I defiantly learned about SSL, and pki infrastructure throu
by UK-AL 10y ago
But web developers should know how SSL works anyway. Otherwise your probably not a great developer.
I defiantly learned about SSL, and pki infrastructure through developer knowledge.
- nickpsecurity 10y agoIf library is done well, then you shouldn't have to know much about SSL to be able to use it. Just an abstract idea of it plus how to use the library. SSL from an ops perspective is quite different. That's why it's better to have pro's in each working together on it.
- UK-AL 10y agoI would want a developer who knows the best practice keeping the ciphersuite up to date and understands stuff like client side certificates if they going to work on any security conscious application.
- nickpsecurity 10y agoI'd prefer it but one you mention can be done upstream by library developer with secure defaults. Think NaCl. Client-side certificates might come with best practices or checklists that show proper use with optional data on the way. Neither issue requires understanding SSL in common deployments. Note that I say this while agreeing with you that I prefer someone who knows what they're doing. Especially as SSL support isn't usually at the usability standard I'm describing. Yet, it's not intrinsic to the problem: just crap UX.