4 ms·

Because security is actually really hard, contrary to popular opinion. As an industry, I think we need to rethink the way we develop, package, and deploy web a

by tjohns 10y ago

Because security is actually really hard, contrary to popular opinion. As an industry, I think we need to rethink the way we develop, package, and deploy web apps. The fact that we rely on individual developers and sysadmins to get security right, perfectly, every time is crazy. In an ideal world the prod environment should protect me from shooting myself in the foot, and the OS should be running a hardened-by-default, single-purpose system image that doesn't require bespoke knowledge to make secure. While far from perfect, I think the PaaS vendors (AppEngine and Heroku) got a lot of things right in this regard. [Disclaimer: I work for Google, but not on Google Cloud.]

cm2187 10y ago
No. Most vulnerabilities are sql injections and phishing attacks. There are so many leaks because incompetence is the norm among developers.
ssharp 10y ago
> Because security is actually really hard, contrary to popular opinion. But some of the password hashing algos used, no salting, making all password characters lower-case in the background, etc. are not hard things to avoid. So when a site is hacked and the user information stolen and we find that stuff out, it's safer to assume other security practices where also subpar.
- iLoch 10y ago
  Yup there are just a lot of bad developers out there, quite honestly.
  - dvhh 10y ago
    Add "cheap" to their traits, and it would help figure out why anybody would ask them to code anything
  - ssharp 10y ago
    For big sites, I have a hard time blaming it on a bad developer. Early in my career, I worked for a company that stored it's passwords in plain-text. I suggested on many occasions stop doing this and was always told no because the site had an older audience and they wanted to make it easy to send password reminders, which also meant they were emailing passwords in plain-text. This came from the tech director and CEO and none of the other devs seemed to care. A few years after I left, their DB was compromised, so someone got a list of email addresses with clear text passwords.

by tjohns 10y ago

cm2187 10y ago

No. Most vulnerabilities are sql injections and phishing attacks. There are so many leaks because incompetence is the norm among developers.

ssharp 10y ago

> Because security is actually really hard, contrary to popular opinion. But some of the password hashing algos used, no salting, making all password characters lower-case in the background, etc. are not hard things to avoid. So when a site is hacked and the user information stolen and we find that stuff out, it's safer to assume other security practices where also subpar.

iLoch 10y ago
Yup there are just a lot of bad developers out there, quite honestly.
- dvhh 10y ago
  Add "cheap" to their traits, and it would help figure out why anybody would ask them to code anything
- ssharp 10y ago
  For big sites, I have a hard time blaming it on a bad developer. Early in my career, I worked for a company that stored it's passwords in plain-text. I suggested on many occasions stop doing this and was always told no because the site had an older audience and they wanted to make it easy to send password reminders, which also meant they were emailing passwords in plain-text. This came from the tech director and CEO and none of the other devs seemed to care. A few years after I left, their DB was compromised, so someone got a list of email addresses with clear text passwords.