4 ms·
>Has this ever been beneficial? If you want to write secure code it's necessary. Otherwise you just end up with PHP web apps that have remotely exploitable mem
by ryanlol 9y ago
>Has this ever been beneficial?
If you want to write secure code it's necessary. Otherwise you just end up with PHP web apps that have remotely exploitable memory corruption bugs because the developer didn't understand that he absolutely has to sanitize all user inputs to certain functions.
>If the code really is horrendous nobody is going to be using it
This just makes it pretty clear that you haven't ever looked.
- seanwilson 9y agoMaybe if you're working for something that requires very high security but it's completely unrealistic that you can security audit all your dependencies. I'm pretty confident Angular, React, Vue etc. don't have any glaringly obvious security problems that all the other contributors missed for example. Do you check the source code for Apache, MySQL, PHP etc.? If I'm picking a library for a component where its flaws would be high impact (e.g. security) and there isn't a strong community behind that library I'm going to be very cautious though.