3 ms·
I'm not entirely sure I believe that. I saw a Paragonie project that was posted a while back, supposedly a "secure by default" CMS. I looked at the code and saw
by orf 9y ago
I'm not entirely sure I believe that. I saw a Paragonie project that was posted a while back, supposedly a "secure by default" CMS. I looked at the code and saw it was an hard to audit mess that decided to implement everything itself. It's own ORM, own router, own MVC framework. I spent an hour and found numerous issues[1] in the code.
I don't believe re-implementing the wheel like that is a 'modern security practice'. I asked why they did that instead of using robust, well tested and well supported libraries and did not get a satisfactory answer.
While it's not the author's project (I think?) he is still part of the company, and I'd hope such a security-focused organization wouldn't have done something like that.
1. https://paragonie.com/project/airship https://paragonie.com/project/airship
2. https://news.ycombinator.com/item?id=13905055 https://news.ycombinator.com/item?id=13905055
- CiPHPerCoder 9y agoThis is off topic and reads a bit like a personal attack, but if you want to have a level-headed discussion about Airship's design and implementation, https://github.com/paragonie/airship/issues https://github.com/paragonie/airship/issues A lot has changed since you last looked at it, and a lot will change before the v2.0.0 rewrite is complete.
- orf 9y agoI'm sorry that you read it as a personal attack, I did not mean for it to read that way. I was merely pointing out something that I consider to be designed contrary to security best practices in response to a comment about security best practices. I'm glad to hear things have changed in the code however, and wish you the best with the rewrite.
- tptacek 9y agoYou replied to a comment praising Scott for improving PHP security by saying "I'm not sure I believe that", and then ambiguously attacked his code. Who are you trying to kid? I don't much care one way or the other about whether it's OK to try to take people down a peg, but I do care very much when people do that and then try to get away with pretending that's not what they're doing.
- sctb 9y agoWe detached this subthread from https://news.ycombinator.com/item?id=14763705 https://news.ycombinator.com/item?id=14763705 and marked it off-topic.