4 ms·
> The main problem is that web apps have a huge surface of attack, a huge part of any web application is handling untrusted user input. That's not actually tru
by gnaritas 9y ago
> The main problem is that web apps have a huge surface of attack, a huge part of any web application is handling untrusted user input.
That's not actually true; not all web frameworks work by having pages that parse query params on every navigation. Callback based frameworks like Seaside let you write apps where form input is the only attack vector and messing with URL's will only make you lose your session. That pretty much removes the largest attack vector in most web apps.
- simias 9y agoWell you're just delegating the issue to the framework then, it doesn't really change what I said. If the framework is written in C++ it'll have to be written very carefully and thoroughly validated. If the framework is written in a safer language then it's not much different than if you write a web application in, say, Django where you call native C and C++ modules. That's very common.
- gnaritas 9y agoSure, but that's why we use frameworks to begin with, to create such abstractions. My point was the main attack vector many web apps suffer from are merely due to frameworks that leave too much to the developer. Abstracting page to page linking, as Seaside does or as this very website's Arc framework does with callbacks kills that vector by changing the very nature of what links do.