4 ms·
Interesting article about principles for designing a successful web app... if you're the only user. There are zero references to security mentioned at all. As a
by david_shaw 16y ago
Interesting article about principles for designing a successful web app... if you're the only user. There are zero references to security mentioned at all. As a security engineer, this bothers me a little bit.
A lot of people don't understand that security holes in their applications aren't usually caused by a 0day in their framework, but instead sloppy security practices in the application itself. I break web applications for a living, and although I appreciate the consistent business, entrepreneurs and developers on Hacker News should understand that a critical hole will cripple their business.
Take some time before you let other people use your app (other than internal testing) and do a few simple checks:
- Am I sanitizing user-supplied input in my application? Can I throw a ' in a userid form, or will it break my SQL statements?
- If I put ''";<xss> in the search bar, and view source, are > and < symbols floating around the page?
- Am I relying on security through obscurity? This is a big one. "Oh, no one will find the hardcoded password in this world-readable configuration file six directories deep" is how infrasctructures get destroyed.
- Am I handling credit card data myself? Do I need to be PCI-DSS compliant?
These few questions will prevent 90% of XSS, SQL injection and CSRF attacks if you carry them out thoroughly. Don't realease a buggy webapp just to get hacked.
- brlewis 16y agoHe's defining success in terms of potential popularity. I think security is important, but empirically, security seems irrelevant to most apps' popularity. Many apps have stayed popular after major security breaches.
- david_shaw 16y agoI completely agree, and just wanted to reply to touch on this point a little bit. You are correct that the article (rightfully) provides a forumula to create a popular app. Sure, there are lots of technical details that weren't touched upon in this article, and certainly we are not going to enumerate each of them and criticize the author for not creating an end-all be-all make-the-best-app-ever article. However, I do believe that security should be a primary concern from the very start. Think about security early, think about security often. Once your app is already popular with 500k active users is not a good time to realize your oversight in security, leading to a possibly fatal breach.
- alain94040 16y agoWhile my brain agrees with your position, my heart tells me that it's more likely that you never make it to 500K users if you focus on security. I'd welcome a counter-example: can you name a succesful startup that died because of lack of early security? The way it seems to work today on the Web is succeed first, get the money, then fix whatever needs to be fixed.
- david_shaw 16y agoI don't mean to criticize the article posted, and welcome many of the points myself. I am coming more from a software development perspective, although I understand that the article is geared primarily from a marketing point of view. I agree with you that being paranoid about security instead of working on a human-friendly interface, or worse--a functioning product--will absolutely hinder developments to grow, but that is not what I'm suggesting. In my experience, the vast majority of crippling bugs are simple things, that can easily be prevented using methods such as the four I listed. These should be part of everyday secure coding practices. I would never tell a developer that they should stop working on their product to tinker with obscure security fantasies, but I'd also say that they're crazy if they don't include basic checks (such as ensuring on a basic level that user input is clean) as mentioned above. Development methodologies like TDD include this inherently in the software life cycle: tests reaching outer bounds and unexpected input are regularly created to make sure that errors are handled correctly.