3 ms·
While I love reading these kinds of articles, I suspect they’re not the most important thing for most developers trying to build secure websites. My rationale
by hyperpape 8y ago
While I love reading these kinds of articles, I suspect they’re not the most important thing for most developers trying to build secure websites.
My rationale is that a list of attacks and issues like this requires you to reason backwards from attacks to what a safe approach would be. This is incredibly hard work that most people are not ready to do.
Instead, what you need is for someone to present a set of up to date best practices that you can implement. Here’s one stab at one for the specific topic of file uploads: https://twitter.com/olemoudi/status/1023976897661870083 https://twitter.com/olemoudi/status/1023976897661870083 (not vouching for this particular list per se—I don’t know if it’s missing things, but it seems like it’s on the right track).
- ggeorgovassilis 8y agoAgreed! I think the most important security topics have been well covered elsewhere like code injection, session fixation, CSRF. I wanted to talk about unusual attacks which, however, are relevant to many web applications and most developers (count me in!) were not aware of at the time.