5 ms·

When I interview developers, I generally ask some basic questions about security - "Explain to me what an XSS attack is?", or "How would you defend a web app ag

When I interview developers, I generally ask some basic questions about security - "Explain to me what an XSS attack is?", or "How would you defend a web app against SQL injection?" Basic stuff, which - to my mind - literally every person who develops anything which is on the web should know. And a surprising number of people - even "senior" developers can't answer this stuff. It's really worrying.

amriksohata 8y ago
maybe its the fault of businesses of not training their staff in security and taking it seriously...until a breach happens.
laurentl 8y ago
“What is the OWASP top 10?” I can forgive someone who can’t explain how XSS or CSRF works (I’m not sure I can explain it so clearly myself—kudos to the article’s author for the excellent explanation) if they know about the top 10 and have read it at least once.
- techbio 8y ago
  Open Web Application Security Project (OWASP) Last year: https://www.owasp.org/index.php/Top_10-2017_Top_10 https://www.owasp.org/index.php/Top_10-2017_Top_10
mdpopescu 8y ago
I've been developing web apps since .NET 3, and the only thing I understand (and can claim to guard against [1]) in the OWASP top 10 is SQL injection. I always try to explain to my clients that web security is a complex field and they should hire a pro for that area... which, given that Google itself seems to have problems with it, is quite difficult. [1] - claim, because you never know when someone happily calls exec_sql with a string from a stored procedure (had it happen at two different companies).
- jvehent 8y ago
  > I always try to explain to my clients that web security is a complex field and they should hire a pro for that area... No. Just no. Every other field of engineering includes security and safety as a core requirement of anything they do. Software engineering is no different, and while specialists can help, every engineer needs to know how to write secure code if we are to improve the sad situation the Internet is in. Sell yourself as a software engineer who knows security, and watch the money rain as literally everyone tries to hire you.
  - wodenokoto 8y ago
    No they don't. Engineers building bridges don't sit around choosing what kind of fences or security cameras the construction site needs.
    - Piskvorrr 8y ago
      The abstraction doesn't fit. Where the civil engineers would be expected to build a bridge that doesn't collapse when the wind is Just Right (key word: Tacoma Narrows Bridge), software makers are expected to build a lock that doesn't open when someone whistles Just Right (key word: SQL injection).
      - smush 8y ago
        Bridge builders are not expected to make the bridge itself defend against saboteurs, unlike software. To painfully extend the scenario: the wind is relatively well understood and once you've learned a lesson and guarded against it as a bridge builder, a given bridge can be considered stable. Not so with software. One vuln fix, 5 more show up to take its place over time. Malicious actors & botnets = the wind now (bear with me please). Once the bridge no longer collapsed via a certain Just Right tune, the wind would stop blowing the old Just Right way and instead try finding a new Just Right way, like whirling in a tight circular motion in just the right spot to see if it can unscrew bolts, or attempt -ddos- to tornado itself into a waterspout to try to collapose the bridge. Security is not a one and done operation.
brabara 8y ago
You can reduce this to: When I interview developers, I generally ask some basic questions about ____ - "Explain to me what _____ is?", or "How would you _____?" Basic stuff, which - to my mind - literally every person who develops anything which is on _____ should know. And a surprising number of people - even "senior" developers can't answer this stuff. It's really worrying.
reacweb 8y ago
I have almost succeeded Stripe CTF 2 (runed out of time on final step because of the crowd). I am sure I can not give clear definition during an interview without a good refresh before.
robodale 8y ago
I did a code review a while back with a new Web/Software Engineer II hire (I was not involved in the interview process) and noticed they were doing an HTTP GET request when they should have been doing a POST (attempting to change some values in the backend/database). I talked to him about the issue, just chatting about GET, POST, PUT, etc...and all I got back was a deer-in-the-headlights look. He responded "I...I don't know what any of that is." :( I now ask "Can you explain what are some differences between an HTTP GET versus POST request?" with every web developer interview I do. If they get that one wrong or cannot answer...I don't bother with anything deeper.
SilasX 8y ago
Do you expect a better answer for the second than "use a framework that parses the input in a way that escapes the input such that it's not interpreted as a command"?
- devinl 8y ago
  Prepared statements tend to be the best answer for most cases which is similar to the approach you describe but is natively supported by most SQL dialects and also improves performance. In my experience, many developers and even experienced security engineers can fail to give this answer though.
  - SilasX 8y ago
    That's only relevant to know if you're actually implementing the piece that takes raw input and builds a query out of it, and most devs don't work with that piece on a day-to-day basis. Knowing that you need to use a framework that takes care of input sanitizing is enough for the typical dev. Edit: Expecting "prepared statements" as "the" answer seems close to making it a trivia question rather than "sufficient understand for doing the job" question.

amriksohata 8y ago

maybe its the fault of businesses of not training their staff in security and taking it seriously...until a breach happens.

laurentl 8y ago

“What is the OWASP top 10?” I can forgive someone who can’t explain how XSS or CSRF works (I’m not sure I can explain it so clearly myself—kudos to the article’s author for the excellent explanation) if they know about the top 10 and have read it at least once.

techbio 8y ago
Open Web Application Security Project (OWASP) Last year: https://www.owasp.org/index.php/Top_10-2017_Top_10 https://www.owasp.org/index.php/Top_10-2017_Top_10

mdpopescu 8y ago

I've been developing web apps since .NET 3, and the only thing I understand (and can claim to guard against [1]) in the OWASP top 10 is SQL injection. I always try to explain to my clients that web security is a complex field and they should hire a pro for that area... which, given that Google itself seems to have problems with it, is quite difficult. [1] - claim, because you never know when someone happily calls exec_sql with a string from a stored procedure (had it happen at two different companies).

jvehent 8y ago
> I always try to explain to my clients that web security is a complex field and they should hire a pro for that area... No. Just no. Every other field of engineering includes security and safety as a core requirement of anything they do. Software engineering is no different, and while specialists can help, every engineer needs to know how to write secure code if we are to improve the sad situation the Internet is in. Sell yourself as a software engineer who knows security, and watch the money rain as literally everyone tries to hire you.
- wodenokoto 8y ago
  No they don't. Engineers building bridges don't sit around choosing what kind of fences or security cameras the construction site needs.
  - Piskvorrr 8y ago
    The abstraction doesn't fit. Where the civil engineers would be expected to build a bridge that doesn't collapse when the wind is Just Right (key word: Tacoma Narrows Bridge), software makers are expected to build a lock that doesn't open when someone whistles Just Right (key word: SQL injection).
    - smush 8y ago
      Bridge builders are not expected to make the bridge itself defend against saboteurs, unlike software. To painfully extend the scenario: the wind is relatively well understood and once you've learned a lesson and guarded against it as a bridge builder, a given bridge can be considered stable. Not so with software. One vuln fix, 5 more show up to take its place over time. Malicious actors & botnets = the wind now (bear with me please). Once the bridge no longer collapsed via a certain Just Right tune, the wind would stop blowing the old Just Right way and instead try finding a new Just Right way, like whirling in a tight circular motion in just the right spot to see if it can unscrew bolts, or attempt -ddos- to tornado itself into a waterspout to try to collapose the bridge. Security is not a one and done operation.

brabara 8y ago

You can reduce this to: When I interview developers, I generally ask some basic questions about ____ - "Explain to me what _____ is?", or "How would you _____?" Basic stuff, which - to my mind - literally every person who develops anything which is on _____ should know. And a surprising number of people - even "senior" developers can't answer this stuff. It's really worrying.

reacweb 8y ago

I have almost succeeded Stripe CTF 2 (runed out of time on final step because of the crowd). I am sure I can not give clear definition during an interview without a good refresh before.

robodale 8y ago

I did a code review a while back with a new Web/Software Engineer II hire (I was not involved in the interview process) and noticed they were doing an HTTP GET request when they should have been doing a POST (attempting to change some values in the backend/database). I talked to him about the issue, just chatting about GET, POST, PUT, etc...and all I got back was a deer-in-the-headlights look. He responded "I...I don't know what any of that is." :( I now ask "Can you explain what are some differences between an HTTP GET versus POST request?" with every web developer interview I do. If they get that one wrong or cannot answer...I don't bother with anything deeper.

SilasX 8y ago

Do you expect a better answer for the second than "use a framework that parses the input in a way that escapes the input such that it's not interpreted as a command"?

devinl 8y ago
Prepared statements tend to be the best answer for most cases which is similar to the approach you describe but is natively supported by most SQL dialects and also improves performance. In my experience, many developers and even experienced security engineers can fail to give this answer though.
- SilasX 8y ago
  That's only relevant to know if you're actually implementing the piece that takes raw input and builds a query out of it, and most devs don't work with that piece on a day-to-day basis. Knowing that you need to use a framework that takes care of input sanitizing is enough for the typical dev. Edit: Expecting "prepared statements" as "the" answer seems close to making it a trivia question rather than "sufficient understand for doing the job" question.