3 ms·

> just because they don't know what you know, doesn't make them idiots If you're making a product, then it's your responsibility to do so in a way that doesn't

> just because they don't know what you know, doesn't make them idiots If you're making a product, then it's your responsibility to do so in a way that doesn't put your users or the general public in danger. Not knowing security best practices when you get started doesn't make you an idiot, but releasing something without first putting in the work to learn and then implement the best practices kind of makes you a shitty person. I mean otherwise you might as well just say something like, "I just wanted to make a car, I don't care if it's safe or not because that's not the fun part."

Lab3301 8y ago
A big problem with security is that you don't know what you don't know. Want to allow users to upload image? * Make sure submitted files are actually images * Limit file size to prevent denial of service * Normalize the filename to prevent directory traversal * Add a randomized component to filenames to prevent users from overwriting each other's files * Serve file with the proper content type * HTML encode filename for display Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS. I don't think that's negligence, it's just not something you'd necessarily know until you saw it. And this doesn't even consider language quirks and gotchas that are even more esoteric.
- Alex3917 8y ago
  > Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS. Right, but presumably you're using the standard techniques to mitigate XSS, e.g. sanitizing all other text input, using an X-XSS-Protection header, using a CSP that only allows scripts that have been whitelisted, etc. Even if you don't know that an SVG can contain js, that shouldn't put your users at risk if you're doing everything else correctly. And then when that gets caught in an audit or reported by a user or as part of a bug bounty, you can fix it. (Although if you're going to be serving up a certain UCG file type to users, I don't think it's unreasonable to expect people to Google for vulnerabilities associated with that file type.) Developers shouldn't be expected to have perfect security knowledge or to never make mistakes, but I think it is reasonable to expect them to not be grossly negligent. I don't want to live in a world where only people wealthy enough to afford full security audits before they get any traction should be allowed to launch products, but I also think developers should be held accountable if they're recklessly endangering people.
  - arvinsim 8y ago
    And while you are doing all that your manager is breathing down your neck to finish the damn thing and your competitor has already released a comparative feature that you are developing. In the ideal world, companies would give developers enough time to figure out security. But in practice, most companies/businesses just want you to ship ASAP.
ChrisSD 8y ago
If you don't know security best practices then learning them on the fly isn't particularly helpful, simply because you don't even know what you don't know. It's much better to accept your ignorance and defer to someone who does know security.
- Alex3917 8y ago
  > It's much better to accept your ignorance and defer to someone who does know security. Society doesn't currently offer any mechanism to pay for that though. E.g. if you as a developer make a product, you can't force VCs to fund a security audit, nor can you force security folks to work for equity, nor is there any public money available to pay for this.
  - arvinsim 8y ago
    I disagree. It is the onus of companies and managers to give developer enough time to figure this out. If they don't include it in their estimates, don't expect developers to put in their personal time to implement proper security.

Lab3301 8y ago

A big problem with security is that you don't know what you don't know. Want to allow users to upload image? * Make sure submitted files are actually images * Limit file size to prevent denial of service * Normalize the filename to prevent directory traversal * Add a randomized component to filenames to prevent users from overwriting each other's files * Serve file with the proper content type * HTML encode filename for display Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS. I don't think that's negligence, it's just not something you'd necessarily know until you saw it. And this doesn't even consider language quirks and gotchas that are even more esoteric.

Alex3917 8y ago
> Then, oops, you didn't know SVGs allowed JavaScript, so now you have stored XSS. Right, but presumably you're using the standard techniques to mitigate XSS, e.g. sanitizing all other text input, using an X-XSS-Protection header, using a CSP that only allows scripts that have been whitelisted, etc. Even if you don't know that an SVG can contain js, that shouldn't put your users at risk if you're doing everything else correctly. And then when that gets caught in an audit or reported by a user or as part of a bug bounty, you can fix it. (Although if you're going to be serving up a certain UCG file type to users, I don't think it's unreasonable to expect people to Google for vulnerabilities associated with that file type.) Developers shouldn't be expected to have perfect security knowledge or to never make mistakes, but I think it is reasonable to expect them to not be grossly negligent. I don't want to live in a world where only people wealthy enough to afford full security audits before they get any traction should be allowed to launch products, but I also think developers should be held accountable if they're recklessly endangering people.
- arvinsim 8y ago
  And while you are doing all that your manager is breathing down your neck to finish the damn thing and your competitor has already released a comparative feature that you are developing. In the ideal world, companies would give developers enough time to figure out security. But in practice, most companies/businesses just want you to ship ASAP.

ChrisSD 8y ago

If you don't know security best practices then learning them on the fly isn't particularly helpful, simply because you don't even know what you don't know. It's much better to accept your ignorance and defer to someone who does know security.

Alex3917 8y ago
> It's much better to accept your ignorance and defer to someone who does know security. Society doesn't currently offer any mechanism to pay for that though. E.g. if you as a developer make a product, you can't force VCs to fund a security audit, nor can you force security folks to work for equity, nor is there any public money available to pay for this.
- arvinsim 8y ago
  I disagree. It is the onus of companies and managers to give developer enough time to figure this out. If they don't include it in their estimates, don't expect developers to put in their personal time to implement proper security.