6 ms·

I've got to be missing something. How difficult is it to implement secure authentication to the server that has access to the database? Am I just doing it wrong

I've got to be missing something. How difficult is it to implement secure authentication to the server that has access to the database? Am I just doing it wrong? Because it doesn't seem overly difficult to me to secure my web services.

corecoder 8y ago
Seems like the people who would be able to implement this stuff securely is also mostly the people who would not want to. [Edit: spelling]
Jach 8y ago
There are many so-called software engineers who respond with some variant of "no one knows about it but us, so it's fine". It's not even security-through-obscurity, as no particular efforts are made to obscure the resource, just that no particular efforts are made to publicize or document it and thus "that's good enough security for MVP".
- welcome_dragon 8y ago
  I once worked with a solutions architect who said things like "so? There are laws against people accessing this illegally. We don't need SSL"
MagicPropmaker 8y ago
People who go through the Ruby on Rails tutorial, where you make a simple microblog and each post is identified by a sequential number get a job making software for a little 2-bit company and this happens.
- gowld 8y ago
  Do rails tutorials not have login pages?
  - dcbadacd 8y ago
    Many tutorials are written by people who have just learned about the thing, not by those who have to have had to write secure code.
SamuelAdams 8y ago
It's probably not difficult - there's plenty of libraries for every framework and stack. My guess is this product was developed in an "agile" fashion. The contracting company showed a "POC" that did what the product owner / VIP wanted to. Then they probably said "ship it". Product managers are more concerned with functionality than other things like scalability or security. My guess is they just never explicitly asked for it.

6 ms·

I've got to be missing something. How difficult is it to implement secure authentication to the server that has access to the database? Am I just doing it wrong

by ngngngng 8y ago

corecoder 8y ago
Seems like the people who would be able to implement this stuff securely is also mostly the people who would not want to. [Edit: spelling]
Jach 8y ago
There are many so-called software engineers who respond with some variant of "no one knows about it but us, so it's fine". It's not even security-through-obscurity, as no particular efforts are made to obscure the resource, just that no particular efforts are made to publicize or document it and thus "that's good enough security for MVP".
- welcome_dragon 8y ago
  I once worked with a solutions architect who said things like "so? There are laws against people accessing this illegally. We don't need SSL"
MagicPropmaker 8y ago
People who go through the Ruby on Rails tutorial, where you make a simple microblog and each post is identified by a sequential number get a job making software for a little 2-bit company and this happens.
- gowld 8y ago
  Do rails tutorials not have login pages?
  - dcbadacd 8y ago
    Many tutorials are written by people who have just learned about the thing, not by those who have to have had to write secure code.
SamuelAdams 8y ago
It's probably not difficult - there's plenty of libraries for every framework and stack. My guess is this product was developed in an "agile" fashion. The contracting company showed a "POC" that did what the product owner / VIP wanted to. Then they probably said "ship it". Product managers are more concerned with functionality than other things like scalability or security. My guess is they just never explicitly asked for it.