36 ms·

Yeah, because the people hiring you have no clue what kind of a maintainability hellscape you're leaving for the next person... Also I'm 97% sure I could own y

Yeah, because the people hiring you have no clue what kind of a maintainability hellscape you're leaving for the next person... Also I'm 97% sure I could own your site in under a day, based on how home-baked you just said it is, and I'm garbage at pen testing. Healthcare site, you say? Jesus Christ, I hope they have data breach insurance.

reaperducer 7y ago
Also I'm 97% sure I could own your site in under a day, based on how home-baked you just said it is, and I'm garbage at pen testing. The internal and external security audits already performed by the billion-dollar healthcare company in question disagree with you.
- diminoten 7y ago
  I'm super glad to hear that happened, but please understand where I'm coming from when I said what I did; reinventing the wheel (as I'm sure you had to here) is straight up dangerous.
- noonespecial 7y ago
  Is it bad that the more spent on the audit and the larger the company the less I trust the results?
  - tluyben2 7y ago
    No, they just had to check that box to make sure that they did ‘everything in their power’ to make it secure.
- ceejayoz 7y ago
  I can't speak to your specific case, but I've seen a tool "pass" a billion-dollar company's auditing because the scanner they used never got past the login screen and their folks never noticed that fact.
pojzon 7y ago
I can assure you "owning" a home-baked software is 10 times harder than anything that is popular. Thats from someone who does that for a living. Modern web-devs move faster than they think, leaving so many doors open. Someone who works on the same system plenty of years had time to patch the doors.
- diminoten 7y ago
  I believe you, I do not do this for a living! But am I not right to have red flags fly when someone says they built a home-baked web service for managing health care information? Isn't that nuts, from a security perspective?
  - crumpets 7y ago
    No, you're not right. How you render CSS and the page have very little to do with how secure your app is. SQL escaping, session handling, etc all come easily with standard php libraries. So "I didn't bother with any PHP frameworks" doesn't mean the dev wrote an SQL connector.
    - diminoten 7y ago
      I'm sorry if you thought I meant CSS rendering was the source of potential vulnerabilities, but for any website that has, say, users, if you're not using any PHP frameworks or external libraries you might have to implement some crypto of your own to store passwords securely, just for starters. I don't think PHP offers a standard library to do that, does it? There are a hundred examples that are specific to whatever app this guy built for the Healthcare company, not all of which are covered by the PHP standard library... I believe him when he says it passed external/internal auditing, however I have a very hard time believing he's not either very very expensive or took a very very long time to get the app to the place he claims it is (the third option is that it does very little, which won't actually end up being a good thing once the client gets over the honeymoon phase of "it's so much prettier!!!"). Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that a one-man development team using no 3rd party libraries is definitely creating a codebase nigh unmaintainable by other people down the line. His bragging about creating job security for 2 years is honestly an understatement; he's got job security for the life of the products he's creating, as he's likely the only person who can do anything more with the website in a time frame that isn't measured in years.
throwaway5d097 7y ago
I agree that there are much better choices, but most frontend apps are done with onion oriented development with thousands of dependencies that constantly get vulnerabilities, and aren't any more maintainable in my experience. If it's simple enough and they understand PHP well, it could easily be better.

reaperducer 7y ago

Also I'm 97% sure I could own your site in under a day, based on how home-baked you just said it is, and I'm garbage at pen testing. The internal and external security audits already performed by the billion-dollar healthcare company in question disagree with you.

diminoten 7y ago
I'm super glad to hear that happened, but please understand where I'm coming from when I said what I did; reinventing the wheel (as I'm sure you had to here) is straight up dangerous.
noonespecial 7y ago
Is it bad that the more spent on the audit and the larger the company the less I trust the results?
- tluyben2 7y ago
  No, they just had to check that box to make sure that they did ‘everything in their power’ to make it secure.
ceejayoz 7y ago
I can't speak to your specific case, but I've seen a tool "pass" a billion-dollar company's auditing because the scanner they used never got past the login screen and their folks never noticed that fact.

pojzon 7y ago

I can assure you "owning" a home-baked software is 10 times harder than anything that is popular. Thats from someone who does that for a living. Modern web-devs move faster than they think, leaving so many doors open. Someone who works on the same system plenty of years had time to patch the doors.

diminoten 7y ago
I believe you, I do not do this for a living! But am I not right to have red flags fly when someone says they built a home-baked web service for managing health care information? Isn't that nuts, from a security perspective?
- crumpets 7y ago
  No, you're not right. How you render CSS and the page have very little to do with how secure your app is. SQL escaping, session handling, etc all come easily with standard php libraries. So "I didn't bother with any PHP frameworks" doesn't mean the dev wrote an SQL connector.
  - diminoten 7y ago
    I'm sorry if you thought I meant CSS rendering was the source of potential vulnerabilities, but for any website that has, say, users, if you're not using any PHP frameworks or external libraries you might have to implement some crypto of your own to store passwords securely, just for starters. I don't think PHP offers a standard library to do that, does it? There are a hundred examples that are specific to whatever app this guy built for the Healthcare company, not all of which are covered by the PHP standard library... I believe him when he says it passed external/internal auditing, however I have a very hard time believing he's not either very very expensive or took a very very long time to get the app to the place he claims it is (the third option is that it does very little, which won't actually end up being a good thing once the client gets over the honeymoon phase of "it's so much prettier!!!"). Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that a one-man development team using no 3rd party libraries is definitely creating a codebase nigh unmaintainable by other people down the line. His bragging about creating job security for 2 years is honestly an understatement; he's got job security for the life of the products he's creating, as he's likely the only person who can do anything more with the website in a time frame that isn't measured in years.

throwaway5d097 7y ago

I agree that there are much better choices, but most frontend apps are done with onion oriented development with thousands of dependencies that constantly get vulnerabilities, and aren't any more maintainable in my experience. If it's simple enough and they understand PHP well, it could easily be better.