3 ms·

I believe you, I do not do this for a living! But am I not right to have red flags fly when someone says they built a home-baked web service for managing healt

I believe you, I do not do this for a living! But am I not right to have red flags fly when someone says they built a home-baked web service for managing health care information? Isn't that nuts, from a security perspective?

crumpets 7y ago
No, you're not right. How you render CSS and the page have very little to do with how secure your app is. SQL escaping, session handling, etc all come easily with standard php libraries. So "I didn't bother with any PHP frameworks" doesn't mean the dev wrote an SQL connector.
- diminoten 7y ago
  I'm sorry if you thought I meant CSS rendering was the source of potential vulnerabilities, but for any website that has, say, users, if you're not using any PHP frameworks or external libraries you might have to implement some crypto of your own to store passwords securely, just for starters. I don't think PHP offers a standard library to do that, does it? There are a hundred examples that are specific to whatever app this guy built for the Healthcare company, not all of which are covered by the PHP standard library... I believe him when he says it passed external/internal auditing, however I have a very hard time believing he's not either very very expensive or took a very very long time to get the app to the place he claims it is (the third option is that it does very little, which won't actually end up being a good thing once the client gets over the honeymoon phase of "it's so much prettier!!!"). Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that a one-man development team using no 3rd party libraries is definitely creating a codebase nigh unmaintainable by other people down the line. His bragging about creating job security for 2 years is honestly an understatement; he's got job security for the life of the products he's creating, as he's likely the only person who can do anything more with the website in a time frame that isn't measured in years.
  - jasonlotito 7y ago
    > I don't think PHP offers a standard library to do that, does it? https://www.php.net/manual/en/password.installation.php https://www.php.net/manual/en/password.installation.php "There is no installation needed to use these functions; they are part of the PHP core." The functions are common knowledge in the community, and made to be easy to use. > Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that a one-man development team using no 3rd party libraries is definitely creating a codebase nigh unmaintainable by other people down the line. They said, "No frameworks." They didn't say no libraries. Some people make a distinction between the two, others don't. You are taking the stance that they mean they mean the same thing. Realize that others don't consider them the same thing. Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that someone who doesn't know the nuances between libraries and frameworks in the software development world can't make the claim to have expertise in the software development world. =)
    - diminoten 7y ago
      I don't think someone nitpicking between the definition of the words "framework" and "library" is engaging in this conversation honestly, and I'm pretty sure that your failure to address the "this is but one of hundreds of examples, not all of which are covered by standard libraries in PHP" comment I made is further justification of that belief.
      - mdemare 7y ago
        In the context of web development, they are generally considered as distinct.
        diminoten 7y ago
        Not the argument, nor is it relevant, hence the discussion about it being disingenuous.
      - jasonlotito 7y ago

crumpets 7y ago

No, you're not right. How you render CSS and the page have very little to do with how secure your app is. SQL escaping, session handling, etc all come easily with standard php libraries. So "I didn't bother with any PHP frameworks" doesn't mean the dev wrote an SQL connector.

diminoten 7y ago
I'm sorry if you thought I meant CSS rendering was the source of potential vulnerabilities, but for any website that has, say, users, if you're not using any PHP frameworks or external libraries you might have to implement some crypto of your own to store passwords securely, just for starters. I don't think PHP offers a standard library to do that, does it? There are a hundred examples that are specific to whatever app this guy built for the Healthcare company, not all of which are covered by the PHP standard library... I believe him when he says it passed external/internal auditing, however I have a very hard time believing he's not either very very expensive or took a very very long time to get the app to the place he claims it is (the third option is that it does very little, which won't actually end up being a good thing once the client gets over the honeymoon phase of "it's so much prettier!!!"). Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that a one-man development team using no 3rd party libraries is definitely creating a codebase nigh unmaintainable by other people down the line. His bragging about creating job security for 2 years is honestly an understatement; he's got job security for the life of the products he's creating, as he's likely the only person who can do anything more with the website in a time frame that isn't measured in years.
- jasonlotito 7y ago
  > I don't think PHP offers a standard library to do that, does it? https://www.php.net/manual/en/password.installation.php https://www.php.net/manual/en/password.installation.php "There is no installation needed to use these functions; they are part of the PHP core." The functions are common knowledge in the community, and made to be easy to use. > Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that a one-man development team using no 3rd party libraries is definitely creating a codebase nigh unmaintainable by other people down the line. They said, "No frameworks." They didn't say no libraries. Some people make a distinction between the two, others don't. You are taking the stance that they mean they mean the same thing. Realize that others don't consider them the same thing. Further, the expertise I do bring to this conversation is in software development, and I can say assuredly that someone who doesn't know the nuances between libraries and frameworks in the software development world can't make the claim to have expertise in the software development world. =)
  - diminoten 7y ago
    I don't think someone nitpicking between the definition of the words "framework" and "library" is engaging in this conversation honestly, and I'm pretty sure that your failure to address the "this is but one of hundreds of examples, not all of which are covered by standard libraries in PHP" comment I made is further justification of that belief.
    - mdemare 7y ago
      In the context of web development, they are generally considered as distinct.
      - diminoten 7y ago
        Not the argument, nor is it relevant, hence the discussion about it being disingenuous.
    - jasonlotito 7y ago