3 ms·
Your argument is a form of survivorship bias. You're not acknowledging all of the gaping security flaws in contemporary web-development frameworks. People were
by meritt 7y ago
Your argument is a form of survivorship bias. You're not acknowledging all of the gaping security flaws in contemporary web-development frameworks. People were writing sloppy PHP before CSRF and XSS were even invented. Yet somehow, Python, Ruby and NodeJS have all had numerous CVEs despite those attack vectors being well known at the time a given framework was written.
You think SQLi was bad? You should spend some time thinking about the numerous attack vectors available today in nearly every GraphQL implementation where programmers can't move fast enough in adding it to their stack. Data exfiltration is no longer a flaw but a feature.
- Avamander 7y ago> People were writing sloppy PHP before CSRF and XSS were even invented. It is very very easy to write sloppy PHP, definitely easier than in many other languages and default frameworks. > You're not acknowledging all of the gaping security flaws in contemporary web-development frameworks. P I'm very aware of them, basically none have (had) as many high-impact vulns as PHP-based stuff does. > Yet somehow, Python, Ruby and NodeJS have all had numerous CVEs despite those attack vectors being well known at the time a given framework was written. You're not acknowledging the orders of magnitudes difference between the impact of an usual PHP vuln and those you listed. > You think SQLi was bad? You should spend some time thinking about the numerous attack vectors available today in nearly every GraphQL implementation The flaws in others are a very poor excuse for flaws in a thing itself.