4 ms·

Seeing shit like this daily is holy demoralizing. Makes me feel like writing software for a living is a lost cause.

Kenji 7y ago
Why is that demoralizing? Even if you're a mediocre programmer, you're miles ahead of the industry standard. It's a good time to earn money.
keanzu 7y ago
It isn't a lost cause. The lessons are: Security is high stakes Security is hard https://blog.codinghorror.com/youre-probably-storing-passwords-incorrectly/ https://blog.codinghorror.com/youre-probably-storing-passwor...
munk-a 7y ago
This particular issue reeks of "roll your own" when a lot of out-of-box token based solutions would just do a better job. The best lesson to learn about security in software is that if you're doing it and you don't have a PhD you're doing it wrong. The benefits of leaning on a third party for common logic should be carefully reviewed on a case-by-case basis unless that software is related to security, in which case, please do lean on a third party.
- ghh45654 7y ago
  >The best lesson to learn about security in software is that if you're doing it and you don't have a PhD you're doing it wrong. fuck, I need to tell that to all top CTF teams that their members should stop competing and leave their jobs and focus on PhD It may be a little bit offensive, but did you even graduate?
  - munk-a 7y ago
    Sorry, I was a bit hyperbolic - let me clarify. I didn't mean that educational experience is a critical portion - more that working in the security field is a lot more theoretical than most and requires a much higher investment of time to start to comprehend. People without degrees absolutely can be security experts, and people with degrees can be utterly clueless - but if you're working on a webapp and given a week to write a login system then it almost certainly will be vulnerable. So it's less specifically required that people have PhDs and more... this stuff takes time to fully understand, I know a lot of pitfalls on the topic but I wouldn't say I'm an expert - I just know enough to know that I don't know.

Why is that demoralizing? Even if you're a mediocre programmer, you're miles ahead of the industry standard. It's a good time to earn money.

keanzu 7y ago

It isn't a lost cause. The lessons are: Security is high stakes Security is hard https://blog.codinghorror.com/youre-probably-storing-passwords-incorrectly/ https://blog.codinghorror.com/youre-probably-storing-passwor...

munk-a 7y ago

This particular issue reeks of "roll your own" when a lot of out-of-box token based solutions would just do a better job. The best lesson to learn about security in software is that if you're doing it and you don't have a PhD you're doing it wrong. The benefits of leaning on a third party for common logic should be carefully reviewed on a case-by-case basis unless that software is related to security, in which case, please do lean on a third party.

ghh45654 7y ago
>The best lesson to learn about security in software is that if you're doing it and you don't have a PhD you're doing it wrong. fuck, I need to tell that to all top CTF teams that their members should stop competing and leave their jobs and focus on PhD It may be a little bit offensive, but did you even graduate?
- munk-a 7y ago
  Sorry, I was a bit hyperbolic - let me clarify. I didn't mean that educational experience is a critical portion - more that working in the security field is a lot more theoretical than most and requires a much higher investment of time to start to comprehend. People without degrees absolutely can be security experts, and people with degrees can be utterly clueless - but if you're working on a webapp and given a week to write a login system then it almost certainly will be vulnerable. So it's less specifically required that people have PhDs and more... this stuff takes time to fully understand, I know a lot of pitfalls on the topic but I wouldn't say I'm an expert - I just know enough to know that I don't know.