3 ms·
Yeah, I wondered if it was something like that. Sounds like input is sanitized before it even touches that system. Which begs an interesting train of thought:
by _bxg1 6y ago
Yeah, I wondered if it was something like that. Sounds like input is sanitized before it even touches that system.
Which begs an interesting train of thought: could we make systems that last longer by doing a better job of isolating pieces of them from the outside world? If malicious input never reaches your code, does it even need security updates?
- mywittyname 6y agoThe rubber has to meet the road. Users have to interface with the software. "Backend" software tends to be very long lived because it's not client facing. Clients don't care that the software was written in Java2 and uses some weird-ass collection of korn shell scripts to keep things moving. These scripts usually just need to eat data from one location, and poop it into another. And because these systems are old, they are well tested and battle hardened. But that backend is no good without some form of user interface. This is almost always the place where things break down. There are many more people involved in the decision making for UX, and we have more and more devices with different use-cases. Most tech-ish companies can't afford to ignore completely new computing paradigms for decades.
- _bxg1 6y agoAt the risk of stretching the metaphor, what I'm talking about are bearings that separate the wheel from the rest of the car. Maybe you have a thin, outward-facing server that does nothing but authenticate, validate, and sanitize input data, and then redirects that to some internal system that knows for sure exactly what it's going to get, and doesn't get to talk to the outside world directly, and therefore doesn't have to worry about attacks.
- giantrobot 6y agoCongratulations, you just invented "middleware".