3 ms·

Ask HN: What should every programmer know about security?

• rlv-dan 6y ago
  Unless you are an expert, you probably shouldn't roll your own security. Let trusted libraries and frameworks do the work.
  • jfengel 6y ago
    Unfortunately, if you're not an expert, even libraries and frameworks can lead to a false sense of security. It's hard to know what constitutes "opening things safely" and what is "You just threw the door wide open". Especially when you tried the first three things and they didn't work.
• hamburglar 6y ago
  * what are certificates and what are their practical benefit (how do TLS and mTLS work on a conceptual level) * how should you store password auth info * what is XSS and how do you prevent it * how to properly escape user-provided data in various contexts (sql, html, file formats and/or encodings)