3 ms·
Whats worrying about the apparent proliferation of security breaches like this is that as the attacks get more sophisticated, so do the prevention methods. This
by beseku 15y ago
Whats worrying about the apparent proliferation of security breaches like this is that as the attacks get more sophisticated, so do the prevention methods. This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers.
The result being that independent development is impossible as you would need to hire ever more expensive security consultants for anything that stores data.
- gaius 15y agoIn my experience the expense of a security consultant is rarely correlated with their skill level.
- Joakal 15y agoBut aren't they using pretty old exploits, SQL injections and DDoS?
- noobiscus 15y ago"This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers." We reached that point quite a while ago. What we are seeing now is the result of that point being reached, without anyone realising at the time.
- crocowhile 15y agoI was thinking more in terms of reactions. Governments rarely admit their own faults and weaknesses. They will react claiming computer terrorists must be stopped now and that more control on the Internet is needed to protect everybody.
- cageface 15y agoMore likely that common development tools and frameworks will become much more intrinsically security conscious.
- zwp 15y agoI understand your point (it is potentially true for more than just the security domain of application development) but I think your premise in this case is false. SQLI (XSS, CSRF, ...) attacks are neither sophisticated nor new. SQLI has been known since at least 1998 (Phrack 54). SQLI protection at least should be abstracted away from the developer's concerns by use of default parametrized queries. Technical difficulty is not the problem here.
- justincormack 15y agoThe security breaches are attacking the old well known holes that everyone has ignored for years. I quite liked this post: http://1raindrop.typepad.com/1_raindrop/2011/06/unfrozen-caveman-attacker.html http://1raindrop.typepad.com/1_raindrop/2011/06/unfrozen-cav... people are just not investing in security. Most of the attacks are not very sophisticated, it is just no one is spending money on solving the basic security weaknesses.
- 7952 15y agoSurely Web frameworks do a lot to help solve this. Im sure django isnt't perfect; but its more secure than anything I could do.