5 ms·
It seems that the typical software engineer doesn't give security a single thought.
by ipnon 6y ago
It seems that the typical software engineer doesn't give security a single thought.
- droopyEyelids 6y agoIt feels like you and the parent commenters are framing this as a choice between allowing public access to existing databases, or continuing to build new tools for accessing the data. The way I understood the article, the ideas is 'can we expose a safe subset of SQL or fix the security issues instead of continuing to build entirely new systems'
- falcolas 6y agoHere's the root of my concern - safely and securely emitting SQL from an untrusted client is exponentially harder than running canned SQL queries from a trusted client. People forget (or don't care) about security or safety when it lets them move faster. "Move fast and break things," is a terrible security model.
- keanebean86 6y agoConsidering the number of times I've had to remind coworkers about sql injection during code reviews I agree.
- neonological 6y agoI mean the guy is front end. Front end development doesn't involve any security.
- ipnon 6y agoI think you would be surprised how quickly and easily an attacker can automatically export vulnerabilities in web applications with programs such as Ffuf and SQLmap.
- neonological 6y agoNot disagreeing. I'm just saying people on the front end never actually deal with security, hence this is the mentality that is the instigator of the suggestion of using SQL on the front end.