2 ms·
I disagree. Using the framework developed by hundreds of talented google engineers will protect you against a large number of attacks. Also, if an attack alread
by oh_sigh 5y ago
I disagree. Using the framework developed by hundreds of talented google engineers will protect you against a large number of attacks. Also, if an attack already exists on the common google framework, then that means google.com is already vulnerable through other usages of the framework, and one more site does not increase your attack surface at all.
- ipaddr 5y agoThere are hundreds of thousands looking for a zero days bugs in bigger frameworks. None for yours. Wordpress is a great example. It has better security than your average php blog. Your average php blog doesn't get attacked by automated exploits attacking known endpoints either. A determined hacker would find it easier to buy an expliot to a common framework compared to figuring out your custom framework. We've seen redis and mongo boxes getting hit by no password logins within seconds of going on the public web. Joe's custom cache and database doesn't get hit.
- oh_sigh 5y agoI don't disagree with anything you're saying. But my point stands that among two theoretical systems: a) 10,000 users of a common framework + 1 user of a custom framework. and b) 10,001 users of a common framework I contend that (a) has a larger attack surface than (b).