4 ms·
The counterpoint is, good defense (and software) comes from good principles and hard work. Good attack (or hack) on the other hand also requires brilliance and
by manquer 5y ago
The counterpoint is, good defense (and software) comes from good principles and hard work. Good attack (or hack) on the other hand also requires brilliance and luck to find the exploit.
Over time defense will keep improving , attack on the other hand will become more difficult when common issues are no longer a problem ( say memory safety or SQL injection) when best practices become the norm.
- bitexploder 5y agoOn HN this week something like half of the articles (e: from a Google search) about PHP had SQLi in them.
- manquer 5y agoWhile SQLi is still quite common, the use of good libraries and prepared statements even in PHP has increased a lot say in last 10 years, the % of projects / services on which SQLi was possible should have also reduced. In that HN thread you talked about someone had mentioned till sometime back even the official docs used to have examples with SQLi, which of course they don't anymore, making it slightly harder for junior devs to make those mistakes, each step is improvement. I am not saying they already solved, I am saying it becomes harder to hack with some techniques over time as defenses become more standard and best practices become actually common place.
- bitexploder 5y agoMy old book I wrote on PHP4 had SQLi in it.. heh. And I still ended up in appsec years later. Been doing that for 15+ years but my roots are software dev, so I use that and try to have a lot of empathy for developers. When I got started app sec was nascent and just becoming it’s own thing, and many in infosec had a very blame oriented mindset with developers. So it’s great to see how far we have brought things.