3 ms·
It's cool to see how these posts are becoming less and less important in the wake of today's frameworks/tools protecting devs by default. From ORMs escaping SQ
by parhamn 5y ago
It's cool to see how these posts are becoming less and less important in the wake of today's frameworks/tools protecting devs by default.
From ORMs escaping SQL, to FE frameworks escaping html/js, to browsers starting to default to same-site=lax. It feels like we've slowly pulled ourselves out of OWASP hell. Pretty nice to see!
Obviously it's still important (see log4j) to know it all especially when its not so clear cut, but still good progress.
- erosenbe0 5y agoI think we really failed in earlier eras to get it right due to the momentum of the frameworks. I would liken to some of the crap building materials that were allowed in the past as new, cheap alternatives but subsequently showed failure or hazards after short service-lifes. Contractors were tasked with implementing these materials to stay within budget and everyone suffered the effects later.