3 ms·
Wow. I would never guess it was so hard to convince someone of this. “The code I write doesn’t have XSS or SQL injection vulnerabilities,” sure. At least those
by fn-mote 2y ago
Wow. I would never guess it was so hard to convince someone of this.
“The code I write doesn’t have XSS or SQL injection vulnerabilities,” sure. At least those are plausible things to believe.
Client side validation?? How could anybody believe in that?
- nine_k 2y agoI convinced fellow engineers who were adamant that the code they had written was OK by writing actual exploits against their code. Twice. Worked both times, without betting on money.
- wglb 2y agoAn axiom of secure programming is to never trust the client. You don't really know what the client is. Often it takes several penetrations via compromised/replaced clients to get the message through. Just look at all the discussions about why browser-based javascript encryption is problematic.