3 ms·

While I personally like the DIY ethic I would be somewhat hesitant to recommend a novice starts developing production web apps. For example , someone has a gre

by jiggy2011 14y ago

While I personally like the DIY ethic I would be somewhat hesitant to recommend a novice starts developing production web apps. For example , someone has a great idea for a site, picks up a basic PHP book, reads all of the "advice" on PHP.net and hacks it all together with a few copy and pastes from various coding forums. Let's say they get some traction and pick up a few hundred users who start putting personal info in there , reusing their bank password and linking it to all of their social media accounts. Problem is that the app is a mess of md5 or plaintext passwords and unsanitised input and when that thing gets owned by some hacker it can have real consequences to those users who trusted it. This might be slightly hypocritical though, since this is basically how I learned to code in my early days but now people have so much of their life online that the stakes are a little higher.

nnq 14y ago
...not to be mean, but if you reuse passwords without at least having 2 of them (one for secure, money related stuff and another for everything else), you deserve having your account cleaned and identity stolen. Considering the world we leave in, I think that "basic personal informational security", like not reusing passwords, not executing email attachments and not falling for basic social engineering scams should be mandatory thought in schools starting from 10 year olds, and have something like "medium personal information security" (with knowledge of what a secued connection - green browser bar is, what a digital signature and key based authentication or multi-factor auth are) mandatory for all people handling other's personal information, even for the lowest public functionaries. These things should be drilled down into peoples' heads not matter they want to learn it or not, just as you don't ask your 7 year old whether he wants to learn to read and write, you just tell him he has to. It shouldn't matter whether you're a literature major or maybe you haven't even graduated high school, but if you have anything to do with handling others information - and 90% of people do have - you should know basic infosec just as you need to know to read and write! It's ugly, but we're living in an ugly world and in the middle of a war, even if it's invisible, and we should adapt to it!
- jiggy2011 14y ago
  Even people who follow a sensible password policy could fall victim if a site that they trust is compromised and their personal information is used against them in part of a bigger scam. The problem with providing Infosec education is that the threats change faster than we could reasonably hope to keep people up to date with them and even programmers struggle to truly understand it all.
pretoriusB 14y ago
>For example , someone has a great idea for a site, picks up a basic PHP book, reads all of the "advice" on PHP.net and hacks it all together with a few copy and pastes from various coding forums. You mean exactly what happened with CDBaby, the site the author of TFA created, which became a highly successful business? Is that a bad thing? As for the lax security thing, we have seen this too many times in supposedly big and respected web services to be particularly fearful of a newcomer. (Not to mention that the same risks to users that happen by accident by some newb programmer, can also happen by intent, by malicious companies putting up fake businesses and such. People should be vigilant in any case). There are a couple of answers I can give here: 1) When the company grows large enough, it will hire people and fix this. If it's small, it cannot do damage to many people anyway. 2) The most important services (credit cards and such) are in most cases delegated to third parties anyway (Paypal, Stripe, etc).
- jiggy2011 14y ago
  An example that comes to mind is when I was at university a fellow student built something that was effectively a speed dating type website for students. He put out the code on the university FTP server so I got a chance to look at it. Plenty of stuff in there that could easily have been exploited, luckily the site didn't really take off and I was able to help him fix the vulnerabilities (at least the ones that I could identify). If someone malicious had got into that , they would have been able to read a whole bunch of information including private messages sent between users, that could have been something that could certainly have had some bad effects on some people's lives.

nnq 14y ago

...not to be mean, but if you reuse passwords without at least having 2 of them (one for secure, money related stuff and another for everything else), you deserve having your account cleaned and identity stolen. Considering the world we leave in, I think that "basic personal informational security", like not reusing passwords, not executing email attachments and not falling for basic social engineering scams should be mandatory thought in schools starting from 10 year olds, and have something like "medium personal information security" (with knowledge of what a secued connection - green browser bar is, what a digital signature and key based authentication or multi-factor auth are) mandatory for all people handling other's personal information, even for the lowest public functionaries. These things should be drilled down into peoples' heads not matter they want to learn it or not, just as you don't ask your 7 year old whether he wants to learn to read and write, you just tell him he has to. It shouldn't matter whether you're a literature major or maybe you haven't even graduated high school, but if you have anything to do with handling others information - and 90% of people do have - you should know basic infosec just as you need to know to read and write! It's ugly, but we're living in an ugly world and in the middle of a war, even if it's invisible, and we should adapt to it!

jiggy2011 14y ago
Even people who follow a sensible password policy could fall victim if a site that they trust is compromised and their personal information is used against them in part of a bigger scam. The problem with providing Infosec education is that the threats change faster than we could reasonably hope to keep people up to date with them and even programmers struggle to truly understand it all.

pretoriusB 14y ago

>For example , someone has a great idea for a site, picks up a basic PHP book, reads all of the "advice" on PHP.net and hacks it all together with a few copy and pastes from various coding forums. You mean exactly what happened with CDBaby, the site the author of TFA created, which became a highly successful business? Is that a bad thing? As for the lax security thing, we have seen this too many times in supposedly big and respected web services to be particularly fearful of a newcomer. (Not to mention that the same risks to users that happen by accident by some newb programmer, can also happen by intent, by malicious companies putting up fake businesses and such. People should be vigilant in any case). There are a couple of answers I can give here: 1) When the company grows large enough, it will hire people and fix this. If it's small, it cannot do damage to many people anyway. 2) The most important services (credit cards and such) are in most cases delegated to third parties anyway (Paypal, Stripe, etc).

jiggy2011 14y ago
An example that comes to mind is when I was at university a fellow student built something that was effectively a speed dating type website for students. He put out the code on the university FTP server so I got a chance to look at it. Plenty of stuff in there that could easily have been exploited, luckily the site didn't really take off and I was able to help him fix the vulnerabilities (at least the ones that I could identify). If someone malicious had got into that , they would have been able to read a whole bunch of information including private messages sent between users, that could have been something that could certainly have had some bad effects on some people's lives.