4 ms·
The fundamental problem is that bad guys can come up with new attack methods faster than we can educate or produce reliable user friendly software to counter th
by jiggy2011 14y ago
The fundamental problem is that bad guys can come up with new attack methods faster than we can educate or produce reliable user friendly software to counter their methods.
Even a sophisticated user is just as vulnerable in many cases. If I give personal information to a third party site that I presume to be trustworthy (say a government site) there's no way I can know if someone is going to find SQLi vulnerabilities in that site next week and exfiltrate all of that data.
- MacsHeadroom 14y agoSpeaking of such, I just recently accidentally happened across an SQLi vulnerability on a government site containing confidential information of tens of millions of people. That's just the way the Internet is right now.
- peterwwillis 14y agoNew attack methods are not the problem. If there is new technology there will always be a new attack method. Right now the existing attack methods are the problem. Specifically, that technology is being developed using the same lack of basic security standards and thus the same old attacks keep working. SQLi should not be a thing. At all. It's the most trivial fucking thing in the world to validate data before you use it in an SQL query, and people get it wrong, every single day. Security isn't hard, it's just tedious.