3 ms·

The reason it's amateur hour is security is an expertise and it's so easy for everyone else to screw it up that that's basically the default. I hope one day tp

The reason it's amateur hour is security is an expertise and it's so easy for everyone else to screw it up that that's basically the default. I hope one day tptacek or someone will distill web application security down to a really simple checklist that even the dumbest of developers can refer to so that at least we make less of the stupid mistakes.

konceptz 12y ago
That's one of the goals of owasp linked in the above post.
- benologist 12y ago
  I do like that link but it leaves it to us, the people who don't know or care deeply about this stuff, to study the problems further and come up with our own solutions. Ideally we'd be given answers instead of just a starting point for additional research.
  - runlevel1 12y ago
    It's hard to invest yourself in something you're not interested in. It's also difficult to know where to begin when there are so many "unknown-unknowns." That in mind: Don't try to be an expert. Start with awareness. 1. Don't roll your own security solutions. Leave it to the experts (i.e. a mature web framework). 2. Learn the best practices for your web framework of choice.[^1] 3. Have a basic understanding of the attacks. You'll find security to be a far less daunting challenge when you chip away at the "unknown-unknowns." Even if they just become "known-unknowns," you'll then know where to focus your attention and be better able to ask the right questions. [1]: For example, http://guides.rubyonrails.org/security.html http://guides.rubyonrails.org/security.html
    - benologist 12y ago
      Why should we treat security like it's something we can google our way through in an afternoon? That's why sites and servers are compromised in record numbers every week. Imagine if we asked doctors for hints.
- Gigablah 12y ago
  Unfortunately the OWASP website is a mess... took me a while to even find the relevant articles on web app security from the landing page.
kybernetyk 12y ago
> even the dumbest of developers Don't you think it's time to get off your high horse?
- benologist 12y ago
  Perhaps you should be less defensive about the incredibly low amount of knowledge/talent/intelligence required to put together many web or mobile apps? If you read the rest of that sentence I included myself in that group since when it comes to security I've not many clues.

konceptz 12y ago

That's one of the goals of owasp linked in the above post.

benologist 12y ago
I do like that link but it leaves it to us, the people who don't know or care deeply about this stuff, to study the problems further and come up with our own solutions. Ideally we'd be given answers instead of just a starting point for additional research.
- runlevel1 12y ago
  It's hard to invest yourself in something you're not interested in. It's also difficult to know where to begin when there are so many "unknown-unknowns." That in mind: Don't try to be an expert. Start with awareness. 1. Don't roll your own security solutions. Leave it to the experts (i.e. a mature web framework). 2. Learn the best practices for your web framework of choice.[^1] 3. Have a basic understanding of the attacks. You'll find security to be a far less daunting challenge when you chip away at the "unknown-unknowns." Even if they just become "known-unknowns," you'll then know where to focus your attention and be better able to ask the right questions. [1]: For example, http://guides.rubyonrails.org/security.html http://guides.rubyonrails.org/security.html
  - benologist 12y ago
    Why should we treat security like it's something we can google our way through in an afternoon? That's why sites and servers are compromised in record numbers every week. Imagine if we asked doctors for hints.
Gigablah 12y ago
Unfortunately the OWASP website is a mess... took me a while to even find the relevant articles on web app security from the landing page.

kybernetyk 12y ago

> even the dumbest of developers Don't you think it's time to get off your high horse?

benologist 12y ago
Perhaps you should be less defensive about the incredibly low amount of knowledge/talent/intelligence required to put together many web or mobile apps? If you read the rest of that sentence I included myself in that group since when it comes to security I've not many clues.