4 ms·
Wait, why do you say all bets are off if you use Spring? Don't banks and most running the Java EE run Spring?
by infinitone 12y ago
Wait, why do you say all bets are off if you use Spring? Don't banks and most running the Java EE run Spring?
- tptacek 12y agoYes, large financials do tend to run Spring. I'm not sure what that has to do with the safety of the framework. Banks do not as a rule have safer code than other kinds of enterprises.
- cpach 12y agoIs it really that naive to assume that banks have higher security standards than, say, shopping list apps? ;-)
- tptacek 12y agoI'm not sure "naive" is the word I'd choose. Let's just say those standards are often aspirational.
- cpach 12y ago:)
- wolf550e 12y agoMy bank's site is SSLv3-only. Banks do the least amount of security they can get away with, because they do not compete on security and they are insured against loss and the customers indirectly pay for the insurance via fees.
- smt88 12y agoMy friend works for Accenture. Whenever they've tried to pitch a security project to a company, the company has basically laughed in their faces. They'd rather have just paid out for a huge loss of data (think Target and Home Depot) rather than put in the money upfront. They thought the upfront money would be greater. After those aforementioned disasters, things have changed, and Accenture is now (a little bit more) able to sell security projects.
- smt88 12y agoSpring brags about having 1.3 million lines of code. That's a security nightmare right there, and that amount of code is nowhere close to being necessary for a web API. No one person can get a handle on all that code.