6 ms·

If you're new to web application development and security, don't blindly follow the advice of someone else who is also new to web application security. You sho

If you're new to web application development and security, don't blindly follow the advice of someone else who is also new to web application security. You should instead have a security audit with people who have experience in security, so they can help you identify where and why you're system is vulnerable. If no one exists on your team/company that does, then hire a consultant. Security is a hairy issue, and no single blog post/article is going to distill the nuances down in an easy to digest manner.

codingdave 11y ago
Security is never perfect. It is a deterrent, not impenetrable prevention. So sure, to security people, it is never good enough. To everyone else, a easy to digest blog post might give them food for thought that would make their work one step better than it was before, resulting in security that is still flawed, but better. So why not just accept the post for what it is - some basic advice to do that one better step.
- balls187 11y ago
  > So why not just accept the post for what it is - some basic advice to do that one better step. http://www.nytimes.com/2015/07/10/us/office-of-personnel-management-hackers-got-data-of-millions.html http://www.nytimes.com/2015/07/10/us/office-of-personnel-man...
  - woah 11y ago
    Look up "medium-brow dismissal"
    - balls187 11y ago
      I did. Wasn't sure what I was looking for. https://www.google.com/search?q=medium-brow+dismissal&ie=utf-8&oe=utf-8 https://www.google.com/search?q=medium-brow+dismissal&ie=utf... It's clearly a logical failure to suggest heeding the authors advice would result in a catastrophic security breach. Not paying attention to security by reason of "I've done a little better than nothing at all" feels like willful negligence.
      - jaawn 11y ago
        https://news.ycombinator.com/item?id=5072224 https://news.ycombinator.com/item?id=5072224 (edit: this is an explanation of what "middle-brow dismissal" is)
    - deleted 11y ago
      [deleted]
  - codingdave 11y ago
    Do you honestly feel that the work of beginning web developers falls into the same risk management quadrant as a major governmental database of personal information?
- balls187 11y ago
  If you're going to do something, do it right. Security is never perfect, and to security people, we know that there is a tradeoff between Security and Users. We don't advocate letting The Perfect be the Enemy of the Good when it comes to security, and on the same token we want you to implement security properly if you do it.
  - oldmanjay 11y ago
    Since the security advice in the article is bad, this is more the case of the wildly incorrect is the enemy of the reader who takes the advice. Somewhat different.
  - tenken 11y ago
    "right" is subjective. there is always "good enough for right now, with the tools available, and the budget in hand".
HOLYCOWBATMAN 11y ago
I wouldnt take any advice on web dev from someone if his simple blog looks like this http://i.imgur.com/uHi0g0Z.png http://i.imgur.com/uHi0g0Z.png brb compiling linux to JS to render my blog post.
- dimxasnewfrozen 11y ago
  The footer clearly says "Proudly published with Ghost." It's not his own doing.
  - lewisl9029 11y ago
    That begs the question... why is Ghost loading all this? I had the impression that it was supposed to be a simple, bloat-free blogging platform.
jhallenworld 11y ago
If you can afford it, buy a proven security solution. For example use an IBM Datapower or ISAM appliance (or similar from F5). Enterprises will choose something like this to secure their many internal web applications.
- technion 11y ago
  Having worked with such solutions before.. the pricing can come in higher than having a professional actually review your code and improve it. The end result of better code is far better than a magical appliance.
jaawn 11y ago
In general, you may be right, but the security suggestions in this particular post are the same I hear from people "who have experience in security." Also, they often encourage readers to basically go out and find the thing everyone says is the best thing (i.e. "When storing passwords, salt and hash them first, using an existing, widely used crypto library.") I challenge you to point out specific suggestions in this article which are wrong or misleading, or to point out glaring omissions.
- grey-area 11y ago
  There are quite a few misleading or incorrect suggestions, to pick a few: Encryption passwords is not hashing (think this was fixed after publishing due to comments below) OAuth is not for authentication SPA is not suited to all or even most websites, and is far from being 'king' in any sense. CDNs have pros and cons, they don't suit everyone. Localisation does not mean serving assets closer to home, but translating stuff. Nothing better than SSL? TLS
  - jaawn 11y ago
    Most (all?) encryption functions are also hash functions, they're just special hash functions with the extra property of making it extremely difficult to discover the source. (edit: I realized after posting this, that this item is incorrect in regards to the cipher text, which obviously changes in length in relation to the length of the source, unlike the output of a hash function which is a fixed length) If OAuth is not for authentication, someone better tell Google: "Google APIs use the OAuth 2.0 protocol for authentication and authorization." [1] TLS is basically just the newest version of SSL. The name was changed for legal reasons. So it is an understandable oversight [2] The others aren't security related, so I didn't address them. [1] https://developers.google.com/identity/protocols/OAuth2 https://developers.google.com/identity/protocols/OAuth2 [2] http://security.stackexchange.com/questions/5126/whats-the-difference-between-ssl-tls-and-https http://security.stackexchange.com/questions/5126/whats-the-d...
    - dragonwriter 11y ago
Silhouette 11y ago
You should instead have a security audit with people who have experience in security, so they can help you identify where and why you're system is vulnerable. If no one exists on your team/company that does, then hire a consultant. It is easy to write that, and on the face of it, it's hard to argue against. The trouble is, those audits and consultants don't come cheap, and if you're new at web apps and working on your first one that no-one has ever heard of yet, there is little really essential that you wouldn't find investing the same time reading the usual beginners' guides to security on-line. It's all risk management, and if you even make that effort you'll already be a significantly harder target than many established sites. As a corporate lawyer once told me when I was getting the very first contract drawn up for a new business, for a simple supplier relationship, he could certainly charge me five figures and write an extensive document protecting the business against every conceivable threat he could imagine involving that supplier, but until the business had actual revenues worth protecting and the deal with that particular supplier was worth a lot more than the legal fees, he wouldn't advise doing it.
paragon_init 11y ago
If you are a business, then definitely yes. But the average self-taught developer will not have the resources available to hire a security consultant. Instead of throwing money at the problem, you can instead choose to teach yourself more about the subject. We maintain a curated list on Github for people interested in learning about application security for this very reason. https://github.com/paragonie/awesome-appsec https://github.com/paragonie/awesome-appsec But if you're a company and your operating budget is in the millions of dollars hire a security consultant!
- balls187 11y ago
  > If you are a business, then definitely yes. But the average self-taught developer will not have the resources available to hire a security consultant. True. You don't need to hire consultants to perform a security audit. Ask HN and Security Stack Exchange are good free alternatives to get critiques on your approach.
  - paragon_init 11y ago
    If you build something open source and it gets incredibly popular, security researchers will also probably come to you. This creates its own problems, of course. (Can't have problems without PR.)
borski 11y ago
This is something we help with a lot at Tinfoil (https://www.tinfoilsecurity.com https://www.tinfoilsecurity.com). You can read our blog for useful tips and info, but we always recommend actually running our web application scans against your app in order to actually look for vulnerabilities. Is it as good as having 'tptacek or someone else from Matasano looking at it as a human? Not quite, since humans have more ingenuity. Is it better than reading a blog post and trying to follow 'best practices'? Infinitely. Don't try to do it yourself.

codingdave 11y ago

Security is never perfect. It is a deterrent, not impenetrable prevention. So sure, to security people, it is never good enough. To everyone else, a easy to digest blog post might give them food for thought that would make their work one step better than it was before, resulting in security that is still flawed, but better. So why not just accept the post for what it is - some basic advice to do that one better step.

balls187 11y ago
> So why not just accept the post for what it is - some basic advice to do that one better step. http://www.nytimes.com/2015/07/10/us/office-of-personnel-management-hackers-got-data-of-millions.html http://www.nytimes.com/2015/07/10/us/office-of-personnel-man...
- woah 11y ago
  Look up "medium-brow dismissal"
  - balls187 11y ago
    I did. Wasn't sure what I was looking for. https://www.google.com/search?q=medium-brow+dismissal&ie=utf-8&oe=utf-8 https://www.google.com/search?q=medium-brow+dismissal&ie=utf... It's clearly a logical failure to suggest heeding the authors advice would result in a catastrophic security breach. Not paying attention to security by reason of "I've done a little better than nothing at all" feels like willful negligence.
    - jaawn 11y ago
      https://news.ycombinator.com/item?id=5072224 https://news.ycombinator.com/item?id=5072224 (edit: this is an explanation of what "middle-brow dismissal" is)
  - deleted 11y ago
    [deleted]
- codingdave 11y ago
  Do you honestly feel that the work of beginning web developers falls into the same risk management quadrant as a major governmental database of personal information?
balls187 11y ago
If you're going to do something, do it right. Security is never perfect, and to security people, we know that there is a tradeoff between Security and Users. We don't advocate letting The Perfect be the Enemy of the Good when it comes to security, and on the same token we want you to implement security properly if you do it.
- oldmanjay 11y ago
  Since the security advice in the article is bad, this is more the case of the wildly incorrect is the enemy of the reader who takes the advice. Somewhat different.
- tenken 11y ago
  "right" is subjective. there is always "good enough for right now, with the tools available, and the budget in hand".

HOLYCOWBATMAN 11y ago

I wouldnt take any advice on web dev from someone if his simple blog looks like this http://i.imgur.com/uHi0g0Z.png http://i.imgur.com/uHi0g0Z.png brb compiling linux to JS to render my blog post.

dimxasnewfrozen 11y ago
The footer clearly says "Proudly published with Ghost." It's not his own doing.
- lewisl9029 11y ago
  That begs the question... why is Ghost loading all this? I had the impression that it was supposed to be a simple, bloat-free blogging platform.

jhallenworld 11y ago

If you can afford it, buy a proven security solution. For example use an IBM Datapower or ISAM appliance (or similar from F5). Enterprises will choose something like this to secure their many internal web applications.

technion 11y ago
Having worked with such solutions before.. the pricing can come in higher than having a professional actually review your code and improve it. The end result of better code is far better than a magical appliance.

jaawn 11y ago

In general, you may be right, but the security suggestions in this particular post are the same I hear from people "who have experience in security." Also, they often encourage readers to basically go out and find the thing everyone says is the best thing (i.e. "When storing passwords, salt and hash them first, using an existing, widely used crypto library.") I challenge you to point out specific suggestions in this article which are wrong or misleading, or to point out glaring omissions.

grey-area 11y ago
There are quite a few misleading or incorrect suggestions, to pick a few: Encryption passwords is not hashing (think this was fixed after publishing due to comments below) OAuth is not for authentication SPA is not suited to all or even most websites, and is far from being 'king' in any sense. CDNs have pros and cons, they don't suit everyone. Localisation does not mean serving assets closer to home, but translating stuff. Nothing better than SSL? TLS
- jaawn 11y ago
  Most (all?) encryption functions are also hash functions, they're just special hash functions with the extra property of making it extremely difficult to discover the source. (edit: I realized after posting this, that this item is incorrect in regards to the cipher text, which obviously changes in length in relation to the length of the source, unlike the output of a hash function which is a fixed length) If OAuth is not for authentication, someone better tell Google: "Google APIs use the OAuth 2.0 protocol for authentication and authorization." [1] TLS is basically just the newest version of SSL. The name was changed for legal reasons. So it is an understandable oversight [2] The others aren't security related, so I didn't address them. [1] https://developers.google.com/identity/protocols/OAuth2 https://developers.google.com/identity/protocols/OAuth2 [2] http://security.stackexchange.com/questions/5126/whats-the-difference-between-ssl-tls-and-https http://security.stackexchange.com/questions/5126/whats-the-d...
  - dragonwriter 11y ago

Silhouette 11y ago

You should instead have a security audit with people who have experience in security, so they can help you identify where and why you're system is vulnerable. If no one exists on your team/company that does, then hire a consultant. It is easy to write that, and on the face of it, it's hard to argue against. The trouble is, those audits and consultants don't come cheap, and if you're new at web apps and working on your first one that no-one has ever heard of yet, there is little really essential that you wouldn't find investing the same time reading the usual beginners' guides to security on-line. It's all risk management, and if you even make that effort you'll already be a significantly harder target than many established sites. As a corporate lawyer once told me when I was getting the very first contract drawn up for a new business, for a simple supplier relationship, he could certainly charge me five figures and write an extensive document protecting the business against every conceivable threat he could imagine involving that supplier, but until the business had actual revenues worth protecting and the deal with that particular supplier was worth a lot more than the legal fees, he wouldn't advise doing it.

paragon_init 11y ago

If you are a business, then definitely yes. But the average self-taught developer will not have the resources available to hire a security consultant. Instead of throwing money at the problem, you can instead choose to teach yourself more about the subject. We maintain a curated list on Github for people interested in learning about application security for this very reason. https://github.com/paragonie/awesome-appsec https://github.com/paragonie/awesome-appsec But if you're a company and your operating budget is in the millions of dollars hire a security consultant!

balls187 11y ago
> If you are a business, then definitely yes. But the average self-taught developer will not have the resources available to hire a security consultant. True. You don't need to hire consultants to perform a security audit. Ask HN and Security Stack Exchange are good free alternatives to get critiques on your approach.
- paragon_init 11y ago
  If you build something open source and it gets incredibly popular, security researchers will also probably come to you. This creates its own problems, of course. (Can't have problems without PR.)

borski 11y ago

This is something we help with a lot at Tinfoil (https://www.tinfoilsecurity.com https://www.tinfoilsecurity.com). You can read our blog for useful tips and info, but we always recommend actually running our web application scans against your app in order to actually look for vulnerabilities. Is it as good as having 'tptacek or someone else from Matasano looking at it as a human? Not quite, since humans have more ingenuity. Is it better than reading a blog post and trying to follow 'best practices'? Infinitely. Don't try to do it yourself.