4 ms·

> anit-patterns can be learned a spell checker didn't save you from a typo. not nitpicking, just using this example to illustrate a point: for an app to be se

> anit-patterns can be learned a spell checker didn't save you from a typo. not nitpicking, just using this example to illustrate a point: for an app to be secure, developers have to be 100% of the time on ball, while an attacker just has to be lucky once. the weight is so much in favor of attacker than only few of the biggest can afford to pay for a competitive level of security, it being a race: security is effective not when perfect, but when it costs more to attack a site than what you'd gain of it.

mdpopescu 11y ago
Or even when the gain/cost ratio for attacking YOUR site is greater than the one for other sites. (You don't have to outrun the bear, you have to outrun the other people.)
ethbro 11y ago
> a spell checker didn't save you from a typo Believe this is where parent's preference for high-quality, easy-to-use libraries handling common security operations comes from. It's a lot easier to make a typo (or logical mistake) in 250 lines of your own code than in (hopefully) <250 lines of a library invocation. Honestly, library functionality like this in any given language should be thought of as an analog to infrastructure spending. We're finally seeing reinvestment from end-users and value capturers (Facebook, Google, MS, etc) back down the chain to the OSS projects they depend on. Language guiders (and in some cases the support businesses who are attached to languages) should be equally serious about this. If your language doesn't have high-quality, easy-to-use libraries to mitigate attack surfaces, that's a fundamental weakness in your language eco-system... (Aka the "Perl+CPAN is better than a lot of more advanced languages, because code" argument)