Beefy Boxes and Bandwidth Generously Provided by pair Networks
XP is just a number
 
PerlMonks  

Re: •web site design, or lack thereof

by Hero Zzyzzx (Curate)
on Apr 07, 2002 at 14:25 UTC ( #157274=note: print w/ replies, xml ) Need Help??


in reply to web site design, or lack thereof

Not only is security not layered in from the start, and it's not taught to folks, I think there is a set of developers who don't think it's as important as it is. This is probably due to lack of training, because I don't think folks want to do a bad job, if they KNOW they are doing a bad job.

I view CGI security like nutrition education related to health care in the US. If everyone were taught it and understood it, from the very beginning, many problems would be avoided.

I did a code review for a woman who built a formmail.pl like script. She accepted "to" addresses straight from submitted form elements with no "validity" checking (like making sure only certain addresses could be mailed to, or better yet, taking email addresses right off the page and integrating them into her app), making her script (which she distributes on her website, BTW) ripe for hijacking by spammers. When I pointed this out to her, her response was "No one is going to bother to figure it out. Besides, I want my scripts to be usable by average humans."

Her point being that security by obscurity was enough, and that "security" ne "usability". My reply back was if you're doing something, you should do it RIGHT, and not protecting your users is a BAD THING. At least give them the option to have a secure script. If someone is going to install a freakin' script, they can make a list of valid email addresses (or maybe they shouldn't be using CGI scripts. . .) Anyway, she wanted to work collaboratively on a project with me. . .I think I'll pass on this one.

-Any sufficiently advanced technology is
indistinguishable from doubletalk.


Comment on Re: •web site design, or lack thereof

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://157274]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others chilling in the Monastery: (8)
As of 2014-12-25 00:32 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    Is guessing a good strategy for surviving in the IT business?





    Results (159 votes), past polls