News for hackers. Stuff that matters.
Re:Show HN: Serverless meets Microservices by nickpsecurity on Thursday May 12, 2016 @11:28AM (#11684089)
If library is done well, then you shouldn't have to know much about SSL to be able to use it. Just an abstract idea of it plus how to use the library. SSL from an ops perspective is quite different. That's why it's better to have pro's in each working together on it.
Re:Show HN: Serverless meets Microservices by UK-AL on Thursday May 12, 2016 @11:46AM (#11684246)
I would want a developer who knows the best practice keeping the ciphersuite up to date and understands stuff like client side certificates if they going to work on any security conscious application.
Re:Show HN: Serverless meets Microservices by nickpsecurity on Thursday May 12, 2016 @12:41PM (#11684776)
I'd prefer it but one you mention can be done upstream by library developer with secure defaults. Think NaCl. Client-side certificates might come with best practices or checklists that show proper use with optional data on the way. Neither issue requires understanding SSL in common deployments.

Note that I say this while agreeing with you that I prefer someone who knows what they're doing. Especially as SSL support isn't usually at the usability standard I'm describing. Yet, it's not intrinsic to the problem: just crap UX.