There's a concept that you should use several products in highly secure environments.

For example, if your input validation is written in PHP, you might want to write another layer in front, i.e. in your reverse proxy layer, using something like https://github.com/nbs-system/naxsi. The way, neither just a PHP bug nor a lua bug should defeat you.

In reality, they're probably written by the same person, and thus it's probably a logic bug that will result in a hack and, assuming a zero sum game in engineering time, I'd probably rather focus on protective monitoring than rewriting the same input validation.

But there you go. In much the same way, if you don't really believe you can trust cisco or huawei to protect against their respective governments, then you layer both and hope they keep each other in check.

This is usually a better way to get multiple single points of failure than it is to get a more resilient system.

True @tptacek, but we're talking about systems where you'd rather the system fail closed than leak anything. Not something one would really normally consider for their uber for hedgehogs app.

Personally, I'm not really a big fan of the baseline for the guidence being behind closed doors, I prefer to be able to read said validation, but the guidence does exist and is parroted around the industry occasionally.

You can click on the timestamp of a comment and reply to it there so you don't have to @ people like a barbarian.

You can give the usability information about this website without calling a group of people barbarians.

I jokingly compared a single person to a barbarian without calling anyone a barbarian, like a barbarian.

Then again, we are in discussion regarding PHP, so someone's bound to point out we're a bunch of neanthardal barbarians just because of that. So it could have been just a kneejerk reaction.