Why is modern web development so complicated?

Re:Why is modern web development so complicated? by orf on Wednesday August 07, 2019 @04:32PM (#20638658)

I remember seeing this one post on HN from some PHP consultancy that had open sourced some kind of PHP web app that was "engineered from the start to be secure".

I took a look at the code on GitHub and it was absolutely horrible. They basically built their own mini-framework, poorly, with mixed concerns and poor, ad-hoc and inconsistent validation everywhere. Terrible.

I left an issue on GitHub with my findings and got into an argument with the author in the HN submission about how it's disingenous to say something is engineered from the ground up to be secure, if you're eschewing all the man hours that have gone into something like Larvel. I think his reasoning boiled down to "Larvel has CVE's so it's not secure".

Some people are just like that I guess.

Edit: found it - "How We Engineered CMS Airship to Be Simply Secure" https://news.ycombinator.com/item?id=13905055

[ Parent | on HN ]

Re:Why is modern web development so complicated? by wolco on Wednesday August 07, 2019 @05:01PM (#20639013)

Messy code is not insecure code and clean looking code is not secure code by default.

It could be a signal of sloppyness or writing it in vim.

[ Parent | on HN ]

Re:Why is modern web development so complicated? by orf on Wednesday August 07, 2019 @05:04PM (#20639050)

I totally agree. My point was:

> This is not engineering a project to be "simply secure", in the sense that it is definitely not simple and probably not secure!

Messy, duplicated code that re-invents the wheel hides security bugs.

Saying "Windows has security issues, so I'm going to write my own operating system for my software" doesn't mean you can't knock it out of the park and make the most secure operating system ever... but I wouldn't exactly bet on that being the case.

[ Parent | on HN ]