Why must you laugh at my back end?

Re:Why must you laugh at my back end? by eropple on Tuesday August 30, 2011 @04:45PM (#2943171)

Sorry, but this is bull. If you take any information, even if it's an email and password, data security is either tops on your list or you're abusing your users (even "only a hundred"; one is too many!). There is literally zero middle ground on this: you do it or you shouldn't be building web applications. And given how utterly trivial it is to provide proof against injection attacks in any modern language and toolkit, choosing not to do so because it's "hard" as irresponsible as you can get.

This sort of behavior is why the rest of us get a bad rap.

[ Parent | on HN ]

Re:Why must you laugh at my back end? by paganel on Tuesday August 30, 2011 @05:18PM (#2943303)

> Sorry, but this is bull. If you take any information, even if it's an email and password, data security is either tops on your list or you're abusing your users (even "only a hundred"; one is too many!). There is literally zero middle ground on this: you do it or you shouldn't be building web applications

http://blog.moertel.com/articles/2006/12/15/never-store-pass...

Needless to say, almost 5 years have passed and they're still around :) their traffic probably a couple of orders of magnitude higher. I was there when it happened, and yes, probably some Russian hacker or whatnot has my password from there, but that's not such a big deal because reddit doesn't know my name, doesn't have my CC number or any details related to my life.

Now, were this to happen to a company that has a lot more information available about each and every one of us stored in one central place (think Google or FB), then things could get really nasty. And I'm not talking about stupid mistakes like the one from above, I'm talking about MITM attacks orchestrated by (vicious) Governments, or cyber-warfare, or just plain old NSA not having to bother to collect information from a myriad of places anymore, when they can just go directly to the source.

[ Parent | on HN ]

Re:Why must you laugh at my back end? by eropple on Tuesday August 30, 2011 @06:37PM (#2943532)

I'm unclear why you replied to me, because you didn't say anything meaningful.

I did not say you couldn't build web applications if you were a jerkass who was cavalier with the security of his users' data. I said you shouldn't.

[ Parent | on HN ]

Re:Why must you laugh at my back end? by paganel on Wednesday August 31, 2011 @04:25AM (#2944779)

>I did not say you couldn't build web applications if you were a jerkass who was cavalier with the security of his users' data. I said you shouldn't.

That would have left us without reddit, I don't know about you, but without it the Internet would have been a lot less interesting.

[ Parent | on HN ]

Re:Why must you laugh at my back end? by evilduck on Wednesday August 31, 2011 @09:49AM (#2945498)

Compromising user data isn't a prerequisite to building something cool. Negligence is still negligence. Drunk drivers make it home without killing anyone more often than not.

[ Parent | on HN ]

Re:Why must you laugh at my back end? by Hisoka on Thursday September 01, 2011 @12:12AM (#2948630)

Ok Point taken. And lesson learned. I take what I said back. Security is important.

[ Parent | on HN ]