News for hackers. Stuff that matters.

A comment on Using a Framework will harm the maintenance of your software. Parent comment

Re:Using a Framework will harm the maintenance of your software by megaman821 on Wednesday October 12, 2022 @11:15PM (#33186728)
I remember people saying this in a PHP days and almost without fail their code would be littered with security bugs. They don't a template language, and there would be a XSS vulnerability. They don't need an ORM, and there would be a SQL injection vulnerability. They don't need a form library, and there would be a CSRF vulnerability.

Now-a-days there are less security vulnerabilities and more buggy messes powered by Express.JS. API's with shitty query string parsers than crash the server.

The average developer should just be using a framework.

[ Parent | on HN ]
Re:Using a Framework will harm the maintenance of your software by goodpoint on Thursday October 13, 2022 @02:57AM (#33188060)
> The average developer should just be using a framework.

Yes, and the non-average shouldn't.

[ Parent | on HN ]
Re:Using a Framework will harm the maintenance of your software by raesene9 on Thursday October 13, 2022 @04:11AM (#33188505)
The tricky part is that many more developers think they're capable of handling all these issues than actually are.

Web app security is a genuinely tricky area with lots of edge cases. Good frameworks provide abstractions that mean you don't have to deal with a lot of those problems for most mainstream cases.

[ Parent | on HN ]
Re:Using a Framework will harm the maintenance of your software by hsn915 on Thursday October 13, 2022 @07:57PM (#33198037)
You're basically saying the average developer is grossly incompetent. Which I don't necessarily object to, but it's important to be aware that this is what you are saying, even though you are not using the exact phrase "grossly incompetent".

If the average developer is so incompetent maybe they should undergo further training before being allowed to touch production systems? I suppose this is what code reviews are for, but I don't see how it helps when incompetent developers review each other's code.

[ Parent | on HN ]