Re:Using a Framework will harm the maintenance of your software
by ldng on Thursday October 13, 2022 @03:30AM
(#33188251)
And of course you regularly check back for bugs and security issues, right?
Re:Using a Framework will harm the maintenance of your software
by snovv_crash on Thursday October 13, 2022 @03:53AM
(#33188402)
Usually the security issues come from the wrapper code that tries to hammer the square peg of an algorithm into the round hole of the abstraction they provide. Dropping the wrapper code is the safest thing you can do.
Re:Using a Framework will harm the maintenance of your software
by raesene9 on Thursday October 13, 2022 @04:10AM
(#33188502)
I used to be a web app security tester. I loved it when I got an app that didn't use a framework for development because I knew I'd get some security issues for sure.
In the context of web applications, frameworks mean that your devs don't have to be experts in SQL Injection, XSS, SSRF, Session management etc etc etc.
My experience over several hundred tests was that without a framework there weren't many apps that could get that right first time. If they were lucky the pentesters found the issues, if they were unlucky, it was attackers.
Re:Using a Framework will harm the maintenance of your software
by snovv_crash on Thursday October 13, 2022 @06:33AM
(#33189323)
A library could work here too, to turn off the footguns and provide safe tooling. No need for the library to also intercept all of the DOM callbacks for you as well.
I'm much more likely to rip out the one function I need out of a framework or library and put it in my code, with a comment "// stolen from <source>". I've spent lots of time untangling the crux of someone's implementation away from the problematic abstractions they built up around it to make it universally adaptable.