Ask HN: I'd like to learn more about programming secure websites

Re:Ask HN: I'd like to learn more about programming secure w... by yan on Thursday November 19, 2009 @11:36AM (#950506)

I also feel that I should point out: Putting forms behind SSL does not absolve you of secure coding guidelines! SSL does not influence whether or not your webapp is vulnerable to traditional injection and logic flaw attacks.

[ Parent | on HN ]

Re:Ask HN: I'd like to learn more about programming secure w... by Ixiaus on Thursday November 19, 2009 @12:11PM (#950582)

While that is true, the OP said he was interested in learning more beyond just SQL injection etc...

Which brings me to your second subject: logic flaw. That is probably the most common security flaw than anything else. It is been made worse by the fact that most "web developers" don't actually understand logic nor the full implications of structured programming.

It is compounded by a lack of understanding system fundamentals too; it's quite common amongst developers I have met to not know why "0123" comes out as "83" in any scripting language built atop C (Python and PHP are popular examples). (Hint for those that don't know: C interprets integer literals with a leading zero as an Octal number).

[ Parent | on HN ]

Re:Ask HN: I'd like to learn more about programming secure w... by diN0bot on Thursday November 19, 2009 @12:55PM (#950666)

haha. this is so true. i have no doubts the biggest problems we'll face with early product iterations are our own bugs rather than malicious third parties :-)

we'll do the best we can to get both fronts up to snuff before the general public gets a stab at us.

[ Parent | on HN ]