Show HN: Security Training for Developers • Hacker News Board

Re: Show HN: Security Training for Developers

#11

Post by zmitri » Thu, Mar 10, 2016, 3:20 AM UTC

Enjoyed this a lot. Great starting point for anyone interested.

Re: Show HN: Security Training for Developers

#12

Post by billyhoffman » Thu, Mar 10, 2016, 3:25 AM UTC

Slick and a nice UI, but the security advice in this is just plain terrible.

Blacklist input validation as defense against XSS? Are you kidding me? And then over to session fixation, where I see the exact same ?jessionid=blah example that has been in any Web Security book for the last 10-15 years? Come on!

Re: Show HN: Security Training for Developers

#13

Post by barbs » Thu, Mar 10, 2016, 3:54 AM UTC

At a glance this seems to be aimed mostly at web developers. How much of this would be relevant for a native mobile developer like myself?

Re: Show HN: Security Training for Developers

#14

Post by greggh » Thu, Mar 10, 2016, 4:17 AM UTC

This is so beautiful that I wish it was good advice, but it's not. Some of these examples actually introduce problems. SHA-256? Really?

Re: Show HN: Security Training for Developers

#15

Post by malcolmhere » Thu, Mar 10, 2016, 4:36 AM UTC

bsrx wrote: post #7

Any comments on who put this together, or their long term goals?

Author here! I put this together because I was bit frustrated with the quality of teaching resources for my development team. (And I find the OWASP wiki a bit of a mess.)

Not sure about the business model yet, though it's peaked some interest here and on /r/programming, so I figure there's an appetite for good training material.

Re: Show HN: Security Training for Developers

#16

Post by malcolmhere » Thu, Mar 10, 2016, 4:38 AM UTC

barbs wrote: post #13

At a glance this seems to be aimed mostly at web developers. How much of this would be relevant for a native mobile developer like myself?

Give it a try, it's free! We don't cover mobile specifically, but if you are building APIs, much of the advise is useful. And thinks like password management are useful for every developer to know. :-)

Re: Show HN: Security Training for Developers

#17

Post by malcolmhere » Thu, Mar 10, 2016, 4:38 AM UTC

greggh wrote: post #14

This is so beautiful that I wish it was good advice, but it's not. Some of these examples actually introduce problems. SHA-256? Really?

My bad, I've removed the reference to outdated password schemes. :-o

Re: Show HN: Security Training for Developers

#18

Post by TACIXAT » Thu, Mar 10, 2016, 5:00 AM UTC

Security is hard. XSS lol.

http://i.imgur.com/3QJfsu7.png

Re: Show HN: Security Training for Developers

#19

Post by malcolmhere » Thu, Mar 10, 2016, 5:36 AM UTC

TACIXAT wrote: post #18

Security is hard. XSS lol. http://i.imgur.com/3QJfsu7.png

Oh wow. Would love to know you did that. :-o

Re: Show HN: Security Training for Developers

#20

Post by johnsonjo » Thu, Mar 10, 2016, 6:11 AM UTC

TACIXAT wrote: post #18

Security is hard. XSS lol. http://i.imgur.com/3QJfsu7.png

Even though you did manage to get that far. It doesn't seem that you can actually make it persist or anything like that on his site so it is probably about as useful of an XSS as typing directly into the console on your browser.