Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why must you laugh at my back end?

blog.pud.com

Post reply on HN
Print view View original

151–160 of 230 posts

Re: Why must you laugh at my back end?

#151

Post by antonp »

radagaisus wrote: post #119
wynand wrote: post #15

Earlier quoted context omitted.

I have respect for people that can deliver, regardless of what they use. The allure of cool tech is strong but tech doesn't make products: people do. I cannot see what is wrong with your using plain PHP if you can get the job done faster (as long as you avoid things that make exploits easy, such as raw mysql db functions). When the time for a framework comes, you'll know. Stop worrying about what others think and goo…

here's how I learned Python without noticing it: (I had a background in PHP, JS, C++) 1. Off hours on 2-3 days with dive into python 3. 2. A month later - 'oh let's do this in python!' on google code jam 3. 'python challenge? that's cool' - one night hackathon a month later 4. 'I hate php, I'll do this new web app in django' 5. Two days messing with django 6. Five days and the app was done. I don't know if I write 'b…

>I don't know if I write 'best practice' python or django but it's about x6 less code than in PHP.

Just curious... Surely you mean django vs php (not zend or some other framework - which _would_ have been the fair comparison.

Re: Why must you laugh at my back end?

#152

Post by eropple »

radagaisus wrote: post #150
eropple wrote: post #132

Earlier quoted context omitted.

Kohana is a little brain-damaged. Good intentions, but it's essentially a PHP5 version of CodeIgniter in most ways that matter. The problem with this is that a PHP5 version of CodeIgniter doesn't leverage the constructs and concepts that make PHP5.3 (which in 2011 is the lowest version of PHP you should be considering) much more pleasant to work with than previous iterations. Kohana, and CI2, are both rather meat-axe…

Kohana 3 is not a rewrite of CI. it was written from scratch. Kohana also has the worst documentation in the world. Seriously. It has very clear comments in its source code, though.

Yes, it's written from scratch--which is why I said "essentially". It's a full rewrite into what is still not very idiomatic PHP5.1, and I can't really recommend using a non-5.3 framework given the improvements in expressivity and flexibility that came with 5.3.

Re: Why must you laugh at my back end?

#153

Post by eropple »

paganel wrote: post #143
eropple wrote: post #129

Earlier quoted context omitted.

Sorry, but this is bull. If you take any information, even if it's an email and password, data security is either tops on your list or you're abusing your users (even "only a hundred"; one is too many!). There is literally zero middle ground on this: you do it or you shouldn't be building web applications. And given how utterly trivial it is to provide proof against injection attacks in any modern language and toolki…

> Sorry, but this is bull. If you take any information, even if it's an email and password, data security is either tops on your list or you're abusing your users (even "only a hundred"; one is too many!). There is literally zero middle ground on this: you do it or you shouldn't be building web applications http://blog.moertel.com/articles/2006/12/15/never-store-pass... Needless to say, almost 5 years have passed and…

I'm unclear why you replied to me, because you didn't say anything meaningful.

I did not say you couldn't build web applications if you were a jerkass who was cavalier with the security of his users' data. I said you shouldn't.

Re: Why must you laugh at my back end?

#154

Post by qaexl »

3pt14159 wrote: post #126
abscondment wrote: post #91

Earlier quoted context omitted.

1-3 remind me of a great "I Can Has Cheezburger?" anecdote about being a successful CTO: http://www.scottporad.com/2010/11/12/what-it-really-means-to...

I wish more people knew about FreshBooks' rewrite. They had horrible code. And they slowly morphed it into a php-python-ruby mix which is (from my dev friends there) pretty damn good now. It's ok to have a setup or tools that are fucked, but FB would never be able to hold onto developers or iterate quickly on their product if they hadn't sunk at least 9 man-years on the clean up. A million bucks for a slow rewrite is…

You ever played Weiqi? (Otherwise known as Go).

Unlike chess, stones don't move once played. They can only be captured. On a 19x19 board, you have to balance short-term gains with long-term gains. Since there are no left-right or top-bottom orientations, you often have to reimagine where you draw the lines of territory as you play. Sometimes, you can kill your shapes by playing too many stones. Better players can see where things will go, identify "dead shapes," and stop wasting time trying to rescue them. Sometimes you trade off bad moves for bigger gains. Sometimes you simply have to work with mistakes you made in the early game.

This is very much like writing code and getting it to market. You're trying to build something despite disruptive opposition even as the clock winds down.

Re: Why must you laugh at my back end?

#155

Post by RossDM »

Hisoka wrote: post #94
nhashem wrote: post #9

This is great. Seriously. I cut my teeth in the early 2000s writing the type of PHP code that would make your eyes bleed. Global variables everywhere. HTML/PHP/MySQL in the same file. Career-wise I ended up going down a backend/database developer path, so if I do anything with consumer-facing web applications, it's on my free time. I'm working on such an app now, and right now the fastest way I can get anything done…

That's not a bad strategy. I also believe in "Just get it out and done ASAP and brush it up like heck afterwards". Worry about injection attacks, efficiency issues, scaling after you gain some traction. You can always rewrite later when it becomes an issue.

Problem is that 'rewrite later' never happens because you're always busy. Setting up safeguards to protect against common attacks is quick enough that it can be done upfront. Efficiency and scaling can usually wait, though figure it out ahead of time if possible.

Re: Why must you laugh at my back end?

#156

Post by prawn »

slowpoke wrote: post #116
olliesaunders wrote: post #107

Earlier quoted context omitted.

No good if you care about IE6 support

Unless you have a boss telling you to support IE6, you don't . People need to stop using this prehistoric excuse for a browser.

As you said, some people work at companies that mandate its use - they have no choice. While that's happening, it needs to be considered.

Re: Why must you laugh at my back end?

#158

Post by auxbuss »

gaius wrote: post #120
wynand wrote: post #15

Earlier quoted context omitted.

I have respect for people that can deliver, regardless of what they use. The allure of cool tech is strong but tech doesn't make products: people do. I cannot see what is wrong with your using plain PHP if you can get the job done faster (as long as you avoid things that make exploits easy, such as raw mysql db functions). When the time for a framework comes, you'll know. Stop worrying about what others think and goo…

Delivering version 1 is very different from delivering version 2, 3 4... That's when the real test of engineering is.

Not just because this is what I do, mainly, but it's such an important point that it deserves highlighting. Working software is easy. Working maintainable software is harder.

Re: Why must you laugh at my back end?

#159

Post by mark242 »

Hisoka wrote: post #123
mark242 wrote: post #98

Earlier quoted context omitted.

Can you please list out the applications you've created? I'd like to add them to my "never ever register on these sites" list. If you're only worrying about injection attacks "...after you gain some traction" or "...when it becomes an issue" you're already too late, and I don't ever want to trust any of my private data with you, ever. This is the 21st century. Scrubbing and validating user input is _trivial_ now, fra…

Oh please. I'm not building anything that requires a credit card, or anything sophisticated. When you have literally just a hundred users, YES I will skip paying lots of attention on injection attacks because the chances of that happening is very low. To you techies, it sounds like a huge deal, but the priority in any business to make profit first.

Let this post be a warning to web entrepreneurs everywhere-- if you take shortcuts like this, your business will get burned at some point in the future. Every single thing you've just said is wrong. Every single thing.

First -- "the chances of that happening is very low." Let this be an education; there are automated toolsets that seek out and exploit known vulnerabilities in software across the entire Internet. If you have a public-facing website, you will get attacked. Period. The chances aren't "very low", they are a certainty. There are also toolsets that are used to do much more low-level scans for things like XSS, SQL injection, etc. These are commonly used by security auditors, but are also used by 13 year old kids who want to compromise your site. Again-- the chances aren't "very low", they are a certainty.

Next -- "...but the priority in any business to make profit first." State attorneys general are very quickly drafting personal privacy laws. I believe Massachusetts and Nevada are leading the way here, whereby any personally-identifiable information is _required_ _by_ _law_ to be held to the same rigorous data protection standards as PCI. If your site is breached, you will get sued, and you will lose.

Following OWASP takes maybe an extra day's worth of time out of a developer-- saying that you're just going to ignore it because hey, what's the worst that could happen -- again, I would ask you to list what you're building, so I can avoid it forever.

Re: Why must you laugh at my back end?

#160

Post by dasil003 »

Hisoka wrote: post #123
mark242 wrote: post #98

Earlier quoted context omitted.

Can you please list out the applications you've created? I'd like to add them to my "never ever register on these sites" list. If you're only worrying about injection attacks "...after you gain some traction" or "...when it becomes an issue" you're already too late, and I don't ever want to trust any of my private data with you, ever. This is the 21st century. Scrubbing and validating user input is _trivial_ now, fra…

Oh please. I'm not building anything that requires a credit card, or anything sophisticated. When you have literally just a hundred users, YES I will skip paying lots of attention on injection attacks because the chances of that happening is very low. To you techies, it sounds like a huge deal, but the priority in any business to make profit first.

I'm not going to jump down your throat on this, because everyone is inexperienced at some point, and you can never know everything, so on one hand your attitude of "just ship" is healthy.

That said, one of the things that (hopefully) comes with experience is knowing when and where to cut corners. Basic security practices are one place where you need to bake your understanding into everything you do from a low level, because security is one of the hardest "features" to retrofit. Also because basic security does not have to be hard. Hell, you can make an informed decision not to use SSL on your login page, but it must be just that, informed.

Unlike the language du jour, security principles are something that will apply to all programming you do for the rest of your life. So, though you may decide not to use trendy framework x, y or z today, failing to learn basic security and apply it consistently will slowly turn you from a young developer with bright ideas and a lot of potential, to a middle-aged hack developer with a defensive chip on his shoulder.

Post reply on HN