Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Lessons Learned From The Diaspora Launch

kalzumeus.com

Post reply on HN
Print view View original

111–120 of 142 posts

Re: Security Lessons Learned From The Diaspora Launch

#111

Post by sesqu »

SamReidHughes wrote: post #41
wmf wrote: post #34

Earlier quoted context omitted.

That's why professional programmers should get a B.S. in CS and then an M.S. in software engineering (or a few years of internship experience such as that required for licensed architects). Unfortunately, this is one of those things you can't say because it increases the opportunity cost of a programming career.

Or a professional programmer could just get a job and learn software engineering that way.

...by getting scolded by more senior programmers for playing amateur hour and allowing authenticated, unauthorized actions?

Re: Security Lessons Learned From The Diaspora Launch

#112

Post by equark »

code_duck wrote: post #84
equark wrote: post #45

I don't think this is that big of a deal. Pretty much every developer I know has learned about security through this exact process. Either a senior developer or user exposes the flaw and smart, but new, developers quickly realize the didn't understand the attack angles. Without concrete experience it's pretty hard to appreciate how exactly these attacks work. But after a few exploits you start getting paranoid, under…

Why would the community of experienced developers who are supposedly expected to be interested in working on this project, find it rewarding to sit around and wait for them to work through their training wheels? This whole situation really is absurd.

It doesn't seem absurd to me that a few college friends want to hack together a project to fix a problem they see. I think it's great, regardless of whether they succeed. Nobody is forcing you to join them.

Re: Security Lessons Learned From The Diaspora Launch

#113

Post by bherms »

This is a great post and shows how awesome of a community we have. The Diaspora guys are a bit behind when it comes to solid programming, but Patrick (among others) reviewed the code, noted flaws, reported and advised them on how to fix them, then wrote a great post explaining what was wrong to help others avoid the same mistakes. Stuff like this is both educational and helps the programming community move forward. Thanks to Patrick.

Re: Security Lessons Learned From The Diaspora Launch

#114

Post by metageek »

DannoHung wrote: post #93
llimllib wrote: post #18

Earlier quoted context omitted.

> That was 11 years ago. The problem is, these kids are from college . They don't teach you stuff like "writing a secure web application" in college, or even try to. (Not that this is unreasonable, though perhaps I'm suggesting that there should be different career paths for CS majors and people who intend to be professional programmers. (I say as a CS-educated professional programmer))

I disagree, this should be an obvious security capacity: Don't let people who are not permissioned to modify a given resource modify a given resource. I might be able to excuse this since they're fundamentally still in alpha (or pre-alpha) and were rushing to get code out.

"I might be able to excuse this since they're fundamentally still in alpha"

I wouldn't. Authorization is the sort of thing that has to be done first.

Re: Security Lessons Learned From The Diaspora Launch

#116

Post by gthank »

poet wrote: post #33
jlgbecom wrote: post #29

Earlier quoted context omitted.

I've always thought it would make more sense for CS degrees to be for computer scientists (ie, people who want to do more high-level theoretical work), and that software development was more of a trade school, where you learned the languages, and were soon thrown into real-world style projects and apprenticeships. Imagine if your nurse came out of college having never stepped foot into a hospital, having only read ab…

I agree with the sentiment, but it's important to note that excellent programming requires some pretty high level theoretical understanding of Computer Science (i.e. Algorithms). There's a slow way to do everything and a fast way to do some things; programmers need to understand the theory behind this. In addition, if you're trying to teach someone how to write secure code, they're going to need at least some underst…

Cooperative Eduction (http://en.wikipedia.org/wiki/Cooperative_education) is another great option. I think it gave me a huge leg up on the students who didn't participate.

Re: Security Lessons Learned From The Diaspora Launch

#117

Post by gthank »

sesqu wrote: post #111
SamReidHughes wrote: post #41

Earlier quoted context omitted.

Or a professional programmer could just get a job and learn software engineering that way.

...by getting scolded by more senior programmers for playing amateur hour and allowing authenticated, unauthorized actions?

The theory is that they know your entry-level and do some mentoring, code review, etc. to teach you about those sorts of things. That sort of depends on you getting a job with a good company, though.

Re: Security Lessons Learned From The Diaspora Launch

#118

Post by mrkurt »

bl4k wrote: post #16

"NoSQL Doesn’t Mean No SQL Injection" I lol'd. Mind if I use that? MongoDB is harder to secure and filter because you have all of Javascript to worry about, rather than just SQL (and where most servers can escape arguments themselves through prepared statements etc.). SQL databases are also well understood (for eg. in MS-SQL I can stop the remainder of the statement from executing with '--'). MongoDB with its JS engi…

Most Mongo queries don't involve javascript, they're abusing a special operator.

Re: Security Lessons Learned From The Diaspora Launch

#119

Post by jasonkester »

arethuza wrote: post #105
jasonkester wrote: post #60

Lesson learned: Never let the outside world see your First Big Project Ever. This is what Fred Brooks would have called the First System. Everybody builds this thing at the beginning of their career, and it's always this embarrassing. Mine, in 1996, took this a step further and actually prepared SQL statements in javascript before submitting them to the server to run. Yours probably did something equally bad. It's th…

Yes, but Fred Brooks also warned that the Second System would be even worse!

No need to but. I actually mentioned that above :)

Re: Security Lessons Learned From The Diaspora Launch

#120

Post by 10ren »

What idiots those Diaspora guys are! All that excellent security consulting, for free! They don't know the first thing about software development! It makes me so mad, I'm going to write up a carefully researched and detailed account of other errors they've made! Then they'll see how clueless they are - again! Ha, what amateurs!
Post reply on HN