Yep, exactly my thoughts. Unfortunately very few developers really think (about related but not completely adjacent code) when they implement stuff (and that’s when they are even “allowed to” by the task requirements) and even fewer have true knowledge of security and common pitfalls and whatnot to avoid such issues.
And even when you have those you still need good practices and code reviews where the rest of the slip ups is caught.
You’re correct. And I don’t think we are armchair coding. We know proper security is so hard that even experienced developers can write code vulnerable to something like a timing attack. But sending secure data to unvalidated input isn’t a minor slip up that could happen to anyone. They are either unaware of or not bothering with good practices.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@programming.dev
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
Follow the programming.dev instance rules
Keep content related to programming in some way
If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos
Yep, exactly my thoughts. Unfortunately very few developers really think (about related but not completely adjacent code) when they implement stuff (and that’s when they are even “allowed to” by the task requirements) and even fewer have true knowledge of security and common pitfalls and whatnot to avoid such issues.
And even when you have those you still need good practices and code reviews where the rest of the slip ups is caught.
You’re correct. And I don’t think we are armchair coding. We know proper security is so hard that even experienced developers can write code vulnerable to something like a timing attack. But sending secure data to unvalidated input isn’t a minor slip up that could happen to anyone. They are either unaware of or not bothering with good practices.