Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #4412

Re: Lilupophilupop

Show all headers | View raw

Am 11.01.2012 01:31, schrieb Peter H. Coffin:
> On Sat, 07 Jan 2012 18:27:15 +0100, Thomas Mlynarczyk wrote:
> 
>> Jerry Stuckle schrieb:
>>
>>> Validating all input from the user is just good programming practice.
>>
>> And properly (!) escaping output (this includes stuff that goes into
>> SQL queries). As I see it, these two simple measures should prevent
>> 99% of all security vulnerabilities. I'd be interested in learning
>> about the remaining 1% though.
>>
>>> Nothing new here - it just shows there are a lot of programmers out
>>> there unconcerned with security.
>>
>> Indeed. But I don't understand why this is so. After all, we're not
>> talking about the personal homepage of some newbie showing pictures
>> of his dog and favourite cookie recipes. The problem exists also (if
>> not especially) with real big professional sites, even sites where
>> security is paramount (online banking), run by people who should have
>> more than enough money to pay competent, security-aware programmers to
>> do the job properly. I just don't get it.
> 
> Good programmers and idiots are indistinguishable to anyone that is not
> a good programmer. The people making the hiring decisions are not good
> programmers. Ergo, idiots and good programmers get hired in proportion
> to the frequency of each in the job market, and the idiots move on to
> other positions far more frequently, voluntarily or involuntarily. 
> 
> Which also means that even if good programmers and idiots are in roughly
> equal measure, the good programmers are not in the market for new jobs
> nearly as often, make up a smaller portion of the market, and
> not-programmers are unlikely to hire them by accident.
> 

I agree.

But beware the fallacy of the single cause. Good programmers and
idiots can change under certain conditions - learn and un-learn
good programming.

And even good programmers make compromises in their code under
the pressure of time-to-market.

/Str.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-07 13:15 +0100
  Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 08:15 -0500
    Re: Lilupophilupop Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-07 18:27 +0100
      Re: Lilupophilupop "J.O. Aho" <user@example.net> - 2012-01-07 18:52 +0100
        Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 16:02 -0500
      Re: Lilupophilupop "Peter H. Coffin" <hellsop@ninehells.com> - 2012-01-10 18:31 -0600
        Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-11 09:29 +0100
          Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-11 08:42 -0500
          Re: Lilupophilupop Erwin Moller <erwinmollerusenet@xs4all.nl> - 2012-01-11 15:23 +0100
  Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-07 14:28 +0100
    Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-07 16:13 +0100
      Re: Lilupophilupop Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-01-07 18:03 +0100
      Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-07 20:34 +0100
        Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-08 14:53 +0100
          Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 15:27 +0100
            Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 10:00 -0500
              Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 18:29 +0100
                Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 15:49 -0500
                Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 22:59 +0100
                Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 17:38 -0500

csiph-web