Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #4411

Re: Lilupophilupop

Show all headers | View raw

On Sat, 07 Jan 2012 18:27:15 +0100, Thomas Mlynarczyk wrote:

> Jerry Stuckle schrieb:
>
>> Validating all input from the user is just good programming practice.
>
> And properly (!) escaping output (this includes stuff that goes into
> SQL queries). As I see it, these two simple measures should prevent
> 99% of all security vulnerabilities. I'd be interested in learning
> about the remaining 1% though.
>
>> Nothing new here - it just shows there are a lot of programmers out
>> there unconcerned with security.
>
> Indeed. But I don't understand why this is so. After all, we're not
> talking about the personal homepage of some newbie showing pictures
> of his dog and favourite cookie recipes. The problem exists also (if
> not especially) with real big professional sites, even sites where
> security is paramount (online banking), run by people who should have
> more than enough money to pay competent, security-aware programmers to
> do the job properly. I just don't get it.

Good programmers and idiots are indistinguishable to anyone that is not
a good programmer. The people making the hiring decisions are not good
programmers. Ergo, idiots and good programmers get hired in proportion
to the frequency of each in the job market, and the idiots move on to
other positions far more frequently, voluntarily or involuntarily. 

Which also means that even if good programmers and idiots are in roughly
equal measure, the good programmers are not in the market for new jobs
nearly as often, make up a smaller portion of the market, and
not-programmers are unlikely to hire them by accident.

-- 
88. If a group of henchmen fail miserably at a task, I will not berate
    them for incompetence then send the same group out to try the task
    again.
	--Peter Anspach's list of things to do as an Evil Overlord

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-07 13:15 +0100
  Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 08:15 -0500
    Re: Lilupophilupop Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-07 18:27 +0100
      Re: Lilupophilupop "J.O. Aho" <user@example.net> - 2012-01-07 18:52 +0100
        Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 16:02 -0500
      Re: Lilupophilupop "Peter H. Coffin" <hellsop@ninehells.com> - 2012-01-10 18:31 -0600
        Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-11 09:29 +0100
          Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-11 08:42 -0500
          Re: Lilupophilupop Erwin Moller <erwinmollerusenet@xs4all.nl> - 2012-01-11 15:23 +0100
  Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-07 14:28 +0100
    Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-07 16:13 +0100
      Re: Lilupophilupop Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-01-07 18:03 +0100
      Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-07 20:34 +0100
        Re: Lilupophilupop "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-08 14:53 +0100
          Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 15:27 +0100
            Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 10:00 -0500
              Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 18:29 +0100
                Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 15:49 -0500
                Re: Lilupophilupop Gregor Kofler <usenet@gregorkofler.com> - 2012-01-08 22:59 +0100
                Re: Lilupophilupop Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 17:38 -0500

csiph-web