Ask HN: How to secure your code or software?

9 points·forkLding··6 comments

I've developed code and apps etc. and have realized the importance of secure coding. What are the general principles that people should adopt when they what to make their code secure and what should they pay attention to?

I've searched around on HN and haven't found a similar thread so decided to start it

View on HN

OWASP is an excellent source for learning about application security, I advise you to check it out: https://www.owasp.org/index.php/Main_Page

The website's structure migth not be intuitive and there's certainly some outdates stuff there, but their TOP 10 (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...) is a great starting point and they have some nice stack/language-specific docs as well.

Also don't forget the security of the servers...

For example, for myself, since I am the only user of my software (it is not for sale), the server security is much more important...

I certainly agree with familiarizing yourself with OWASP as a resource and community. It's also helpful to think about what threats you are securing your code from. This might be a good place to start: https://www.hacksplaining.com

There is a really good course on edX that goes over some key aspects of secure web applications. Just finished it myself. Learned a lot about preventing common oversights such as maintainable password hashing, XSS, CSP, Certificates, etc.

https://www.edx.org/course/web-security-fundamentals-kuleuve...

It pretty much goes over most of the OWASP top 10.

Someone once said “you’re only paranoid if you think you have enemies...and you don’t”. So I guess one thing to consider is who are the enemies whom you want to protect yourself from.

OWASP

Reply on news.ycombinator.com