Hacker News Reader

Comment by magicbuzz | Hacker News Reader

Looks like your Dad got exposure to IBM equipment and realised that being a programmer could be a good job. I did my undergrad in the early 80s and the Uni had a CDC which was old then. First assignment in Pascal was writing it on a punchcard machine and handing the card batch over. But it was more an exercise in showing new students what had come before. I was fortunate to get a job working in COBOL on HP, which led to Unix exposure. Working on an IBM 370 would mean you were unlikely to move out of COBOL/Fortan for a while. Web dev is an awesome beast compared to what existed in the 80s but the complexity has gone up incredibly. Resultantly, there are a lot of people who struggle to understand the fundamentals. I met a supposed web dev the other day who didn’t know what TLS was, let alone the difference between 1.2 and 1.3

View on HN

you expect a webdev to know the difference between the current standard and its next version thats hardly used at the moment?

aren't you expecting a little bit too much? Don't get me wrong, its great if you do... but knowing about upcoming encryption standards is imo something a security engineer should be fluent in, not a web developer.

Is it reasonable to expect a web developer to be able to configure nginx? To be honest, I guess maybe not. But the person in question was maintaining how https slowed all sites down and so should be avoided. When I questioned him about the new handshaking in TLS1.3, it became evident he didn’t know what I was referring to.

If you can't apt-get install nginx and copy a basic configuration from the internet, I have bad news for you.

Tuning performance and setting up logging is another matter.

Compared to the habit of including huge gobs of javascript and unoptimised images on "modern" web sites the impact of https is nugatory.

DevOps engineer will configure docker\tls\nginx and all that stuff

Surely you just means "ops"? I thought the point of someone being "DevOps" is that the developer also does operations, so it would be their own problem. I wonder if that word has become so diluted that its lost the reason that it came into existence in the first place.

Devops is more about dev working with ops and vice versa instead of siloing. That necessarily ends with some crossover of skills but it isn’t strictly necessary

During my brief time in Devops, I have learned that; if you're getting paged at 3am from your server being DDoS-ed, you're not going to be very effective as a developer . . .

Yes: it helps the developer to learn to code much more defensively - which is a very good thing. But then, that developer has no time to code. Defensively, or otherwise.

(depending on the environment, and management's willingness to invest in infrastructure - yeah, you can really get bogged down in this stuff).

I expect web devs to know about a lot of security concepts, including SSL/TLS, subresource integrity, CORS, a variety of cross-site stuff, etc. It's simply dangerous if they don't.

knowing about security concepts is quite a bit different to knowing the details about the currently established standard of encryption and its next iteration.

We're talking about the changelog of TLS 1.2 to 1.3, not the general attack vectors for web applications.

"web dev" is a big tent with room for many specializations underneath. Not everyone needs to know everything.

Reply on news.ycombinator.com