Hacker News Reader

Comment by beseku | Hacker News Reader

Whats worrying about the apparent proliferation of security breaches like this is that as the attacks get more sophisticated, so do the prevention methods. This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers.

The result being that independent development is impossible as you would need to hire ever more expensive security consultants for anything that stores data.

View on HN

I understand your point (it is potentially true for more than just the security domain of application development) but I think your premise in this case is false. SQLI (XSS, CSRF, ...) attacks are neither sophisticated nor new. SQLI has been known since at least 1998 (Phrack 54).

SQLI protection at least should be abstracted away from the developer's concerns by use of default parametrized queries. Technical difficulty is not the problem here.

"This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers."

We reached that point quite a while ago. What we are seeing now is the result of that point being reached, without anyone realising at the time.

But aren't they using pretty old exploits, SQL injections and DDoS?

The security breaches are attacking the old well known holes that everyone has ignored for years.

I quite liked this post: http://1raindrop.typepad.com/1_raindrop/2011/06/unfrozen-cav... people are just not investing in security. Most of the attacks are not very sophisticated, it is just no one is spending money on solving the basic security weaknesses.

I was thinking more in terms of reactions. Governments rarely admit their own faults and weaknesses. They will react claiming computer terrorists must be stopped now and that more control on the Internet is needed to protect everybody.

Surely Web frameworks do a lot to help solve this. Im sure django isnt't perfect; but its more secure than anything I could do.

More likely that common development tools and frameworks will become much more intrinsically security conscious.

In my experience the expense of a security consultant is rarely correlated with their skill level.

Reply on news.ycombinator.com