Hacker News Reader

Comment by cletus | Hacker News Reader

Should tutorials be expected to teach people sufficient security? Should code snippets be production-ready to put on the Internet for the general public? I tend to think not. Is this just me?

So here's a partial list of issues you'd need to deal with:

- sanitizing input

- Escaping output

- SQL injection

- HTML injection

- XSS

- CSRF

- CORS

- Clickjacking

- DDoS and other resource exhaustion attacks

- Various timing attacks (eg password hashing)

- How to store passwords

- Depending on language, buffer overflows

That's... a lot. You can take this even further: you should assume you're going to get compromised at some point. What are you going to do to detect a breach? Or an active attempt to find a breach? What's your strategy for handling a breach?

Here's an analogy: we can tell you how to treat Poison Ivy without having to add a disclaimer that you're not qualified to be an attending dermatologist.

View on HN

You're making the perfect into the enemy of the good.

Should every tutorial be an entire 200-page course on all web security practices? Of course not.

But should every tutorial that inserts a user-provided value into a SQL statement ensure it's escaped? Of course. There's essentially literally never a situation where you shouldn't do that. It's not just to be "production-ready" -- it's so basic as just to make sure the query will still even parse if the user includes a quote character in their input.

So why on earth are you defending this mistake?

I'd go further and say it's easier to teach prepared queries than string building (or at least equally difficult).

That might not be true for other security issues but I think tutorial writers should be fine saying "here is a bit of magic that fixes a problem called csrf. We won't cover that in this course but leave this in here"

>- sanitizing input

Oh, that unicorn that everybody takes about, yet nobody does anything with it

So, how do you sanitize input?

you save in database escaped strings?

allow only "english" letters?

>- HTML injection

>- XSS

those two belong to

>- Escaping output

don't they?

>- Various timing attacks (eg password hashing)

>- How to store passwords

just use state of art auth/login handling libs?

>- DDoS and other resource exhaustion attacks

I don't think I'd add it there, isn't it handled by firewall / infrastructure than app directly?

> I don't think I'd add it there, isn't it handled by firewall / infrastructure than app directly?

Although most DDoS attacks happen on the layers 3, 4, and 6 of the OSI model, your application still has to be hardened against resource exhaustion and other DDoS attacks.

For example, if you have a REST endpoint that starts a complex query which might return a large result given some specific query parameters (e.g. your limit parameter is not bound, so I can set limit=1000000), running 10000 requests against it from different hosts (malicious or not) may bring down your database server.

You're right, thanks for reminding

Things should be secure by default. With a basic query builder you can't ever have a SQL injection bug, not even by mistake, not even if someone maliciously tell you to do something wrong. This should be the default for tutorials.

The tutorials don't even need to talk about security: just tech secure by default APIs. If the programmer later needs more flexibility (which should be understood as an advanced topic), they ought to learn that you must sanitize user input in raw queries.

I agree with you. Back when I was a little kid learning to code on the internet by myself, tutorials that I could easily understand and quickly use to build things were important. Because without those, I would have probably given up.

Those stupidly bad PHP tutorials that show you how to concatenate a URL parameter to an SQL string were easy to understand, and taught me about everything from writing PHP/SQL, setting up a MySQL server, networking/opening ports, designing database tables, designing an application, and much more. The motivation I got from learning so much in so little time led me to keep learning new things, including learning and understanding why all that code I wrote when I was younger was so bad.

If those shitty tutorials get copy and pasted into production codebases, that's the company's fault for hiring a lazy/bad developer, and for not catching the vulnerability.

Yes, tutorials should be expected to teach people about security if it is within their scope. But the problem with the tutorials from the article is that the authors seem to be genuinely unaware of the security issues. That may also be the reason why they are trying to do the impossible, that is teaching web authentication to beginners in a 10 minute blog post format. And then they often get positive feedback because people like simple but wrong answers to difficult problems.

It shouldn't take anti pattern shortcuts that open up vulnerabilities, especially without adding a disclaimer.

Reply on news.ycombinator.com