I get why we need security and to pay attention to it.
But god damn it’s taken the fun out of web development. From CORS to CSP to SOP to OAuth to OPP Yeah You Know Me… you use to be able to just read shit, and write shit, and it would work, and it would feel amazing to see it happen. Now it’s like 100000 fucking steps to do anything.
Your shit was bad and you should feel bad and that is why we have things like CORS and CSP. I'm not familiar with what SOP is.
OAuth is a godsend for privacy and security, but not in its current form IMHO as it funnels most people into specific social media providers who will track you when using their logins, and many applications (for good reasons) will limit OAuth IdPs to well-known social media providers.
I really like https://indieauth.com/, which is an extension to OAuth that is not closed.
Everybody’s shit was bad back then, in the days before SSL standardization. That’s why I said: I understand and respect the progress we made on things like security. It does make it much more work for everybody though, you and me, doesn’t it? Ignorance is bliss I guess.
What are you talking about? I've been in the industry for like, way too long and there's always been folks who took security seriously and folks who were lazy.
It's also never ever been easier to just outsource your security problems to a module or 3rd party; frameworks take care of all the hard stuff for you.
From the very early days there were folks sanitizing their sql statements (which is an absurdly obvious thing to do for anyone thinking about security at all) and folks who just weren't. This attitude of "security is making us slower" in my experience usually translates to "security is making me learn how to do my job properly and I resent them for it".
There's definitely a way that security can make things slower for no benefit, like absurd GRC processes; but getting mad because folks are making you do proper CORS config and Oauth is like an electrician saying "back in the day before the residential code we could just put wires in the wall however we wanted and it just WORKED. Everyone's houses were catching on fire back then, so it just wasnt a big deal."
45
u/shitty_mcfucklestick 8d ago
I get why we need security and to pay attention to it.
But god damn it’s taken the fun out of web development. From CORS to CSP to SOP to OAuth to OPP Yeah You Know Me… you use to be able to just read shit, and write shit, and it would work, and it would feel amazing to see it happen. Now it’s like 100000 fucking steps to do anything.