Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
Wish we could @amahlaka++ in this world, we need more of you 😁
-
@Bootleg nope some schools are really that shit. In my last year I said the teachers: either im sick the rest of the year or you have to be open to learn something.
After that I had to teach them two hours a week, told them as much as I could about git, frameworks, security and the like.
I heard from an intern that next year they did mention git but didnt explain it. Thats at least better than not mentioning at all. -
@xewl Yeah I thought, but I like my queries like my stories: well written xD
-
@c3ypt1c r/nothingEverHappens
-
@C0D4 yeah but that was taking raw input. Someone could coerce it into returning that.
-
@MatthewSamms i dod teach them about selting as well andhash collisions and rainbowtables
-
@WildOrangutan Never learn a insecure way to do something...
Its not like they put a newbie in a crane and tell him: "just lift some things with it, next year I will tell you how to do it in a secure manner"
You dont have to tell them the most complicated instruction and they can take a bit more time but teaching wrong code is never good -
I once went through the codebase of the FosUserBundle and was surprised to see a for loop over the hash comparison instead of `generatedPaaswordHash == storedHash`.
It turns out that they want to enforce that the password comparison process takes the same amount of time when hacker tries to do a timing attack. (foo == bar would be false quickly, bao == bar would be false less quickly).
Security is hard.
Really makes you think if you should implement your own user management (spoiler: you shouldn't). It's worth reading the implementation though if you ever have to. You won't think of all vectors of attack. -
@vhoyer it's where the unicorns eat supper
-
@vhoyer files with pre-seeded combinations of character-sets.
-
@FitzSuperUser fuck that shit @amahlaka has the makings of an owner of the business and being an influencer. It would be such a shame to see such an attitude be wasted working for someone else.
-
@codeRetard I run my own business 🤔 I need people like that 🤷♂️
-
😒 Even though the teacher could have *mentioned* hash and injection, if the topic is the language, don't expect going deep in other matters. What else did you want in this class? OAuth2?
👍Thumbs up for enlightening your colleagues.
👎Thumbs down for making the teacher look bad in front of everyone.
Do the right thing. But also, be nice. Always be nice. -
@gosubinit the ppint i wanted to make is that he should at least mention while teaching that the method he is using is not secure at all
-
@gosubinit some teachers you are allowed to look bad because they are.
-
@amahlaka
As long as that was your only intension :)
I'm just thinking from the teachers perspective here, they came to teach you about SQL, not security. They might not actually understand the aspects of security you do, they mightn't have even heard of hashing. My point is, you don't know, and you risk making them look bad, and while I can understand it would feel good being right, that security should be mentioned, it's not their job to make sure you don't get hacked.
They're teaching you how to make queries, they're teaching you SQL, and if the course structure just so happens to have separated SQL and security, then they will not teach that, though while I agree a mention would be great, in my personal opinion, it would have been better to keep the thought to your fellow students rather than getting the teacher to, you did the mention, best leave it at that, eh? :)
That said - it's not black or white, there are truths to each side, keep up the great job ranting! 😁 -
@coolq it was php class
-
@amahlaka
That's not exactly my point :) -
@AI-Overlord because teachers never admit mistakes?
Me Vs a PHP teacher
Him:
And to do login, we just do SELECT username WHERE password = (userinput)
Me:
Really? Checking raw userinput against plaintext password?
Him:
There is no point in doing it securely here because if they want, the students can go take a seperate course on security
Me:
So no point in teaching students that they should write their code secure by default and just leave it as a afterthought?
Him:
Yes, because this is how i have always done it
Me:
———
Him:
Okay, time for a break
*leaves room*
Me:
*Uses the break to teach all students about sql injection, password hash and salt, rainbow tables and user input sanitizing*
Him:
*comes back*
Students to teacher:
He's right, if you dont teach us to code securely by default, we are likely to end up causing a data leak or be hacked, if you dont teach us properly we have no point coming here
Me:
*Smiles at the teacher with a face that says: Pwnd*
Him:
Alright then, tell me whats wrong in my code
I was so proud that i helped the class understand secure by default principles
rant
wk112
teacher
school