It's a nice mix of issues. Web security (client/server-side) is a big field, and keep changing. We need a lot of awareness.
If you like this kind of web security focused articles, our security researchers publish (almost weekly) very basic to advanced web security topics in our blog : https://www.netsparker.com/blog/web-security/ Some of them are very specific like;
It's one of the 5 pillars of Islam. One has to give 2.5% of their wealth to poor. It's compulsory unlike Sadaqah - Charity ( https://en.wikipedia.org/wiki/Sadaqah ).
I guess if everyone followed just this 2.5% rule, there wouldn't be any poor left in the world (I didn't do the math though).
P.S. When I say poor, I'm not referring to people who cannot afford the new iPhone.
We are developing a web application security scanner [1] and we indeed use max length setting and also detect binary responses, just tested this and as expected it worked fine.
I'm actually surprised that many other scanners failed to do this.
It's a bit (actually a lot) worrying that their donation page that you enter personal and credit card info is not over HTTPS. Possibly it will significantly decrease the donations they'll receive online.
My argument was about software development and I don't know how much it would hold up for other fields.
Employer pays the time for that employee to acquire the knowledge, employer serves the know-how that the employee might never ever able to learn by herself. How is it not reasonable to expect that knowledge to be used against the employer? Why is it one-way? I'm not talking about knowledge in a sense that "good code should include comment" kind of dev best practice. I'm talking about domain specific know-how that the employer came up with in many years by spending lots of money (R&D, trial & error, field studies etc).
And that's exactly my point. This is why non-compete makes sense. To repeat, because none of the stuff you have mentioned can replace what non-compete provides.
I agree, but if we want that we should start from demolishing "patents" and many other similar more basic issues first, but we all know why that's not going to happen.
Secondly when you do that, aren't you actually killing commercial research? Why would I spend $10M to research something if one of my employees can just take that know-how and move to my competitor?
Sorry I wasn't clear on the original comment, how can NDA stop a developer to use what he knows while writing code or creating procedures?
If you are a developer and worked on a code for 2 years. NDA cannot cover what you know what you don't. Your know-how that you captured on that company can simply be replicated in another company. You'll write the code from scratch, and NDA or copyright, or even patent in majority of the cases will not be enough to enforce or stop such a think. In rare cases patent can solve it but do we want all companies to patent everything?
> Trade secrets, IP, secret sauce: covered by NDA and IP assignment agreements
As a developer pretty much none of these matter or protects anything.
Imagine this scenario;
- John has no idea about video encoding but a good developer.
- John joins to a video encoding startup
- This startup encodes videos 3 times faster than the competitor
- After working on the core product for 2 years, John knows a lot about video encoding, because he's been trained. He also knows why they can do faster than anyone else. It's not one thing, bunch of things.
- Then John receives an offer from the competitor with 50% more salary (obviously this is smart thing to do for competing company). He obviously leaves, because 50% more! All the know-how, experience etc. will be just automatically transferred to this competitor. NDA, copyright etc. nothing can prevent it.
So how is this good for anyone but John? If you think this kind of stuff doesn't happen and all this kind of advancements are public domain anyway, you are wrong. There are many niche fields where competing advantage comes from technical excellence and understanding couple of key things better than your competition.
Not to mention John will have inner knowledge of so many other non-technical but important details that can give obvious unfair competitive advantage.
When non-competes are removed companies do need to treat their employees differently. "If I don't trust this employee enough I shouldn't give them the important bit of the source code, shouldn't train them on X know-how that we internally produced" etc. which is pretty bad for everyone.
I never used them or seen them in a benchmark so cannot comment much of the capability or quality. I think it's best if you compare it for yourself. Running a scan very easy and won't take much of your time, drop me an email and will get you a license or account to our cloud solution, so you can test it and see how it compares. Email: [email protected]
* It's about how make the suggestion. "How about making this blue darker?" vs. "Do you think making this blue darker would give us more engagement? Are there any studies, or have we done A/B testing on this? I think it fits on our branding better because..." etc. Derek's example is really bad one though. Why would a manager (unless an experienced designer) would make such a pointless suggestion?
* If everything you say is just done without any sort of questioning then it's obvious there is a problem.
If your team cannot take your feedback just like taking feedback from their colleagues, cannot argue with you or veto your idea easily with a legitimate response, take everything you said as a "command" then you have failed as a manager anyway.
I assume Derek's advice makes sense for Korean culture where manager and team dynamics are different.
Use static source code analysis and dynamic web app scanners.
They are easy to integrate into your SDLC, they are not going to replace manual testing or secure development practices but they'll help a lot. They'll pick up tons of stuff for free, they'll remind you best practices.
I have a startup (at least it still feels like a startup!) and we are developing a web application security scanner called Netsparker [0]. It found over 100 zero days in open source applications while testing it [1], including very popular vulnerabilities in applications such as Wordpress and Joomla. I guess that by itself proves how good scanning can be.
If you want to try it on your websites and see it for yourself drop an email / message to [email protected] with a mention of HN and I'll get you a fully functional trial that you can use on your own websites.
Now visit your favs from your profile and you'll notice that "SQL Injection" post is automatically added your fav list. Just like upvote system fav needs to be protected against CSRF.
I wrote about a similar topic from a web application security point of view: Why Framework Choice Matters in Web Application Security* ( https://www.netsparker.com/blog/web-security/why-framework-c... )
Also today there is enough data in the industry to prove this argument beyond any doubt for web applications.
* original article is written about 11 years ago or something this is a republished version