Hacker News new | ask | show | jobs
by whatever1 236 days ago
Just use a framework to build your site. Don’t reinvent the wheel!
5 comments

There are some vulnerabilities frameworks can address wholesale (like CSRF or XSS) as long as you keep to the blessed way of doing things, but they aren't able to save you from a complete failure to build authorization into your API. Like how seatbelts save lives but can't stop you from accelerating directly into a pole if you choose to do so.
Mass assignment problems sometimes also come from (improper?) use of frameworks. This goes beyond frameworks and more about how thorough the testing and review of how the user account modification and access control is done.
> Just use a framework to build your site. Don’t reinvent the wheel!

How do you arrive at that conclusion after reading an article on how an API had a broken access control vulnerability?

He’s being sarcastic and suggesting using some out of the box rbac thing.
i respectfully disagree with this sentiment. i think that in general, reinventing the wheel can be a great learning opportunity in understanding how the wheel works.
Great to reinvent the wheel for your mom and pop blog, or to teach yourself these concepts and try to break in. But not for authn and authz for something official like this.
But maybe do that on a smaller scale personal project?
Reinventing the wheel for Formula 1 driving…
Depending on the wheel, maybe. Nowadays it's more standardized - same rims for example. The tires are standardized.

There's a lot less freedom in reinventing the wheel in formula 1 nowadays

https://www.formula1-dictionary.net/wheels.html

The steering wheel of course isn't even a wheel anymore, for a long time. It's some video game console / airplane cockpit looking monstrosity.

It can. But it can be very bad at producing wheels that don't break.
Not if you understand how the wheel works. That's the whole point.
I funnily just read a whole Twitter thread that had this same thesis, not 45 minutes ago... What a small world
Github used a framework tho.