5 ms·

I think the evidence contradicts you at this point

orangelimesoda 2mo ago
So you don't need to know anything about credit cards for someone to enter it into an app? I don't get the take (is it bad sarcasm?)
- devmor 2mo ago
  To be fair, for the vast majority of cases, no you don't. It is extremely rare for companies to roll their own payment processing anymore, or even handle PCI scope at all.
  - orangelimesoda 2mo ago
    Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data? How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find? Can I store your SSN in plain text in a text file? Why not? The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket policy be for all these driver's license photos - there are so many???
    - devmor 2mo ago
      > Credit card entry If you're handling credit card numbers yourself, you're in a shrinking subset of developer roles. I've spent the last 7 years of my career working at payment processors, so I do handle that stuff, but the majority of my industry has built an infrastructure that makes it so most developers don't have to think about that. To your other examples, not everyone on the team needs to know these things up front. Someone in the review process does, and eventually that knowledge gets disseminated and more people know it to carry it forward in their career.
      - redlimetea 2mo ago
        [dead]
    - lmm 2mo ago
      > Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data? > How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find? > Can I store your SSN in plain text in a text file? Why not? You wouldn't be touching any of those unless you work for a handful of providers where that's their whole business. Usually you add the dependency, use their widget, and that's it.
- oenton 2mo ago
  To your last question about bucket policies, clearly you just need to scope it down: arn:aws:sts::*:assumed-role/trustme*/* (indeed that first wildcard means any account)
bostik 2mo ago
That's quite an indictment of the common app development practices. (Not that I disagree with your point...) And security is hard. Because it is by definition off the happy path, it is quite often at odds with MVPs and rapid release cycles. Then you add all the ways the users can use your product to attack/abuse others. Any non-hobbyist app development does indeed require at least a decent understanding of security.

So you don't need to know anything about credit cards for someone to enter it into an app? I don't get the take (is it bad sarcasm?)

devmor 2mo ago
To be fair, for the vast majority of cases, no you don't. It is extremely rare for companies to roll their own payment processing anymore, or even handle PCI scope at all.
- orangelimesoda 2mo ago
  Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data? How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find? Can I store your SSN in plain text in a text file? Why not? The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket policy be for all these driver's license photos - there are so many???
  - devmor 2mo ago
    > Credit card entry If you're handling credit card numbers yourself, you're in a shrinking subset of developer roles. I've spent the last 7 years of my career working at payment processors, so I do handle that stuff, but the majority of my industry has built an infrastructure that makes it so most developers don't have to think about that. To your other examples, not everyone on the team needs to know these things up front. Someone in the review process does, and eventually that knowledge gets disseminated and more people know it to carry it forward in their career.
    - redlimetea 2mo ago
      [dead]
  - lmm 2mo ago
    > Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data? > How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find? > Can I store your SSN in plain text in a text file? Why not? You wouldn't be touching any of those unless you work for a handful of providers where that's their whole business. Usually you add the dependency, use their widget, and that's it.
oenton 2mo ago
To your last question about bucket policies, clearly you just need to scope it down: arn:aws:sts::*:assumed-role/trustme*/* (indeed that first wildcard means any account)

bostik 2mo ago

That's quite an indictment of the common app development practices. (Not that I disagree with your point...) And security is hard. Because it is by definition off the happy path, it is quite often at odds with MVPs and rapid release cycles. Then you add all the ways the users can use your product to attack/abuse others. Any non-hobbyist app development does indeed require at least a decent understanding of security.