[CTphpnwb]

dawmail333, on 02 January 2011 - 04:25 AM, said:

CTphpnwb, on 02 January 2011 - 04:42 AM, said:

joezim007, on 01 January 2011 - 02:18 PM, said:

...if you're not an expert in each area you will probably do something wrong or forget an important piece, which could end up compromising the security or the stability of your projects that use the framework. There is a reason that frameworks are updated often: they missed something.

I'm not saying you're wrong, but something to keep in mind is that if you use a framework and they did miss something, your site becomes extremely vulnerable as soon as a hacker compromises another site that uses the same framework. If you wrote your own then your security flaws are yours and yours alone, assuming you've made decent effort at making your site secure. Hacking somebody else's site gives no advantage to the hacker attacking yours. There are pros and cons to everything!

I would have to disagree.

What are you disagreeing with? I never said a framework wasn't a good way to go. It just isn't perfect! There are no panaceas out there, and there never will be. Anything that has an upside also has a downside.

Coding with a framework has the upsides of being faster to develop, generally more secure, and usually easier to maintain. That's all great, but it does have the downside that if a flaw is found in the framework then many if not all projects that use it will share that flaw. Are you saying that this is incorrect?

[nightscream]

In the beginning it might look much easier to just start with a framework because a lot is written for you. Like said in other posts they might have security flaws and things you are not aware of. I would suggest try writing in classes and make re use better, create your own framework but only use the things you need on a specific project. Not that frameworks don't have advantages, they are fast and a lot has been done for you. Also there is nothing wrong with combining both. If you find a few flaws in a framework try to write your own code to prevent using the flaws of the framework.

It really depends on the project and situation. I haven't worked with a framework yet but I think basic stuff like database connection, ... are 100% secure.

[dawmail333]

CTphpnwb, on 06 January 2011 - 02:14 AM, said:

dawmail333, on 02 January 2011 - 04:25 AM, said:

CTphpnwb, on 02 January 2011 - 04:42 AM, said:

joezim007, on 01 January 2011 - 02:18 PM, said:

...if you're not an expert in each area you will probably do something wrong or forget an important piece, which could end up compromising the security or the stability of your projects that use the framework. There is a reason that frameworks are updated often: they missed something.

I'm not saying you're wrong, but something to keep in mind is that if you use a framework and they did miss something, your site becomes extremely vulnerable as soon as a hacker compromises another site that uses the same framework. If you wrote your own then your security flaws are yours and yours alone, assuming you've made decent effort at making your site secure. Hacking somebody else's site gives no advantage to the hacker attacking yours. There are pros and cons to everything!

I would have to disagree.

What are you disagreeing with? I never said a framework wasn't a good way to go. It just isn't perfect! There are no panaceas out there, and there never will be. Anything that has an upside also has a downside.

Coding with a framework has the upsides of being faster to develop, generally more secure, and usually easier to maintain. That's all great, but it does have the downside that if a flaw is found in the framework then many if not all projects that use it will share that flaw. Are you saying that this is incorrect?

Well, practically, I wouldn't consider that an issue: it's not like you're hunting down all machines that run an old version of IIS kind of thing, you're hunting down applications that run off old versions of a framework. Technically possible, but I haven't seen any examples of it practically being used.

If you can show me one (or more), I will happy concede your point though, and add it to my collection of knowledge

[CTphpnwb]

dawmail333, on 13 January 2011 - 10:39 PM, said:

If you can show me one (or more), I will happy concede your point though, and add it to my collection of knowledge

Look no further than Windows! IT departments long ago decided that it was the platform/framework they would "standardize" on and so when it has a security problem, millions of people and businesses have security problems. IT gained ease of training (only one OS/framework to learn) but gave up corporate security in the bargain, and I'm not talking about security versus another OS, either. Even farmers know not to plant their fields with only one crop (no matter how profitable) because it exposes you to too much risk. Choosing multiple platforms/frameworks/crops maintains diversity, and diversity is your best defense against security issues.

[dawmail333]

Mm, not quite what I meant: an OS is still such a vast platform to run with.
I was referring specifically to programming frameworks

I can think of a kind-of example: that ASP.Net vulnerability I was reading about that required you to remove your custom error pages, but it still illustrates one of the strengths: it got fixed pretty darn quickly.

[CTphpnwb]

An OS is essentially a very large programming framework! That's really a big part of its reason for being! After all, who cares about a file system if applications can't work with it?

Certainly some errors are fixed quickly, but many others can go unfixed for years and even pass from one version of the framework to another, as has happened with Windows. All I'm saying is that you need to consider that when thinking about frameworks.

[dawmail333]

Ok, but no-one's going to write their own OS for their project

[Valek]

dawmail333, on 15 January 2011 - 10:18 PM, said:

Ok, but no-one's going to write their own OS for their project

Doesn't change the fact that application programming still makes use of functionality provided by the OS. Take the Win32 API for example. It makes accomplishing certain tasks on that platform a lot easier, but if part of it were written poorly or left vulnerable, every piece of code written utilizing that part of it will have the same vulnerability. That's the point CTphpnwb is trying to make. While development is faster, you're still only as secure as the framework's developer(s) make their framework.

[dawmail333]

Which I've understood all along xD

What I'm saying is, if you wrote your own code from scratch, and a hacker discovered a vulnerability, you'd have a hell of a lot more work on your hands having to find, and plug the hole.
Often, with these frameworks, you'll have a fix before the problem occurs, and even more often before anyone targets you.

It means you're putting a whole community behind your security, not just yourself.

[CTphpnwb]

Yes, you do have the whole community behind you, but as I've pointed out, sometimes that's not enough. Sometimes it's actually a hindrance. Backwards compatibility is a huge issue for Windows and a reason why some vulnerabilities take years to fix or never go away. That's the danger of everyone jumping on the same framework(s). Inertia can work against you as much or more than it works for you.

[dawmail333]

Really?

I didn't think that backwards compatibility was such a tremendously large issue in developer-focussed objects like that. I thought that developers were just expected to read the changelog for breaking changes?

That was my understanding, anyway. It's what I do/expect.

Windows is a consumer facing product, so I can understand why they have to maintain that compatibility.

[Valek]

In many cases I would agree, but you'd be surprised at just how many projects are written to (still) maintain compatibility with PHP 4, despite PHP 5 being the standard for at least 3-4 years now.

[Xtron]

Framework. You get a whole community of support behind it, you don't have to worry about writing alot of things yourself, it's easier to work with a team because you have a standard platform to work with.

As for the PHP 4/5 thing, in my case, and probably most of you, it didn't matter. I didn't even think anybody would still want to use PHP 4..

[TMKCodes]

Myself I won't use PHP framework created by someone else. The reason is I want to know how to do that stuff myself as I don't have short deadlines, anyway my boss has been saying I work fast so do I need to work still faster by using someone else's work to do my bidding. Then again once I have my own business running I might need to think about using my own framework or someone else, this is because I will be needing the products fast.