Hacker News Reader

Comment by saagarjha | Hacker News Reader

All programming has a barrier, but I think web development is a unique situation where there’s a lot of complexity because it’s so open to abuse. If you don’t do HTTPS right bad things can happen, so setting that up is hard. If you process payments bad things can happen, so setting that up is hard. If you send people email bad things can happen, so setting that up is hard. With things like game programming the worst that can happen is your game is slow or buggy or laggy but usually you’re not exposing it to the huge, often malicious audience. With web development you make one mistake and someone is stealing thousands of dollars from you and running cryptomining on your VPS while defacing your website.

View on HN

> With things like game programming the worst that can happen is your game is slow or buggy or laggy but usually you’re not exposing it to the huge, often malicious audience

Not my domain of expertise, but cheating and lags in online real-time games (like FPS games) can ruin a game quickly. Also, in-game shops, currency, micro-transactions probably are targets for crackers and exploiters.

Generally that’s not something you run into until you’re actually much deeper into the field.

So because the webapp is exposed to the public over the internet and there's a risk of hacking the the developer story can be poor? That doesn't sound right. The developer story is just poor because the frameworks and developer Tools are poor, badly documented and don't work well together holistically. Part of this is just due to the continuous churn in web development that creates insane amount of busywork and makes sure that almost all of your available documentaton is always put of date. i find that most of this "complexity" that the author mentions is just man made.

But things like HTTPS, payment processing, emails / account management and even game programming, all of these have already been made easier - nobody has to build any of that on their own anymore, at best they have to configure it.

To make a safe website, stop wanting to do everything yourself. Use a webhost that doesn't give you SSH access, or a service like Netlify.

I just checked the author’s website, and he could have just used an installer to get him a wordpress website with an elearning system plugin attached to get to the same result. Buy an SSL and he would have been done. Any other path is just making it harder if it is not his field of expertise.

And linking all these heterogeneous pieces together and configure them to work is like cat herding: each component is so different and the developers are so proud of their "innovative" way of doing things that one cannot master it. A few years ago I started to believe that modern web developers are more about showing off and hipstering than having a genuine desire to make things better.

Weirdly, I think the same. I noticed an uptick of twitter programmers.

Yeah and it results in so many small, seemingly insiginificant things that can bite you. Like the last point in which I guess the author had hardcoded their redis uri rather than using the environment variable provided by Heroku. How would anyone know about that unless they had been told by someone or been bitten in the past or had some understanding of how Heroku worked underneath.

Edit: from the comments it's clear that OP didn't actually hardcode the connection string.

To be fair, haven't we all (eventually) learned to support environment configuration by messing it up in similar ways at some point?

Absolutely! maybe it's one of those things you just have to mess up to understand why it's important.

Can't really agree with that. Although most of my experience and expertise is with mobile game development, I think that I've read at least 5 blog posts and articles that explained that all connection strings, usernames and passwords (aside from something really trivial for local testing) should always be read from environment variables and never be hardcoded, and arguments were convincing enough. So, even if I haven't worked with Heroku before, I would look for a way to get this url in a service-provided environment variable.

Also, I would look to configure all components to fail loudly, so that if something wouldn't connect to Redid, my server just wouldn't launch.

I'm not trying to say that I'm better or smarter than OP: I've actually tried learning bioinformatics, but dropped out of uni 14 years ago, realising that my brain is just not created for anything biology-related. Rather my point is, many of these problems (and problems I've seen junior developers struggling with) are not some arcane knowledge that you should just learn by heart (like all of those awful genus names in Latin, or all the enzymes in the dreadful ATP scheme that I still have nightmares of sometimes), but a logical extension of more basic and universal principles that actually make total sense once you think about them.

Sure but it's something thats easily overlooked or neglected, many tutorials might tell a beginner to do it but not _why_ to do it which is important. It's also easy to hardcode during testing or development and forget about. Why would someone without a software background expect that a url could change from under them?

> Also, I would look to configure all components to fail loudly, so that if something wouldn't connect to Redid, my server just wouldn't launch.

In this case though the OP did not have control over the redis connection handling it was through a dependency that silently timed out.

Two quick points here:

1. A few years ago, I probably would have made the mistake of actually hard-coding my connection strings, usernames and passwords. I'm pretty sure I did that on my first ever webapp, cause I didn't know any better. So, not defending my intelligence, or taking any offense at your statement. 2. But... That's not what's happened here. I'm setting the redis url inside Heroku's "Config Vars" section, and then reading it in with Django's `env()` functionality, as is appropriate. But the url has seemingly been changed from underneath me, for a reason I still don't fully understand.

Side-note: I used to be under the impression that CS was "harder" than biology, and that anyone who understood CS could pick up biology at will, if they decided. Turns out that's not the case, haha.

Appologies for my earlier comment then I misunderstood your last point. I think my point still stands though. Thanks for the article!

> But the url has seemingly been changed from underneath me, for a reason I still don't fully understand.

Is the Redis add-on attached to the Heroku instance? This is how Heroku knows which instances' environment variables need updating when rotating credentials.

If you redirect users, bad things can happen. If you consume third party dependencies, bad things can happen. If you handle sensitive or personally identifiable information, bad things can happen. If you are not aware of privacy protection laws, bad things can happen. If you configure S3 buckets, bad things can happen. If you deploy static assets, better exclude sensitive information like version control data or bad things can happen. If you construct database queries, bad things can happen. If you manipulate files, bad things can happen. If your site can be put in an iframe, bad things can happen... and the list goes on and on.

I don't think that this is what makes it hard.

Setting up https, or online payments, etc. is actually quite simple. People with engineering or scientific background have most likely faced much more complex tasks. Security and safety aspects can be more stringent in many other industries, including in software development.

The difficulty of the web, I think, is the proliferation of standards (or not so standards) and technologies: networking, https and friends, APIs (payments, etc), html, css, javascript, php, ruby, java, aws, react, vue, redis, SQL, etc. And they are all evolving independently all the time. This is a right mess and can be overwhelming.

This is a fantastic point. Payments in particular have been intimidating for me. Nobody wants to pay for something and then have some goofy mistake on the backend mess up processing it. Or even worse, make them feel like their credit card is susceptible to theft.

I don't know how to explain it, exactly, but worrying about this definitely made development more difficult, even when initially setting up and testing out.

If it makes you feel any better, I have been programming for almost half a dozen years, the latter portion of which I spent learning how to do so formally, and I am deathly frightened to work on any of the things you had trouble with. I’ll take securing an ancient obfuscated firmware binary any day over trying to secure your website :)

Reply on news.ycombinator.com