The Perils of DIY Security: A Developer's Party Foul
Description
This is a cartoon meme using the 'They Don't Know' party format. A smug-looking developer in a party hat stands alone in a corner, thinking, 'THEY DON'T KNOW I BUILT MY OWN SECURITY FEATURES FROM SCRATCH.' The rest of the party guests are dancing and talking, with speech and text on their shirts revealing the consequences of his work. One person's shirt reads, 'IS COPYING CODE FROM STACKOVERFLOW WHAT WE CALL \'FROM SCRATCH\' NOW?' while another guest asks, 'DID ANYONE ELSE JUST GET THEIR PASSWORD EMAILED TO THEM?'. Another shirt sarcastically suggests, 'DO YOUR OWN BILLING NEXT,' and a nearby comment adds, 'WE KNOW WE ALL SAW THE DATA LEAK.' The watermark '@PERMIT_IO' is visible at the bottom. The meme humorously critiques the Dunning-Kruger effect in software development, specifically the dangerous overconfidence of building critical systems like security from scratch. It highlights common anti-patterns like plaintext passwords and copying code without understanding, leading to a predictable data leak. The joke is deeply relatable to senior engineers who understand that using specialized, third-party services for complex domains like security (and billing) isn't a shortcut, but a mark of experience and wisdom
Comments
25Comment deleted
The quickest way to get promoted to 'customer' is to announce you've written your own authentication service. The second quickest is emailing everyone their password to prove it works
Rolling your own auth feels heroic right up until the SOC-2 auditor asks where you store the salt, and the only place you can point to is the password-reset email
The real security vulnerability here isn't the homebrew auth system - it's the developer's confidence surviving contact with production. Nothing says 'senior engineer' quite like watching your custom security solution become tomorrow's CVE while the PM asks why you didn't just use Auth0
Ah yes, the classic party where everyone's secretly aware that Bob rolled his own AES implementation using XOR and a random number generator seeded with `Date.now()`, but nobody wants to be the one to tell him that the 'security audit' he's so proud of was just ESLint complaining about unused variables. Meanwhile, the real elephant in the room is that their OAuth tokens are being stored in localStorage and the session cookies have `secure: false` because 'it was easier to debug that way' six months ago
Roll-your-own auth: the fastest path from ADR to IR - ‘build vs buy’ becomes ‘breach vs buy’ once the passwords start arriving by email
If your app emails passwords, congratulations - you’ve built a zero-cost secrets distribution service and an unlimited incident‑response budget; OIDC would’ve been cheaper
Nothing says 'secure' like a Stack Overflow answer with 2 upvotes and a 'works on my machine' comment
reinventing a square wheel ♥💖💘💞💟💕 Comment deleted
I mean, it depends. I'm tired of this absolutism Comment deleted
Only people who understand why you shouldn't write your own crypto are allowed to write their own crypto Comment deleted
Ron Rivest's crypto algorithms are quite a proof to that. Comment deleted
Since when "security features" mean cryptographic primitives? Also most commonly used security models are outright bad and the general track record of the industry is so absurd it boggles my mind. Comment deleted
fr, hacking means hacking people, data can be secured easily, but ppl keep forgetting passwords and their social media footprint is a shitton of personal data Comment deleted
That assumes existing libraries a) exist for the target platform, b) work. My friend had to implement RSA manually because all/most existing libraries required allocations, and their environment didn't provide allocation facilities. I'm not saying I'm happy with their decision, but it's one of the many possible ugly solutions in absence of a clean one Comment deleted
can you tell me what arch/env that was and what IP address they use? Comment deleted
mhm, not sure. that code was required for some weird playstation hack Comment deleted
…I couldn't do anything with actual info anyway 😅 Comment deleted
I needed a fast parallel SIMD-based SHA-256 implementation once. Side-channel leaks weren't a problem in that context, and no existing solutions suited me, so I just implemented it myself. How was I supposed to sidestep that? Comment deleted
oh, something something telegram Comment deleted
Not quite, but I think they used a custom cipher mode Comment deleted
AES IGE used in MTProto is in OpenSSL. Comment deleted
Also I plan to start implementing macaroons library soon. With canonical s-expressions and tweetnacl most likely. I want to keep it minimal. Comment deleted
Also also, you absolutely should do that. And then have someone come over and show you all the ways it is broken. Otherwise you'll never learn. The amount of cargo-culted nonsense that passes as security nowadays is pretty high. If you don't have security-focused person in your circle, or even if you do, consider doing it as an exercise with a friend and then swap the projects and try to break each other's thing. Comment deleted
Fr tho some things are stupidly genius. Like you dont need a backup if you have a printer that prints all transactions. And no hacker can ruin those /s Comment deleted
They can still spam them to hell. That's extremely common technique to do after intrusion to deal with network logging & IDS/audit logs. Comment deleted