Kivikakk

> Look, you can't put up a blog post titled "How We Engineered CMS Airship to Be Simply Secure" and say that when asked "well, how did you actually engineer it to be secure?". In your post you talk about problems all solved by a framework, and apparently you haven't even evaluated what is out there already and rushed headfirst into building it all yourself.

I've looked at Laravel, about two years ago. http://seclists.org/fulldisclosure/2015/Apr/57

I haven't looked deeper at what it's done since then, since nobody is paying me to do so. I wasn't impressed then, and instead of waiting for them to get around to doing things right (while figuring out how to preserve backward compatibility), I started from zero.

You don't have to like that decision, but that's the decision I made.

> Again, using a framework makes your code way easier to review and a lot smaller to boot.

Sure, use a framework.

And then this happens: https://kivikakk.ee/cryptography/2016/02/20/breaking-homegrown-crypto.html

I designed my own because, unfortunately, most of the PHP community either doesn't prioritize security enough to be trustworthy, or is simply in over their heads.

We use third party libraries (Twig for templates, HTML Purifier for allowing some HTML but avoiding XSS vulnerabilities) because they're well-studied and trustworthy libraries.

However, I do not trust most other PHP developers to do anything security-critical correctly. And thus, I will not design something meant to be secure…