5 ms·

This isn't an uber problem - it's a startup tech problem - no one wants to take security seriously because it's a cost sink that only averts risk, does not actu

This isn't an uber problem - it's a startup tech problem - no one wants to take security seriously because it's a cost sink that only averts risk, does not actually make a company revenue. I have seen ssn's store insecurely, open api's with customer data, old frameworks and languages that no longer receive security patches. Nearly every startup says they take security seriously, because that's the right answer to say, but very very very few actually do. This is just another minor blip in the otherwise very large system of data available everywhere. Your data is not safe, trust me on that.

5706906c06c 9y ago
I've done InfoSec for a bunch of startups, none seem to grasp the importance of security by design and how it can play an integral role in the business. It's exhausting to have to battle a neon-haired developer that wants to just write code (rightfully so,) not following a process or standards often engaging in arguments just to be right. Imagine one person going asking an entire engineering org to create security priorities until business gets a hold of those and comes back to yell at you for delaying sprints, yep, that's InfoSec for you. Also, any business that says "We take security seriously" isn't. That's a boilerplate they plucked out of the legalese to CYA.
- chickenfries 9y ago
  edit: ah, nevermind, just a reference that went over my head
  - mahyarm 9y ago
    It's a play on words about the pointy haired boss
    - 5706906c06c 9y ago
      I meant not offense to those with neon-colored hair, correct on the PHB read. Also, Wally is based on a person I worked with. Apparently, he worked with Scott Adams back in the PacBell days.
      - chickenfries 9y ago
        Aw, I feel bad about pointing it out now. I don't even have neon colored hair, but perhaps I am a bit jealous of the people who do.
- dsfyu404ed 9y ago
  This. Nothing is secure by design because anyone that can make it secure by design can get a job somewhere they're taken seriously.
- CaptainZapp 9y ago
  I certainly agree with your comment, since it reflects my experience in a lot of cases. But "We take security seriously" Why would such a statement legally cover your ass? From a legal perspective it sounds as dubious as warnings on a Truck "Stay back 10 metres. Truck is not responsible for damage"
  - 5706906c06c 9y ago
    I can't disagree. However, it doesn't deter businesses from using it as it demonstrates intent to maintain certain security posture, regardless of how ill-conceived that posture might be. That said, the statement is touchy feely, and will more than likely not hold true in the court of law when pressure tested.
jacquesm 9y ago
People right here on HN advocate against start-ups taking security seriously because it slows them down. Really bugs me.
- api 9y ago
  That's standard issue advice. "No company ever failed because of a security breach."
  - autotune 9y ago
    Mt. Gox failed due to a security breach.
    - MVorlm 9y ago
      Well, I imagine that's an edge case. Most startups aren't handling money(sans payments ofcourse).
      - jacquesm 9y ago
        No, but most start-ups are handling their customers' data and that translates into substantial value.
wilde 9y ago
This is largely a usability issue. There have been folks in the performance community complaining in the same way for years. Then all of a sudden React comes along and lots of people started talking about performance because the framework made their primary task (building a website) easier. Security is much harder than it needs to be currently. Every time I deal with an OpenSSL error I die a little inside. We have scam "security researchers" distracting us on Twitter with spurious reports every week. Asking people to "think more" is a lost cause. We need better tools that make it easier to solve problems in the critical path that encourage more secure defaults than the last ones did. Most other solutions are unlikely to make an impact.
rficcaglia 9y ago
this isn't a startup tech problem - it's a startup customer problem. no customer wants to pay significantly more for a good or service to ensure that the company takes security seriously because they want the lowest cost.

5706906c06c 9y ago

I've done InfoSec for a bunch of startups, none seem to grasp the importance of security by design and how it can play an integral role in the business. It's exhausting to have to battle a neon-haired developer that wants to just write code (rightfully so,) not following a process or standards often engaging in arguments just to be right. Imagine one person going asking an entire engineering org to create security priorities until business gets a hold of those and comes back to yell at you for delaying sprints, yep, that's InfoSec for you. Also, any business that says "We take security seriously" isn't. That's a boilerplate they plucked out of the legalese to CYA.

chickenfries 9y ago
edit: ah, nevermind, just a reference that went over my head
- mahyarm 9y ago
  It's a play on words about the pointy haired boss
  - 5706906c06c 9y ago
    I meant not offense to those with neon-colored hair, correct on the PHB read. Also, Wally is based on a person I worked with. Apparently, he worked with Scott Adams back in the PacBell days.
    - chickenfries 9y ago
      Aw, I feel bad about pointing it out now. I don't even have neon colored hair, but perhaps I am a bit jealous of the people who do.
dsfyu404ed 9y ago
This. Nothing is secure by design because anyone that can make it secure by design can get a job somewhere they're taken seriously.
CaptainZapp 9y ago
I certainly agree with your comment, since it reflects my experience in a lot of cases. But "We take security seriously" Why would such a statement legally cover your ass? From a legal perspective it sounds as dubious as warnings on a Truck "Stay back 10 metres. Truck is not responsible for damage"
- 5706906c06c 9y ago
  I can't disagree. However, it doesn't deter businesses from using it as it demonstrates intent to maintain certain security posture, regardless of how ill-conceived that posture might be. That said, the statement is touchy feely, and will more than likely not hold true in the court of law when pressure tested.

jacquesm 9y ago

People right here on HN advocate against start-ups taking security seriously because it slows them down. Really bugs me.

api 9y ago
That's standard issue advice. "No company ever failed because of a security breach."
- autotune 9y ago
  Mt. Gox failed due to a security breach.
  - MVorlm 9y ago
    Well, I imagine that's an edge case. Most startups aren't handling money(sans payments ofcourse).
    - jacquesm 9y ago
      No, but most start-ups are handling their customers' data and that translates into substantial value.

wilde 9y ago

This is largely a usability issue. There have been folks in the performance community complaining in the same way for years. Then all of a sudden React comes along and lots of people started talking about performance because the framework made their primary task (building a website) easier. Security is much harder than it needs to be currently. Every time I deal with an OpenSSL error I die a little inside. We have scam "security researchers" distracting us on Twitter with spurious reports every week. Asking people to "think more" is a lost cause. We need better tools that make it easier to solve problems in the critical path that encourage more secure defaults than the last ones did. Most other solutions are unlikely to make an impact.

rficcaglia 9y ago

this isn't a startup tech problem - it's a startup customer problem. no customer wants to pay significantly more for a good or service to ensure that the company takes security seriously because they want the lowest cost.