7 ms·

Hopefully it will also change the "move fast & proper security is an afterthought" model of startups. Years ago(in CS degree before professional work), I used

Hopefully it will also change the "move fast & proper security is an afterthought" model of startups. Years ago(in CS degree before professional work), I used to wonder & be amazed by how fast new companies(mainly U.S.) moved so quickly. It wasn't because they had some secret sauce or 10x devs, it was because all they did was focus solely on features & take shortcuts. Their customers data security was an afterthought - e.g. production DBs open to anyone in company(even the world in some cases(mongo)), no auditing or logging of data access. Maybe YC(& other accelerators) will make a security expert available to these people...because young adults with 0 professional experience will probably not consider security & rely on the defaults of whatever stack they're using to be good enough. Even less consideration will be given when they're fed & surrounded by a grow fast at all costs mentality. Good security in their products needs thought & critical analysis put into it & I'm not sure new devs appreciate it.

extralego 9y ago
A motto for the coming decades: “Move fast and fix things”
- EGreg 9y ago
  "Move carefully - lots of people are depending on us."
  - madez 9y ago
    Thats how all other engineers are working, except software developers, particularly in certain big companies in the US. It's reckless to not be careful and deeply think of your actions consequences as an engineer, because you yield so much power.
    - lurker456 9y ago
      Only when the regulatory environment demands it. Normal engineers also cut corners in third world countries with weaker protections.
      - TomMarius 9y ago
        Not really true. People want to be safe and secure, but they often don't have enough money. For example: Last summer I visited Georgia and Armenia. What I saw in ordinary flats was basically screaming "I will catch fire soon" - but richer places had security taken care of just like your or my own house, even though it's not really a requirement. If it was a requirement (theoretically it is , but it's not enforced), most places would have no electricity at all. Same with cars: these people drive really old junk (literally) cars that are visibly (often seriously) crashed and you wouldn't be able to use them in other places, but they don't have an alternative. They'd like a nice and safe car like everyone does (and they buy them if they have enough money), but it's either this or nothing, no regulator can change that.
    - EGreg 9y ago
      I have a poster that says: "Don't break things. We have millions of partners moving together."
reificator 9y ago
> young adults with 0 professional experience will probably not consider security & rely on the defaults of whatever stack they're using to be good enough. I typed up a response with a few of my experiences, but it's probably wiser to not share those anecdotes at this time. Suffice to say I've had the exact opposite experience, where the only people who cared about security and stability in any capacity were the youngins, and the veterans dismissed any and all suggestions for improvement regardless of how diplomatically (or not) they were worded. The one anecdote I do feel comfortable sharing is in regards to stability, not security, but it's fairly similar to what I've encountered security-wise. Once, I inherited a legacy codebase very tightly coupled to a legacy platform. I managed to shove an abstraction layer in there, which was then used to port the same codebase between three very different platforms. The biggest problem that I had was in maintaining the very specific, somewhat unintuitive, completely undocumented behavior of the original codebase. Which was of course very tightly coupled to by downstream processes. But after getting the API in there, I was able to run the code on its own and that meant that I could start writing automated tests. I listed off the biggest pain points whenever changes were made and the most critical behaviors that actually generated revenue, and put them all under test. Everything that commonly went wrong (and there was a lot thanks to some unreliable domain-specific tooling) was now automatically validated whenever changes were made. When I showed one of my bosses (the owner of the company and someone in a former technical role) he was less than impressed. I was told off for avoiding my job, and instructed to test it manually like a real programmer.
IAmEveryone 9y ago
The worst part is that (cough) at least one company has completely misunderstood the relationship implied by "Move fast and break things". As the story goes, Travis Kalanik was furious when Tesla's not-really-autonomous driving mode led to the first casualty, screaming that he had wanted to be the first to kill someone with self-driving technology. It's almost as if he thought of breaking things (/people) as a cause for progress, and not an intended consequence.
dominotw 9y ago
> how fast new companies(mainly U.S.) moved so quickly. I've worked in startup/mid size companies outside U.S and from what i've seen its totally inaccurate to say that startups outside U.S move slowly because they take privacy/security more seriously.
- TomMarius 9y ago
  Yes, they ignore it just like the US companies.
- shady-lady 9y ago
  The reason I mentioned US specifically was because VC funding to support hyper growth was historically & (still is) way more common there than elsewhere in the world(Western Europe specifically). A condition which seems to almost mandate the grow fast at all costs mentality. It doesn't preclude anywhere else in the world from being lax about security. I also have worked for multiple small/mid companies in Western Europe and, anecdotally for me, data & thoughts to security are held in much higher regard.
curun1r 9y ago
It's not likely to change that until customers start to actually care about security. And by actually care, I mean start making purchasing decisions based on that. Startups have limited resources, and that will never change. The nature of limited resources is to spend those resources on the tasks that will move the needle the most. Until security tasks start moving the needle, they'll get ignored. One way to make customers start caring about security? Regulation. In a very small startup with a serious shortage of resources, we're currently planning our GDPR compliance. And we're not doing it because we think privacy is important (though we do), we're doing it because customers are telling us that we need it before they can sign up. If customers aren't going to think security is important on their own (and they aren't), passing laws that force them to think it's important is the only way to change the situation.
nickpp 9y ago
>>>Hopefully it will also change the "move fast & proper security is an afterthought" model of startups. In short: starting startups will become more difficult. One of the things most taxing and scary for people in our society, starting your own business, but also one of the things most needed and useful (who else creates jobs and Big Cos later?!) will become harder to do. But what did startups ever did for us, no?!
- adrianN 9y ago
  Yeah, let's just blow all concerns about privacy in the wind. Think of the jobs! While we're at it we might also want to abolish building codes, to combat high rents. And what about OSHA? Clearly safety rules for workers just make it harder to start hardware companies!
  - nickpp 9y ago
    Everything truly important for customers will become an advantage for the provider in the free market and it will improve. Including privacy. Governmental attempts to short-circuit that process are at best misguided at at worst harmful. They create ossified markets where established players rule and innovation and competition are nonexistent. Natural consequences - but hard to accept when one just takes the rallying cry du-jour in arms. "Think of the children!"
    - adrianN 9y ago
      You assume consumers with perfect information unselfishly optimizing for the long term good of all people and a market with true competition. None of which is true in reality.
      - nickpp 9y ago
        I don't assume anything. I just observe the "freer" markets like computers, entertainment and software and marvel at the rich choices, advances and quality present in spite of no regulations requiring for them. And then I look at any heavily regulated markets and I shudder at the prices, lack of choice, crappy quality and how horrible stuff happens in spite of regulations supposed to prevent it. So I draw a logical conclusion: Free Markets beat Regulations pretty much every time.

extralego 9y ago

A motto for the coming decades: “Move fast and fix things”

EGreg 9y ago
"Move carefully - lots of people are depending on us."
- madez 9y ago
  Thats how all other engineers are working, except software developers, particularly in certain big companies in the US. It's reckless to not be careful and deeply think of your actions consequences as an engineer, because you yield so much power.
  - lurker456 9y ago
    Only when the regulatory environment demands it. Normal engineers also cut corners in third world countries with weaker protections.
    - TomMarius 9y ago
      Not really true. People want to be safe and secure, but they often don't have enough money. For example: Last summer I visited Georgia and Armenia. What I saw in ordinary flats was basically screaming "I will catch fire soon" - but richer places had security taken care of just like your or my own house, even though it's not really a requirement. If it was a requirement (theoretically it is , but it's not enforced), most places would have no electricity at all. Same with cars: these people drive really old junk (literally) cars that are visibly (often seriously) crashed and you wouldn't be able to use them in other places, but they don't have an alternative. They'd like a nice and safe car like everyone does (and they buy them if they have enough money), but it's either this or nothing, no regulator can change that.
  - EGreg 9y ago
    I have a poster that says: "Don't break things. We have millions of partners moving together."

reificator 9y ago

> young adults with 0 professional experience will probably not consider security & rely on the defaults of whatever stack they're using to be good enough. I typed up a response with a few of my experiences, but it's probably wiser to not share those anecdotes at this time. Suffice to say I've had the exact opposite experience, where the only people who cared about security and stability in any capacity were the youngins, and the veterans dismissed any and all suggestions for improvement regardless of how diplomatically (or not) they were worded. The one anecdote I do feel comfortable sharing is in regards to stability, not security, but it's fairly similar to what I've encountered security-wise. Once, I inherited a legacy codebase very tightly coupled to a legacy platform. I managed to shove an abstraction layer in there, which was then used to port the same codebase between three very different platforms. The biggest problem that I had was in maintaining the very specific, somewhat unintuitive, completely undocumented behavior of the original codebase. Which was of course very tightly coupled to by downstream processes. But after getting the API in there, I was able to run the code on its own and that meant that I could start writing automated tests. I listed off the biggest pain points whenever changes were made and the most critical behaviors that actually generated revenue, and put them all under test. Everything that commonly went wrong (and there was a lot thanks to some unreliable domain-specific tooling) was now automatically validated whenever changes were made. When I showed one of my bosses (the owner of the company and someone in a former technical role) he was less than impressed. I was told off for avoiding my job, and instructed to test it manually like a real programmer.

IAmEveryone 9y ago

The worst part is that (cough) at least one company has completely misunderstood the relationship implied by "Move fast and break things". As the story goes, Travis Kalanik was furious when Tesla's not-really-autonomous driving mode led to the first casualty, screaming that he had wanted to be the first to kill someone with self-driving technology. It's almost as if he thought of breaking things (/people) as a cause for progress, and not an intended consequence.

dominotw 9y ago

> how fast new companies(mainly U.S.) moved so quickly. I've worked in startup/mid size companies outside U.S and from what i've seen its totally inaccurate to say that startups outside U.S move slowly because they take privacy/security more seriously.

TomMarius 9y ago
Yes, they ignore it just like the US companies.
shady-lady 9y ago
The reason I mentioned US specifically was because VC funding to support hyper growth was historically & (still is) way more common there than elsewhere in the world(Western Europe specifically). A condition which seems to almost mandate the grow fast at all costs mentality. It doesn't preclude anywhere else in the world from being lax about security. I also have worked for multiple small/mid companies in Western Europe and, anecdotally for me, data & thoughts to security are held in much higher regard.

curun1r 9y ago

It's not likely to change that until customers start to actually care about security. And by actually care, I mean start making purchasing decisions based on that. Startups have limited resources, and that will never change. The nature of limited resources is to spend those resources on the tasks that will move the needle the most. Until security tasks start moving the needle, they'll get ignored. One way to make customers start caring about security? Regulation. In a very small startup with a serious shortage of resources, we're currently planning our GDPR compliance. And we're not doing it because we think privacy is important (though we do), we're doing it because customers are telling us that we need it before they can sign up. If customers aren't going to think security is important on their own (and they aren't), passing laws that force them to think it's important is the only way to change the situation.

nickpp 9y ago

>>>Hopefully it will also change the "move fast & proper security is an afterthought" model of startups. In short: starting startups will become more difficult. One of the things most taxing and scary for people in our society, starting your own business, but also one of the things most needed and useful (who else creates jobs and Big Cos later?!) will become harder to do. But what did startups ever did for us, no?!

adrianN 9y ago
Yeah, let's just blow all concerns about privacy in the wind. Think of the jobs! While we're at it we might also want to abolish building codes, to combat high rents. And what about OSHA? Clearly safety rules for workers just make it harder to start hardware companies!
- nickpp 9y ago
  Everything truly important for customers will become an advantage for the provider in the free market and it will improve. Including privacy. Governmental attempts to short-circuit that process are at best misguided at at worst harmful. They create ossified markets where established players rule and innovation and competition are nonexistent. Natural consequences - but hard to accept when one just takes the rallying cry du-jour in arms. "Think of the children!"
  - adrianN 9y ago
    You assume consumers with perfect information unselfishly optimizing for the long term good of all people and a market with true competition. None of which is true in reality.
    - nickpp 9y ago
      I don't assume anything. I just observe the "freer" markets like computers, entertainment and software and marvel at the rich choices, advances and quality present in spite of no regulations requiring for them. And then I look at any heavily regulated markets and I shudder at the prices, lack of choice, crappy quality and how horrible stuff happens in spite of regulations supposed to prevent it. So I draw a logical conclusion: Free Markets beat Regulations pretty much every time.