41 ms·

Thanks for the feedback.... 1. Looking at the code base they've released so far, Diaspora is starting from zero as well 2. I agree that startups don't do that

by jdp23 16y ago

Thanks for the feedback.... 1. Looking at the code base they've released so far, Diaspora is starting from zero as well 2. I agree that startups don't do that. The result is insecure code. If Diaspora gains a reputation for bad security, people won't trust them. 3. Well, I'm a tools guy. Burp Suite looks great too, I didn't know about it, but it's just naive to say "that's the only tool you need". 4. I agree that Diaspora's made the right tradeoff so far in getting a minimum viable product out -- I had discussed that in my previous post. The question is, what next? 5. Everything they've written so far. 6. Setting up a page for security contacts is certainly a good first step.

tptacek 16y ago
The Microsoft SDL steps you laid out depend, in varying degrees, on an organizational momentum that a 4-person dev team simply can't generate. Training, threat modeling, and serious community outreach are simply bad investments for them. There are 4-person teams out there that have fielded secure web applications. None of them follow the Microsoft SDL security practices. I like Microsoft, but most things that work for them won't work for startups.
- jdp23 16y ago
  Thanks again, excellent feedback. My network in the security space is somewhat Microsoft-centric and tools-centric so I've probably been thinking too much in that direction. I'd be surprised if people were building highly-secure web apps involving personal information, photos, and friendships without threat modeling ... would love to see counterexamples. anything you can share?
  - tptacek 16y ago
    I can't really share specifics, but, suffice it to say that it is uncommon to find any web app startup doing formal threat modeling.
    - jdp23 16y ago
      I agree .... for that matter it's uncommon to find larger organizations paying much if any attention to it. So I guess what I'm asking for is examples of web startups that you think are creating highly-secure distributed software at Diaspora's level of complexity. Think about it: how much would it cost Diaspora to bring in Matasano or one of your competitors to get some significant help with threat modeling, and catalyze the community to get involved and take it from there? For that matter there may probably at least some security consulting firms who get started for free, both because they believe in what Diaspora's trying to do and because of the visibility they'll potentially get if the project is successful. It's a huge opportunity, and Diaspora's got some advantages: visibility, enthusiasm, name. So while I think that Diaspora has done the right thing so far by focusing on functionality, now's the time they should be thinking about investing in the long term.

by jdp23 16y ago

tptacek 16y ago

The Microsoft SDL steps you laid out depend, in varying degrees, on an organizational momentum that a 4-person dev team simply can't generate. Training, threat modeling, and serious community outreach are simply bad investments for them. There are 4-person teams out there that have fielded secure web applications. None of them follow the Microsoft SDL security practices. I like Microsoft, but most things that work for them won't work for startups.

jdp23 16y ago
Thanks again, excellent feedback. My network in the security space is somewhat Microsoft-centric and tools-centric so I've probably been thinking too much in that direction. I'd be surprised if people were building highly-secure web apps involving personal information, photos, and friendships without threat modeling ... would love to see counterexamples. anything you can share?
- tptacek 16y ago
  I can't really share specifics, but, suffice it to say that it is uncommon to find any web app startup doing formal threat modeling.
  - jdp23 16y ago
    I agree .... for that matter it's uncommon to find larger organizations paying much if any attention to it. So I guess what I'm asking for is examples of web startups that you think are creating highly-secure distributed software at Diaspora's level of complexity. Think about it: how much would it cost Diaspora to bring in Matasano or one of your competitors to get some significant help with threat modeling, and catalyze the community to get involved and take it from there? For that matter there may probably at least some security consulting firms who get started for free, both because they believe in what Diaspora's trying to do and because of the visibility they'll potentially get if the project is successful. It's a huge opportunity, and Diaspora's got some advantages: visibility, enthusiasm, name. So while I think that Diaspora has done the right thing so far by focusing on functionality, now's the time they should be thinking about investing in the long term.