3 ms·
Thanks again, excellent feedback. My network in the security space is somewhat Microsoft-centric and tools-centric so I've probably been thinking too much in t
by jdp23 16y ago
Thanks again, excellent feedback. My network in the security space is somewhat Microsoft-centric and tools-centric so I've probably been thinking too much in that direction.
I'd be surprised if people were building highly-secure web apps involving personal information, photos, and friendships without threat modeling ... would love to see counterexamples. anything you can share?
- tptacek 16y agoI can't really share specifics, but, suffice it to say that it is uncommon to find any web app startup doing formal threat modeling.
- jdp23 16y agoI agree .... for that matter it's uncommon to find larger organizations paying much if any attention to it. So I guess what I'm asking for is examples of web startups that you think are creating highly-secure distributed software at Diaspora's level of complexity. Think about it: how much would it cost Diaspora to bring in Matasano or one of your competitors to get some significant help with threat modeling, and catalyze the community to get involved and take it from there? For that matter there may probably at least some security consulting firms who get started for free, both because they believe in what Diaspora's trying to do and because of the visibility they'll potentially get if the project is successful. It's a huge opportunity, and Diaspora's got some advantages: visibility, enthusiasm, name. So while I think that Diaspora has done the right thing so far by focusing on functionality, now's the time they should be thinking about investing in the long term.