5 ms·

Meanwhile 4 put of 5 webshops we check have critical vulnerabilities and half the owners don’t care because “it just costs money to fix it and things have been

• tetha 8y ago
  We're a SaaS Shop in europe targeting larger enterprise customers. While there is some funny business dealing with that kind of customers, security actually matters to them. We're currently being paid to implement TLS encryption for our offsite database replications, we might be able to create a customer project to setup tripwire systems. That's fun :)
  • blattimwind 8y ago
    > We're currently being paid to implement TLS encryption for our offsite database replications Amazing. I guess... better late than never?
• AnIdiotOnTheNet 8y ago
  Frankly, that's an entirely appropriate way to deal with security. You can make the most secure product in the universe, but no one will use it if it takes forever to develop or is unnecessarily difficult to work with. Of course, how much security is enough is a multi-variable problem, but in general I find that "security people", who for obvious reasons want to sell you on security, way over-estimate its value.
  • dstick 8y ago
    Oh it absolutely is, and the most humbling thing was realising that I would probably do exactly the same thing in their situation ;-) However as a developer and business owner myself (as opposed to a security person), I genuinely thought more people would be more concerned about the security of their website. I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin.... You see not knowing is one thing, but knowing and being complacent is quite another. But we see that in more areas in life I guess :)
    • Scriptor 8y ago
      Really refreshing to see someone say they might do the same thing if the tables were turned. It's easy to judge others shortcomings in what we know, but there's probably plenty of other things that we have our own shortcomings with.
      • dstick 8y ago
        Thanks! There’s a reason large enterprises spend a ton of resources on security while SMBs are vulnerable on just about every public attack surface: priorities. Well that and expectations. Most small business owners see security as part of the developer’s job. However don’t realise it’s something that needs non-stop attention as websites and technologies in general are affected by erosion. What’s safe today might not be tomorrow. The developer isn’t at fault for that, and yet the website owner refuses to foot the patch bill, or pay for continuous monitoring. I could write all day about this and we’ve only been in the trenches for a few weeks now :p
    • type0 8y ago
      > I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin Changing the "password" field on http site to "textarea" with hidden css rule is another great one- to get rid off the browser warning. As it was explained to me, because TLS is too much hustle.
      • dstick 8y ago
        Oh that’s golden, I’m going to remember that one and pop it out as an example some time. Thanks for that!
  • michaelt 8y ago
    no one will use it if it [...] is unnecessarily difficult to work with In some aspects of security, you can trade off inconvenience for cost, instead of trading off against security. For example, imagine an office with a security gate, but it takes a few days for new employees to be issued with a working gate pass. One way to reduce that inconvenience would be to trade off security, by having staff members buzz strangers in if they know the magic words "I just started, my pass hasn't arrived yet". An alternative way would be to trade off cost, by having while-you-wait gate pass printing, and every gate having a guard who can check an online employee directory before buzzing someone in without a pass. I feel a lot of people say "Security is a trade-off with convenience" when they actually mean "Security is a trade-off with convenience and spending, but we've already taken spending off the table"
    • paulddraper 8y ago
      Well, to be frank, duh. There's a trade-off between small battery size and battery capacity. You don't really need to qualify that with "if you've taken spending off the table".
      • smadge 8y ago
        You’re getting downvoted because of being flippant but you are right, by definition there exists a trade off between cost and any feature. It’s the least interesting trade off: if want more X it will cost more. There also is a trade off between any two features mediated by cost, if I spend more on X, then I can’t spend as much on Y. What are more interesting are inherent trade offs. Like the famous trade off between security and liberty seems to not just be mediated by cost.
    • gpm 8y ago
      There is another option here. Have security passes issued promptly. It's possible, I've worked at a bank where it took all of 5 minutes. (Not that I disagree with the general point, just the example)
      • michaelt 8y ago
  • raesene9 8y ago
    That's fine as long as your customers have the same expectations of the level of security you're providing as you do, and you're complying with appropriate legislation around handling of customer personal and business data :)
  • minitech 8y ago
    > Frankly, that's an entirely appropriate way to deal with security. No, it’s not. You don’t have to be perfect, but “critical vulnerabilities and half the owners don’t care” sounds a long way from approaching perfect. This is why we have botnets made of webcams and blogs, and constant leaks of people’s private information and passwords.
  • detaro 8y ago
    I'd agree with that if these people would also suffer financial consequences if it goes wrong, and not offload that on their customers whose data got compromised.
    • AnIdiotOnTheNet 8y ago
      Let's say their customers were aware of and understood all the risks. Do you think they'd really go elsewhere or give up the service? If so, then you're right, but my guess is most of them wouldn't because the risk is acceptable.
  • kbenson 8y ago
    Let's qualify that - it's an entirely appropriate way to deal with security with the current climate of not actually having any repercussions (or none beyond some tepid market response) for security breaches that damage third parties.
  • dredmorbius 8y ago
    The company running a tight ship front-loads risk costs. The firm that doesn't is arbitraging present vs. potential future costs. The apparent lower costs are illusory.
    • wongarsu 8y ago
      A lot of the time the costs aren't actually payed by the breached party though. Most customers don't meaningfully change behaviour due to security breaches and meaningful fines are the exception, so your biggest risk is a breach benefitting your competition. If most of the costs can be externalized there is little incentive to care about them.
      • dredmorbius 8y ago
        The customers also play this game. It's an availability heuristic.
  • some_random 8y ago
    Could I get a list of every product you've worked on or influenced? I want to know what I need to avoid at all costs.
  • some_random 8y ago
    Honestly, I feel this position is morally bankrupt. When someone pays for your product, gives you sensitive information, or interacts with you in any way, they have a set of expectations. When purchasing medicine at a pharmacy, they expect to receive something that has a chance of making them better. When they deposit money into a bank, they expect that the bank will try to have the money there when they want it later. When they drop their car off at a mechanic, they expect the mechanic will try not lose the car. Anything less is called a scam. So when someone purchases a product, they expect that appropriate measures have been taken to ensure that they will not be hurt by that product. The average consumer doesn't know about proper electrical grounding, the interactions of their prescription medications, or XSS. They shouldn't have to, they're paying to not have to. "security people" overvalue security in relation to _your_ bottom line. In truth, they aren't just there for you, they're also there to advocate for the people who will actually be hurt when your garbage security gets circumvented.
    • ascar 8y ago
      He said it's overvalued, not that it's irrelevant. In your example you expect the mechanic to lock your car and keep the keys safe, but you don't expect it to be put in a walled in area with armed guards and full-time surveillance. The latter is what IT security can quickly lead to.
      • some_random 8y ago
        That's absolutely true, but the position he was endorsing was >Meanwhile 4 put of 5 webshops we check have critical vulnerabilities and half the owners don’t care because “it just costs money to fix it and things have been fine so we’d rather spend more on Adwords” Waiting until you get owned to actually patch up critical vulnerabilities in order to save money is negligence.