4 ms·
Rule #1 about databases: It will be hacked. Rule #2: see rule #1
by lsllc 7y ago
Rule #1 about databases: It will be hacked.
Rule #2: see rule #1
- izzydata 7y agoThat would imply that security is irrelevant. Maybe you should re-work your rule the say that it will attempt to be hacked. Therefore you should always worry about security.
- PascLeRasc 7y agoEither that or rework what data you collect so that when you get hacked/leaked it's not as big a deal. Or don't collect data at all.
- tgragnato 7y agoI think OP is arguing that you should worry about security AND collect only what's strictly necessary.
- smudgymcscmudge 7y agoI'm with OP here. You just shouldn't have unencrypted, sensitive data in a database.
- izzydata 7y agoI kind of think you've misunderstood something. This person said "You will be hacked". A guaranteed absolute. If that were the case then why bother protecting anything? His wording was misleading. Not his intentions. Nobody is in disagreement that security is very important.
- munk-a 7y agoI disagree, his wording was pretty spot on. Don't collect personal data - it will be hacked. At many of the businesses I've worked at I've made an effort to lower our PII data blob purely to reduce liability for when it was compromised. If you can see some information, a hacker eventually will. Granted, lowering liability is apparently something I shouldn't worry about since no one is ever held to account for breaches these days.
- izzydata 7y agoIf that is what he was going for then alright. My bad.
- PeterisP 7y agoIt doesn't imply that security is irrelevant - it's just that you shouldn't really expect to succeed in preventing all attacks (since noone does), just reducing their number. This implies that in addition to reducing the likelihood of breaches, you should also focus on all the other aspects of security, especially detection and mitigation; and for databases one of the main ways of reducing the impact of breaches is to avoid storing sensitive information as much as possible. In this particular example, was it really necessary to store pictures of license plates beyond a very limited period of time? A breach can't leak what you don't store, and you will get some breaches.
- txcwpalpha 7y agoSecurity is not irrelevant, but that doesn't mean that everyone won't be hacked. There is a saying in the security world: "there are two types of companies: those that have been hacked, and those that just don't realize yet that they've been hacked". Of course we shouldn't just 'give up' and stop trying to improve our security, but the unfortunate truth is that breaches are practically inevitable. In addition to constantly striving to improve our security, our society also needs to start investigating ways to make it so that breaches are less impactful (for example, stop using SSNs as any type of secret identifier, so that if an SSN database is breached, it doesn't matter).
- 0xffff2 7y agoThat's absurd. This statement is exactly why we use algorithms like bcrypt to store passwords. If we could be confident that our database wouldn't be hacked, we could just store passwords in plain text and save a whole lot of CPU cycles.
- matz1 7y agono, the goal is not to make it unhackable because its impossible but to make it really really costly/difficult to be hack.
- PopeDotNinja 7y agoAt a minimum, if something is secure by design, there's way less to worry about.
- taneq 7y agoSecurity is relevant, it's what determines how long until you're hacked.
- btcbanking 7y agoBecause noone in IT is competent?