4 ms·
> At some point you just have to call out people for being utter morons. The blame is on them, 100%. [...] Your attitude is a symptom of a broader issue that p
by GhettoMaestro 7y ago
> At some point you just have to call out people for being utter morons. The blame is on them, 100%. [...]
Your attitude is a symptom of a broader issue that plagues this industry: Indifference to risk*probability. If you don't ship software with "secure defaults" (depending on the threat/attack model), you essentially are handing out loaded shotguns, then blaming the "dumb" user when they inevitably point it at their foot and click the trigger. Easy solution: Don't hand out the gun loaded -- make the user do specific actions that enable the usage. Yeah, it creates some friction to first time deployment, but that's a secondary concern to having your freaking DB leaking all over the place.
- outworlder 7y agoBut ES doesn't hand over a loaded gun . Someone went out of their way to load the gun up.
- GhettoMaestro 7y agoBullshit. If firing up a piece of software creates an unauthenticated, unprotected (non-TLS) endpoint to read-write data, that's a loaded gun. That is PRECISELY the default behavior of ES. ES has jacked around for years by making TLS and other standard security features premium. To that, I say this: Screw ES and their bullshit business model. Their business model is a leading cause to dumbasses dumping extremely sensitive PII data into a DB that is unprotected - those same folks aren't going to go the extra mile to secure the DB, either by licensing or 3rd party bolt-ons. Thus, why it must be shipped secure by default. Anything less is a professional felony, in my eyes. Also, screw ES again, in-case I wasn't clear.
- deleted 7y ago[deleted]
- late2part 7y agomaybe. but there's always this.... http://www.team.net/mjb/hawg.html http://www.team.net/mjb/hawg.html
- YawningAngel 7y agoIs it a secondary concern, though? As a startup, uptake is as vital as oxygen
- geofft 7y agoIf startups prioritize their growth over the good of society, isn't the logical conclusion that startups are a threat to society?
- marcoperaza 7y agoTort law is going to catch up to software soon enough and people will be held accountable for negligently creating or deploying software that they should have known would cause harm. The fact that someone else down the chain should have known better is not a perfect defense. If that misuse was foreseeable and you didn’t do enough to prevent or discourage it, then you can still be held liable.
- glloydell 7y agoThey're not a startup.