3 ms·
I can't speak for speed and reliability but I can speak for budget vs security and in all honesty, unless it's going to kill people otherwise, screw security in
by iuguy 16y ago
I can't speak for speed and reliability but I can speak for budget vs security and in all honesty, unless it's going to kill people otherwise, screw security in your first iteration and get it out.
If you don't ship you don't have a startup.
If TDD/BDD is getting in the way of shipping, then ditch it. Like security, you can always absorb the debt and introduce it later. To put it another way, if you spend all this time doing it right, ship (eventually) and it never gains traction then what have you gained? On the other hand if you ship a buggy (and presumably fairly insecure) product but it does gain traction then you should pay down the debt because it's working.
- tzs 16y agoYou only get to make one first impression. If my first impression is that you got the fundamental requirements down, and now just need to add features and deal with growth, then I'll stick around. If my first impression is that you ditched fundamental requirements, such as security, then I don't care how many features you have at launch--I can't trust your site. If your idea is good, I'll wait for someone to rip it off and go with them.
- iuguy 16y agoYou are of course correct. However, there's a difference between enough security to launch (i.e. what comes with your framework like XSS, SQL injection protection and basic common sense etc.) and spending lots of time doing extra security stuff (like HTTPS everywhere, making sure cookies are properly scoped etc.) that could be spent getting your startup out of the door. There has to be a balance, which is something quite a few fellow security nerds miss. The value security brings is in protecting data. If you have no data, then there's not much value in security. Likewise, if you have sensitive data then it's worth going the distance to secure it.