3 ms·

This is why security is an onerous black hole. Security folks always condescendingly lambaste companies not using best practices, but security is literally the

by umvi 7y ago

This is why security is an onerous black hole. Security folks always condescendingly lambaste companies not using best practices, but security is literally the worst. It's an infinitely deep hole of money, time, and CPU cycles. If you create a startup with security best practices you'll never get anything done because you have to build everything in a way such that you don't trust anyone, including your own staff. So now your staff have ball and chains shackled to their ankles to prevent them from misbehaving (but also preventing them from having agility). It's 100x cheaper and easier to do the cheapest 80% of security, and then hope that you don't get exploited by the other 20%.

mox1 7y ago
You say black hole, us security people call it a "hard problem". I mean lots of IT things are or end up being black holes. I will say though, usually, attitudes like yours end up causing more problems than they solve (casual dismissal of security in general, more of a bother, doesn't stop everyone, waste of time, etc. etc.) I like to think of security like this: My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. Yes, black hole, but my (infinite) glass is half-full.
- umvi 7y ago
  The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff. Yes, I get we live in a world where bad people take advantage of others, making security necessary. But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist. > My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.
  - saagarjha 7y ago
    Security is a trade off. Everyone knows that the most secure computer is one that you never turn on; the job of your security team is to strike a balance that is better than that.
    - umvi 7y ago
      > Everyone knows that the most secure computer is one that you never turn on An attacker might gain physical access to your turned-off computer and wreck all sorts of mayhem (install a hardware keylogger, rip the hard drive out and recover stuff from it, etc). The most secure computer is the one that doesn't exist.
      - saagarjha 7y ago
        If you never turn it on, there can't be anything useful on it ;)
        umvi 7y ago
        An attacker with physical access could install an LTE-controlled power outlet and then remotely turn it on and use it to mine cryptocurrency whenever you aren't around, stealing your electricity. Ok, maybe that's a stretch...
    - TeMPOraL 7y ago
      > the job of your security team is to strike a balance that is better than that. There are two ways to strike a balance. A cooperative way, and a competitive way. A cooperative way is when all sides get together and hammer out an optimal solution, and then implement it in agreement. A competitive way is when everyone pushes to maximize their interest, and through the fighting, an equilibrium establishes itself[0]. I think GP is complaining about security teams that approach their job in a competitive manner, instead of a cooperative one. -- [0] - You'll note that this is how competitive markets work; this both makes them a robust decision-making mechanism, and an incredibly wasteful one.
hrktb 7y ago
Startups are fine I think: in a 4~10 people company every employee is the equivalent of VP and each getting admin access to company’s DB for instance is par for the course. If you can’t trust your CTO you have other issues at hand.

by umvi 7y ago

mox1 7y ago

You say black hole, us security people call it a "hard problem". I mean lots of IT things are or end up being black holes. I will say though, usually, attitudes like yours end up causing more problems than they solve (casual dismissal of security in general, more of a bother, doesn't stop everyone, waste of time, etc. etc.) I like to think of security like this: My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. Yes, black hole, but my (infinite) glass is half-full.

umvi 7y ago
The problem with security is that there is never "enough." It's a game of cat and mouse that will consume ever increasing amounts of time, money, and electricity until the end of time. Time, money, and electricity that could be spent on other things. Pretty soon I expect 50% of my electricity to be uselessly devoted to spectre mitigation and other security concerns instead of, you know, computing useful stuff. Yes, I get we live in a world where bad people take advantage of others, making security necessary. But if security people had their way, hobbyists wouldn't be allowed to hack together a side project without first hiring a $100k/year security specialist. > My goal is to make it as hard and annoying as possible for bad guys to do bad things to the systems I'm responsible for. By making it hard and annoying for the good guys to do their job as well. I know it's all necessary, but you can't deny that. Having to beg and plead with the IT security gatekeepers every time I want to [open a port for a webserver/install some package/etc] is more onerous than me having sudo privileges, especially when IT tickets take 2-3 days to resolve. And that's just one example. Anything security related is usually a pain. HTTPS is much more painful than HTTP, for example.
- saagarjha 7y ago
  Security is a trade off. Everyone knows that the most secure computer is one that you never turn on; the job of your security team is to strike a balance that is better than that.
  - umvi 7y ago
    > Everyone knows that the most secure computer is one that you never turn on An attacker might gain physical access to your turned-off computer and wreck all sorts of mayhem (install a hardware keylogger, rip the hard drive out and recover stuff from it, etc). The most secure computer is the one that doesn't exist.
    - saagarjha 7y ago
      If you never turn it on, there can't be anything useful on it ;)
      - umvi 7y ago
        An attacker with physical access could install an LTE-controlled power outlet and then remotely turn it on and use it to mine cryptocurrency whenever you aren't around, stealing your electricity. Ok, maybe that's a stretch...
  - TeMPOraL 7y ago
    > the job of your security team is to strike a balance that is better than that. There are two ways to strike a balance. A cooperative way, and a competitive way. A cooperative way is when all sides get together and hammer out an optimal solution, and then implement it in agreement. A competitive way is when everyone pushes to maximize their interest, and through the fighting, an equilibrium establishes itself[0]. I think GP is complaining about security teams that approach their job in a competitive manner, instead of a cooperative one. -- [0] - You'll note that this is how competitive markets work; this both makes them a robust decision-making mechanism, and an incredibly wasteful one.

hrktb 7y ago

Startups are fine I think: in a 4~10 people company every employee is the equivalent of VP and each getting admin access to company’s DB for instance is par for the course. If you can’t trust your CTO you have other issues at hand.