3 ms·

Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of securit

by umvi 6y ago

Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of security hoops?

snorrah 6y ago
Yes, so that you always keep security in mind.
- umvi 6y ago
  And what if the thing I'm building isn't intended for the public internet?
  - tremon 6y ago
    Then why are you building it on the public internet?
    - umvi 6y ago
      I'm not. I'm just using flask/mongodb/whatever for some internal app. But if it's secure by default I need to jump through a bunch of hoops to secure something that won't even be on the public internet.
ObsoleteNerd 6y ago
Absolutely. Laziness isn't an excuse for not caring about security. Security should be the top of your mind any time you connect anything to the internet. The fact it's not, is why we're seeing major attacks/leaks/etc almost every single day now.
- umvi 6y ago
  Right, well now we know why secure by default isn't a thing. If your product is super onerous to use, people will switch to a competitor that is easier to work with. A secure by default product is a dead on arrival product.
foxylad 6y ago
Of course you don't need to waste time setting up security properly. And it's such a pain locking and unlocking your car and your house every time you go in and out too. Tell me, where do you live again? I'm 58 and bald, so channeling yoda is easy: a valuable lesson you need to learn, and learn it the cheap way or the expensive way you can. The cheap way is to invest in a cheap VPS for a month, fire up sshd and a webserver, and then check the logs when the month is up. The expensive way is to carry on treating security as an afterthought. It'll cost you your pride, your reputation, and possibly your career.
Ajedi32 6y ago
Then you just pass the `--disable-all-security` flag. (Or whatever similar method the project you're using exposes to allow that.) Secure-by-default doesn't have to be complicated; it's just a way to ensure people don't shoot themselves in the foot without comprehending what they're doing.
- dawnerd 6y ago
  Exactly. Do people complain about how hard it is to spin up mysql or postgres?
- rectang 6y ago
  Thank you for this reply; it's my favorite post in the entire discussion. It illustrates perfectly why insecure defaults are a terrible way to implement "tutorial mode".

by umvi 6y ago

Secure by default is super onerous though. What if I just want to try out something before committing to it, do I really need to jump through a bunch of security hoops?

snorrah 6y ago

Yes, so that you always keep security in mind.

umvi 6y ago
And what if the thing I'm building isn't intended for the public internet?
- tremon 6y ago
  Then why are you building it on the public internet?
  - umvi 6y ago
    I'm not. I'm just using flask/mongodb/whatever for some internal app. But if it's secure by default I need to jump through a bunch of hoops to secure something that won't even be on the public internet.

ObsoleteNerd 6y ago

Absolutely. Laziness isn't an excuse for not caring about security. Security should be the top of your mind any time you connect anything to the internet. The fact it's not, is why we're seeing major attacks/leaks/etc almost every single day now.

umvi 6y ago
Right, well now we know why secure by default isn't a thing. If your product is super onerous to use, people will switch to a competitor that is easier to work with. A secure by default product is a dead on arrival product.

foxylad 6y ago

Of course you don't need to waste time setting up security properly. And it's such a pain locking and unlocking your car and your house every time you go in and out too. Tell me, where do you live again? I'm 58 and bald, so channeling yoda is easy: a valuable lesson you need to learn, and learn it the cheap way or the expensive way you can. The cheap way is to invest in a cheap VPS for a month, fire up sshd and a webserver, and then check the logs when the month is up. The expensive way is to carry on treating security as an afterthought. It'll cost you your pride, your reputation, and possibly your career.

Ajedi32 6y ago

Then you just pass the `--disable-all-security` flag. (Or whatever similar method the project you're using exposes to allow that.) Secure-by-default doesn't have to be complicated; it's just a way to ensure people don't shoot themselves in the foot without comprehending what they're doing.

dawnerd 6y ago
Exactly. Do people complain about how hard it is to spin up mysql or postgres?
rectang 6y ago
Thank you for this reply; it's my favorite post in the entire discussion. It illustrates perfectly why insecure defaults are a terrible way to implement "tutorial mode".