The team has only one person worth of freedom bit could only be written by someone who doesn't understand big companies. When I was at Oracle, the majority of

The team has only one person worth of freedom bit could only be written by someone who doesn't understand big companies. When I was at Oracle, the majority of the constraints on me and my team came from a differing risk profile of the company. In a stand alone company with basically no customers, e.g. a small startup, a critical security issue isn't something to worry much about; you have no customers, reputation or revenue to lose. At a company that tries to brand on security with millions upon millions of existing revenues, a PHI leak could cause millions in damages. Similarly, I had to deal with arms control paperwork every release since we shipped internationally with encryption turned on by default. Again, not a number of employees problem but a high company profile problem.