22 ms·
>Often I find that IT put too much priority on security in relation to other factors, in part because they lack the perspective to properly prioritize things.
by ghfjfh 5y ago
>Often I find that IT put too much priority on security in relation to other factors, in part because they lack the perspective to properly prioritize things.
This sounds too similar to something they might say about you. Do you have any specific examples?
- AnIdiotOnTheNet 5y agoYes: Spectre and Meltdown. If you are running a cloud hosting company (or are using their services) then these are a huge problem for you because you run untrusted code on systems with sensitive data, or are sharing hardware with untrusted parties. It is probably very much worth the effort to use the performance impacting mitigations here. If you're running an on-prem server, you're not running rando code from untrusted sources so the performance-impacting mitigations don't make sense. Yet there were (and still are) a lot of people who insist these mitigations need to be applied everywhere. This sort of thing comes up all the time though. Think about how often people run web browsers on development machines. Not only are the a vector for "accidentally" installing malware even without bugs, they can sometimes be exploited to obtain data from your computer. Yet would you ever try and tell a developer that they can't use a web browser? But you take a similar decision outside of IT and suddenly IT people think it's a good idea to, say, disable VBA macro execution across the org because they don't have any idea how heavily the accounting department relies on it.
- llama052 5y ago> if you're running an on-prem server, you're not running rando code from untrusted sources so the performance-impacting mitigations don't make sense. Yet there were (and still are) a lot of people who insist these mitigations need to be applied everywhere. There's always generally someone else's code running somewhere, if it's "trusted" or not it's still a valid risk to assess.
- deleted 5y ago[deleted]
- rurban 5y agoI rather thing the big players are ignoring security risks on purpose. Eg Amazon AWS just switched from their secure and isolated Xen to the insecure and faster KVM. Everybody is praising the insecure eBPF on servers. You can certainly play with eBPF on your private isolated machines, but on big public servers it's a high risk. Still, there is where it's used. Nobody but java cares about Unicode identifier insecurity. It's just shrug off, even if the standard gives explicit recommendations and guidelines. Insecurity is the default until a desaster destroys the business model. Managers are making those decisions mostly.
- deleted 5y ago[deleted]