3 ms·
Playing devil’s delegate with a normal process how we launch new service in big tech: 1. Have you done a security review and ideally pen-testing from a 3rd par
by whoevercares 5y ago
Playing devil’s delegate with a normal process how we launch new service in big tech:
1. Have you done a security review and ideally pen-testing from a 3rd party? Are you fully TLS from end to end, are you aware of any exploitable vector from your API/UI and how you mitigate them
2. How do you handle software patching and vulnerabilities?
3. Do you consider your app Operational ready? Can you rollback, do you audit changes, do you need multi-AZ resilience, do you need cell based arch. Did someone other than yourself or outside your team look at your monitoring dashboard? Do you need to be paged at 3am if some of your dependencies or underlying node degrades. We have to answer a 50 questions template and review it multiple times..
4. Did you calculate the cost and forecast it with how the service/app may grow in the next 12-36 months?
While you still need to do all this when using a Cloud providers, you probably _should_ do much more if you manage the bare metal
If you have already done all those, Kudos to you, but I still find it hard to trust everyone who DIY
- db65edfc7996 5y agoTo beelzebub the devil...how many large scale hacks/data leaks/embarrassment from large companies are because of a misconfigured S3 bucket?
- FpUser 5y agoMy clients do / pay for whatever the audits are required in their line of business. I do not get involved unless told to do some particular things. >" but I still find it hard to trust everyone who DIY" It depends on what is the actual DIY part is. In any way it is your problem. Not mine. Sorry to say but to me your whole post feels like typical FUD scaremongering client to cloud. >"While you still need to do all this when using a Cloud providers, you probably _should_ do much more if you manage the bare metal" No I should not probably do much more. I do much less as I have way less moving parts.
- whoevercares 5y agoI just think all those features are necessary for any serious usage and it’s costly to build all on your own. But perhaps you are right since it fit your business model - you seems not interested in building a platform at all
- FpUser 5y ago>"you seems not interested in building a platform at all" I build products. That is my primary output. And the actual delivery is a binary executable that does the job. And it does it with the stellar performance that makes all that horizontal scaling infra totally unneeded. I serve the needs of my clients, not the needs of Amazon.