5 ms·

> online services have cutting edge security with no known exploits, yet you have millions of people attempting daily and developing brand new methods for getti

> online services have cutting edge security with no known exploits, yet you have millions of people attempting daily and developing brand new methods for getting in Reality is the reverse. Plenty of online services with big-security holes, but no one really probes things that hard.

ls612 4y ago
Plenty of people are probing the AmaGoogAppSoft services daily and they seem to be pretty robust. Some random SaaS yeah who knows but the big boys seem to know what they are doing in this space.
- feanaro 4y ago
  Try doing bug bounties (and being successful at them) then report back whether your perspective has been changed.
  - pessimizer 4y ago
    The fact that they're paying people to find holes is evidence that it's difficult to find holes, not the opposite.
    - feanaro 4y ago
      I mean, it does require relatively rare technical skill among the general populace, so you need to incentivize it in some way. That is nowhere near a sufficient argument to prove it's difficult in the sense of it being a rare event. Lots and lots of rewards are given out, which means there are lots and lots of open holes in any given moment.
- Wowfunhappy 4y ago
  I would expect the headquarters building of a fortune 500 company to also have a non-trivial level of security, so in that regard I'm not convinced the internet has changed much. The average home is probably more analogous to a consumer router—and the security story there is not exactly great.
naet 4y ago
My personal site sees little to no real user traffic, but gets hundreds to thousands of hits monthly from bots looking for various known vulnerabilities in older versions of WordPress, PHP, etc.
- rs999gti 4y ago
  I get this too. Are these real threats or Google or other bot traffic that I should be taking action on? My provider's web app firewall and other security measures just log this stuff.

ls612 4y ago

Plenty of people are probing the AmaGoogAppSoft services daily and they seem to be pretty robust. Some random SaaS yeah who knows but the big boys seem to know what they are doing in this space.

feanaro 4y ago
Try doing bug bounties (and being successful at them) then report back whether your perspective has been changed.
- pessimizer 4y ago
  The fact that they're paying people to find holes is evidence that it's difficult to find holes, not the opposite.
  - feanaro 4y ago
    I mean, it does require relatively rare technical skill among the general populace, so you need to incentivize it in some way. That is nowhere near a sufficient argument to prove it's difficult in the sense of it being a rare event. Lots and lots of rewards are given out, which means there are lots and lots of open holes in any given moment.
Wowfunhappy 4y ago
I would expect the headquarters building of a fortune 500 company to also have a non-trivial level of security, so in that regard I'm not convinced the internet has changed much. The average home is probably more analogous to a consumer router—and the security story there is not exactly great.

naet 4y ago

My personal site sees little to no real user traffic, but gets hundreds to thousands of hits monthly from bots looking for various known vulnerabilities in older versions of WordPress, PHP, etc.

rs999gti 4y ago
I get this too. Are these real threats or Google or other bot traffic that I should be taking action on? My provider's web app firewall and other security measures just log this stuff.