5 ms·
This sounds like your standard startup-y security stack. Bonus points for trying to use your cloud provider's hardware key storage and keeping secrets in 1pass
by jrockway 4y ago
This sounds like your standard startup-y security stack. Bonus points for trying to use your cloud provider's hardware key storage and keeping secrets in 1password. It ain't great but you could do worse.
(I've worked at startups and we did better. No access to the cloud provider without a time-based escalation. Secrets in secrets managers. Passwords rotated regularly. Mandatory 2FA. Signed commits. But it would probably still look god-awful if we were a finance company!)
- amanj41 4y agoWhat's particularly astounding about the case of FTX is that it was rolling in cash (unlike many startups), and yet never cared enough to throw money at hiring tons of security-minded staff and engineers
- jrockway 4y agoVery good point. Spending the money on security engineers at a crypto company sounds like a no-brainer to me. They have a lot of good ideas and the work is essential. (Demanding that crypto keys be stored in Google Drive is the kind of suggestion you'd make if you were planning on stealing all the money, I guess.)
- dieselgate 4y agoYeah have often thought the same but presumably they wouldn’t have been able to keep pulling all these shenanigans/fraud if they had proper security staff.
- japhyr 4y agoIf you read through some of the other parts of the thread, there are stories where they fired competent people as soon as they called attention to these kinds of issues.