4 ms·

Isn't the issue that, if you switch away from a service after an incident, it doesn't necessarily mean that the alternative is going to necessarily be better? G

Isn't the issue that, if you switch away from a service after an incident, it doesn't necessarily mean that the alternative is going to necessarily be better? GitHub clearly did things poorly, but is Gitlab or Bitbucket better? Or have they just not happened to have messed up publicly yet/recently? Is swapping away just playing musical chairs at high cost to your dev team having to constantly migrate until you've run out of services to migrate to? I don't say this to imply that everyone is equally bad, but to question if is obviously as illogical as you seem to think it is to stick with a company that's had a major security debacle. What certification can you get from another CI vendor about their security procedures that CircleCI wouldn't have given you 2 years ago, or your internal Jenkins team wouldn't have offered?

NoZebra120vClip 3y ago
> is Gitlab or Bitbucket better? GitLab currently (since August 2021) suffers from the same "SSPR Abuse" vulnerability that Obsidian exposed on Azure AD yesterday. They were nonplussed by my proof of concept and declined to move forward with the bug bounty as offered on Hackerone.
- noirbot 3y ago
  This is sort of what I mean. The fact that one vendor is bad at security has no particular bearing on if their competition is better, or if there's a more secure option you could run internally. Sure, we've learned that Azure is less secure than we may have thought last week, but is AWS or GCP better? Or have they just not been uncovered for their issues yet? Or maybe they had their big security issue last year. Once everyone's had a big problem, what do you do? Make up some scoring system and keep re-migrating your company to whoever currently has the lowest "security mistakes" score?
  - NoZebra120vClip 3y ago
    Take a lesson from the Lock Picking Lawyer. You don't need three impervious locks, two AirTags, and a Klaxon alarm on your bicycle, you only need a stronger lock than everyone else parked next to you. And when a bear attacks you and your buddy, you don't need to outrun the bear, you just need to outrun your buddy. On second thought, I'm not sure any of this philosophically applies to Cybersecurity, given the low cost of entry, stealth and anonymity, and the ability to mount massively parallel, unattended attacks.
    - brightlancer 3y ago
      I think the bigger difference is between targets: the US government is going to be targeted by a ton of folks who don't care about me or you or most folks on HN, even if US gov security is tougher than a random individual's.
  - tormeh 3y ago
    > is AWS or GCP better? Yes, they are.
- stevekemp 3y ago
  I noticed yesterday that HackerOne laid of 12% of its workforce.

NoZebra120vClip 3y ago

> is Gitlab or Bitbucket better? GitLab currently (since August 2021) suffers from the same "SSPR Abuse" vulnerability that Obsidian exposed on Azure AD yesterday. They were nonplussed by my proof of concept and declined to move forward with the bug bounty as offered on Hackerone.

noirbot 3y ago
This is sort of what I mean. The fact that one vendor is bad at security has no particular bearing on if their competition is better, or if there's a more secure option you could run internally. Sure, we've learned that Azure is less secure than we may have thought last week, but is AWS or GCP better? Or have they just not been uncovered for their issues yet? Or maybe they had their big security issue last year. Once everyone's had a big problem, what do you do? Make up some scoring system and keep re-migrating your company to whoever currently has the lowest "security mistakes" score?
- NoZebra120vClip 3y ago
  Take a lesson from the Lock Picking Lawyer. You don't need three impervious locks, two AirTags, and a Klaxon alarm on your bicycle, you only need a stronger lock than everyone else parked next to you. And when a bear attacks you and your buddy, you don't need to outrun the bear, you just need to outrun your buddy. On second thought, I'm not sure any of this philosophically applies to Cybersecurity, given the low cost of entry, stealth and anonymity, and the ability to mount massively parallel, unattended attacks.
  - brightlancer 3y ago
    I think the bigger difference is between targets: the US government is going to be targeted by a ton of folks who don't care about me or you or most folks on HN, even if US gov security is tougher than a random individual's.
- tormeh 3y ago
  > is AWS or GCP better? Yes, they are.
stevekemp 3y ago
I noticed yesterday that HackerOne laid of 12% of its workforce.