3 ms·

Not a great list. Very opinionated, and much as I'm security-conscious, I disagree with a number of "minimum" recommendations there. This list looks like it wa

by jwr 3y ago

Not a great list. Very opinionated, and much as I'm security-conscious, I disagree with a number of "minimum" recommendations there. This list looks like it was written by people who are not paying for anything, so they don't understand the tradeoffs, costs and compromises. I can assure you things look quite different when you are a solo founder running the business and you have to pay for everything. Technical stuff doesn't change, so recommendations like "Do not limit the permitted characters that can be used in passwords" still hold, but "Contract a security vendor to perform annual, comprehensive penetration tests on your systems"? Also, "Publish the point of contact for security reports on your website" and "Respond to security reports within a reasonable time frame" — I'm already spending too much time responding to "security researchers" trying to shake me by sending (rather silly and generic) "vulnerability reports". Some of them follow up by asking if they can "publish this on their social media channels" if I don't respond. I really don't need more "security reports" for my website.

lelanthran 3y ago
> This list looks like it was written by people who are not paying for anything, so they don't understand the TRADEOFFS, costs and compromises. That's the important word there (emphasis mine). I'm doing an MVP now for a client for a custom app (used internally by that client, i.e. only employers are users), and my recommendation for security is "I'll use a simple XOR symmetric stream cipher for now. We can switch to TLS[1] if the system turns out to be useful". Yeah, cut corners on other things as well - they just want to see how viable this thing is in practice. [1] While TLS is nice, certificate management becomes a pain in the rear for remote devices.
- dgb23 3y ago
  So really it’s a prototype. Nothing wrong with that.

by jwr 3y ago

lelanthran 3y ago

> This list looks like it was written by people who are not paying for anything, so they don't understand the TRADEOFFS, costs and compromises. That's the important word there (emphasis mine). I'm doing an MVP now for a client for a custom app (used internally by that client, i.e. only employers are users), and my recommendation for security is "I'll use a simple XOR symmetric stream cipher for now. We can switch to TLS[1] if the system turns out to be useful". Yeah, cut corners on other things as well - they just want to see how viable this thing is in practice. [1] While TLS is nice, certificate management becomes a pain in the rear for remote devices.

dgb23 3y ago
So really it’s a prototype. Nothing wrong with that.