4 ms·

Having a secure baseline setup is obviously important. However the point that tptacek seems to be making is that most of the security risk of startups comes fro

by jiggy2011 14y ago

Having a secure baseline setup is obviously important. However the point that tptacek seems to be making is that most of the security risk of startups comes from the custom code that they write. You can have the most hardened openBSD setup in the world but if you write a web app that runs shell commands based on user input and you don't validate well enough you might be in for a bad time.

lifeisstillgood 14y ago
Is that really the cause of most security penetrations? Would love to hear from security researchers on this. My guess is a known vulnerability in a third party server is far far more likely to get you compromised (think Wordpress) Than unsantised SQL because one can scan and attack Wordpress automatically but need to manually craft an attack against my specific app Anyway. It's not really how to make startups less vulnerable, it's how to sell tptaceks expertise at a greater scale. If there is overlap good
- jiggy2011 14y ago
  Probably true, but you don't need to hire Matasano to tell you to patch your Wordpress. If you follow reasonable security practices then the low end automated scanning attacks tend to go away. Security of custom code is really another vector altogether and an expensive one that suddenly becomes important when your stuff gets popular enough to warrant bespoke attacks. I guess the problem startups may have is that they have lots of users (therefor lots of incentive to attack) before they necessarily have the spare change to pay for professional audits of their custom code.
- tptacek 14y ago
  They are both major causes of intrusions, but if I was running a SaaS shop, I'd be more worried about vulnerabilities in my own code than I would about vulnerabilities in my operating system. Modulo: don't run Wordpress.
  - lifeisstillgood 14y ago
    With my developer hat on, it's not so much my code as it is the poor choices frameworks and similar "everyone does it this way" tilutorials make. It's too easy to follow the tutorial and have a default of stuffing everything into a cookie, overly complex orm s and oh you know the rest - and that's before I have written my facebookforfish code I am not sure where that problem fits in - but it feels like the same issue as we urging the OS or securing my postfix. The layer beneath my code is one I want to be secure and be simple. Help with that and I will use your layer choices. That may or may not be profitable.
  - lifeisstillgood 14y ago
    With my developer hat on, it's not so much my code as it is the poor choices frameworks and similar "everyone does it this way" tilutorials make. It's too easy to follow the tutorial and have a default of stuffing everything into a cookie, overly complex orm s and oh you know the rest - and that's before I have written my facebookforfish code I am not sure where that problem fits in - but it feels like the same issue as we urging the OS or securing my postfix. The layer beneath my code is one I want to be secure and be simple. Help with that and I will use your layer choices. That may or may not be profitable.
- snowwrestler 14y ago
  It's not really that hard to run Wordpress securely enough to deal with the sorts of automated attacks that target Wordpress sites. As I understand it, the danger in custom code is not just that it will be architected insecurely, but that simple oversight can create a vulnerability that won't be found until it is too late. If only one site is running your code, then that site will go down if a vulnerability is found. One advantage of running Wordpress is that Automattic is leveraging a network of millions of honeypots (the other bozos running Wordpress) to find new vulnerabilities fast. You have keep on top of the patches though.

lifeisstillgood 14y ago

Is that really the cause of most security penetrations? Would love to hear from security researchers on this. My guess is a known vulnerability in a third party server is far far more likely to get you compromised (think Wordpress) Than unsantised SQL because one can scan and attack Wordpress automatically but need to manually craft an attack against my specific app Anyway. It's not really how to make startups less vulnerable, it's how to sell tptaceks expertise at a greater scale. If there is overlap good

jiggy2011 14y ago
Probably true, but you don't need to hire Matasano to tell you to patch your Wordpress. If you follow reasonable security practices then the low end automated scanning attacks tend to go away. Security of custom code is really another vector altogether and an expensive one that suddenly becomes important when your stuff gets popular enough to warrant bespoke attacks. I guess the problem startups may have is that they have lots of users (therefor lots of incentive to attack) before they necessarily have the spare change to pay for professional audits of their custom code.
tptacek 14y ago
They are both major causes of intrusions, but if I was running a SaaS shop, I'd be more worried about vulnerabilities in my own code than I would about vulnerabilities in my operating system. Modulo: don't run Wordpress.
- lifeisstillgood 14y ago
  With my developer hat on, it's not so much my code as it is the poor choices frameworks and similar "everyone does it this way" tilutorials make. It's too easy to follow the tutorial and have a default of stuffing everything into a cookie, overly complex orm s and oh you know the rest - and that's before I have written my facebookforfish code I am not sure where that problem fits in - but it feels like the same issue as we urging the OS or securing my postfix. The layer beneath my code is one I want to be secure and be simple. Help with that and I will use your layer choices. That may or may not be profitable.
- lifeisstillgood 14y ago
  With my developer hat on, it's not so much my code as it is the poor choices frameworks and similar "everyone does it this way" tilutorials make. It's too easy to follow the tutorial and have a default of stuffing everything into a cookie, overly complex orm s and oh you know the rest - and that's before I have written my facebookforfish code I am not sure where that problem fits in - but it feels like the same issue as we urging the OS or securing my postfix. The layer beneath my code is one I want to be secure and be simple. Help with that and I will use your layer choices. That may or may not be profitable.
snowwrestler 14y ago
It's not really that hard to run Wordpress securely enough to deal with the sorts of automated attacks that target Wordpress sites. As I understand it, the danger in custom code is not just that it will be architected insecurely, but that simple oversight can create a vulnerability that won't be found until it is too late. If only one site is running your code, then that site will go down if a vulnerability is found. One advantage of running Wordpress is that Automattic is leveraging a network of millions of honeypots (the other bozos running Wordpress) to find new vulnerabilities fast. You have keep on top of the patches though.