5 ms·

One thing I hate seeing is startups and security. Not that mongo is bad or anything this is just a good time to say it. Build your product correctly from the s

by theboss 13y ago

One thing I hate seeing is startups and security. Not that mongo is bad or anything this is just a good time to say it. Build your product correctly from the start and have a security policy early. Don't leave XSS in your website, don't just hack code together and throw it on a server. As a security guy I love seeing new startups products because so often the code is so freshly written and immature that anyone it's asking for trouble. Measure twice cut once

alexandros 13y ago
Some times taking more time (and/or better coders) to do something 'right' vs. just hacking it together is the difference between failure and success. So from an individual startup's POV this may not be worth doing. Having enough users/success to warrant a security breach is a luxury problem when viewed from the eyes of an entrepreneur with no product. On the other hand, collectively, startups losing everyone's credentials/data are burning the commons wrt people's willingness to use new products. But then on hand #3, it's not as if BigCo's have a much better record, so I guess this gets chalked up to the general 'why in the world do we release software this bad?' and the general answer is 'because people have been trained to accept it'. In the same way that if the car was invented today it'd never surpass our current health&safety considerations. So I guess my point is, software is terrible in general, and security is just one aspect of many. As long as we don't have a better way to write it, it'll keep being bad. It's not fair to expect startups to set a higher standard, when they're optimising along several other dimensions at the same time.
- onedev 13y ago
  Yup, though I am an early adopter I am definitely less willing to just hand over my data to a random startup recently than I have in the past.
- theboss 13y ago
  You're right that it is a luxury but you are wrong that it is unfair to expect startups to set a higher standard. Startups have fewer assets than big companies. If you can't secure 1 webserver or you have a security breach with only 3 employees, there is something seriously wrong. If you expect to one day have 10,000 servers you better believe I expect you to be able to handle 3 or 5 or 10 by yourself.
  - memset 13y ago
    How, or where, does one learn how to implement a secure application (say, nginx + uwsgi + python + mongodb)? This is a serious question - the best that I'm aware of are blog posts, but every time someone writes a post about security, HN comments (et al) give contradictory advice.
    - deleted 13y ago
      [deleted]
    - theboss 13y ago
      things like nginx and apache are quite secure out of the box. There are three or four main things you need to do for your architecture though. 1) Change default passwords. You might be surprised how often I am able to get in with root toor or root no password. Mysql? Remember to change the root password (because there is none by default) 2) Learn OWASP top 10 and write good code. They have code RIGHT ON THE SITE for how to write a better more secure web-app. There aren't a whole lot of sites out there that make it hard to break their web-app 3)Keep your stuff updated. There was a apache php 0day today. You better believe everyone needs to update their services. 4) Disable extra services you don't need. Telnet, FTP, 53, 445, the list is long depending on what you're running. IF you don't need it, disable it. Don't set a firewall in front of it and call it secure, disable it. To top it off. 5) 2 factor your ssh (and make sure you're using ssh2 always.) if you don't have a VPN set up. Make it so an attacker needs the key and your password. If you do this minimal stuff you should be fairly secure. edit: Securing particular services takes a lot of experience and knowledge about the service. nginx, apache, etc. To do special things to it you need expertise. This is why out of the box, nginx and apache run with low privileges and are fairly secure.
- trimbo 13y ago
  > Some times taking more time (and/or better coders) to do something 'right' vs. just hacking it together is the difference between failure and success Maybe it's high time we start taking "not screwing over your customers" into account when considering what makes a success.
- orblivion 13y ago
  And yet companies do take a lot of care when it comes to design and usability. This tells me that if customers were to be more aware and security conscious, everything would fall into place. Startups would cut corners there no more than they do with usability. Right now there's a perverse incentive, if they do the right thing, they fall behind the competition. But if the competition has to do it, it's not a problem.
nfoz 13y ago
Capitalism often presents a choice between aggressively building unsafe products, or losing out to the competition. It's extremely hard to win in a fast market by being stable, secure, and correct, at least when it comes to software.
- theboss 13y ago
  Capitalism will also say that I'm most likely to succeed if I can do all three.
  - lttlrck 13y ago
    Does it really?
morgante 13y ago
> Not that mongo is bad or anything this is just a good time to say it. To be clear, this breach had absolutely nothing to do with Mongo. It occurred via a web interface which could've been put in front of any hosted database.

by theboss 13y ago

alexandros 13y ago

Some times taking more time (and/or better coders) to do something 'right' vs. just hacking it together is the difference between failure and success. So from an individual startup's POV this may not be worth doing. Having enough users/success to warrant a security breach is a luxury problem when viewed from the eyes of an entrepreneur with no product. On the other hand, collectively, startups losing everyone's credentials/data are burning the commons wrt people's willingness to use new products. But then on hand #3, it's not as if BigCo's have a much better record, so I guess this gets chalked up to the general 'why in the world do we release software this bad?' and the general answer is 'because people have been trained to accept it'. In the same way that if the car was invented today it'd never surpass our current health&safety considerations. So I guess my point is, software is terrible in general, and security is just one aspect of many. As long as we don't have a better way to write it, it'll keep being bad. It's not fair to expect startups to set a higher standard, when they're optimising along several other dimensions at the same time.

onedev 13y ago
Yup, though I am an early adopter I am definitely less willing to just hand over my data to a random startup recently than I have in the past.
theboss 13y ago
You're right that it is a luxury but you are wrong that it is unfair to expect startups to set a higher standard. Startups have fewer assets than big companies. If you can't secure 1 webserver or you have a security breach with only 3 employees, there is something seriously wrong. If you expect to one day have 10,000 servers you better believe I expect you to be able to handle 3 or 5 or 10 by yourself.
- memset 13y ago
  How, or where, does one learn how to implement a secure application (say, nginx + uwsgi + python + mongodb)? This is a serious question - the best that I'm aware of are blog posts, but every time someone writes a post about security, HN comments (et al) give contradictory advice.
  - deleted 13y ago
    [deleted]
  - theboss 13y ago
    things like nginx and apache are quite secure out of the box. There are three or four main things you need to do for your architecture though. 1) Change default passwords. You might be surprised how often I am able to get in with root toor or root no password. Mysql? Remember to change the root password (because there is none by default) 2) Learn OWASP top 10 and write good code. They have code RIGHT ON THE SITE for how to write a better more secure web-app. There aren't a whole lot of sites out there that make it hard to break their web-app 3)Keep your stuff updated. There was a apache php 0day today. You better believe everyone needs to update their services. 4) Disable extra services you don't need. Telnet, FTP, 53, 445, the list is long depending on what you're running. IF you don't need it, disable it. Don't set a firewall in front of it and call it secure, disable it. To top it off. 5) 2 factor your ssh (and make sure you're using ssh2 always.) if you don't have a VPN set up. Make it so an attacker needs the key and your password. If you do this minimal stuff you should be fairly secure. edit: Securing particular services takes a lot of experience and knowledge about the service. nginx, apache, etc. To do special things to it you need expertise. This is why out of the box, nginx and apache run with low privileges and are fairly secure.
trimbo 13y ago
> Some times taking more time (and/or better coders) to do something 'right' vs. just hacking it together is the difference between failure and success Maybe it's high time we start taking "not screwing over your customers" into account when considering what makes a success.
orblivion 13y ago
And yet companies do take a lot of care when it comes to design and usability. This tells me that if customers were to be more aware and security conscious, everything would fall into place. Startups would cut corners there no more than they do with usability. Right now there's a perverse incentive, if they do the right thing, they fall behind the competition. But if the competition has to do it, it's not a problem.

nfoz 13y ago

Capitalism often presents a choice between aggressively building unsafe products, or losing out to the competition. It's extremely hard to win in a fast market by being stable, secure, and correct, at least when it comes to software.

theboss 13y ago
Capitalism will also say that I'm most likely to succeed if I can do all three.
- lttlrck 13y ago
  Does it really?

morgante 13y ago

> Not that mongo is bad or anything this is just a good time to say it. To be clear, this breach had absolutely nothing to do with Mongo. It occurred via a web interface which could've been put in front of any hosted database.