4 ms·

You're right that it is a luxury but you are wrong that it is unfair to expect startups to set a higher standard. Startups have fewer assets than big companies

by theboss 13y ago

You're right that it is a luxury but you are wrong that it is unfair to expect startups to set a higher standard. Startups have fewer assets than big companies. If you can't secure 1 webserver or you have a security breach with only 3 employees, there is something seriously wrong. If you expect to one day have 10,000 servers you better believe I expect you to be able to handle 3 or 5 or 10 by yourself.

memset 13y ago
How, or where, does one learn how to implement a secure application (say, nginx + uwsgi + python + mongodb)? This is a serious question - the best that I'm aware of are blog posts, but every time someone writes a post about security, HN comments (et al) give contradictory advice.
- deleted 13y ago
  [deleted]
- theboss 13y ago
  things like nginx and apache are quite secure out of the box. There are three or four main things you need to do for your architecture though. 1) Change default passwords. You might be surprised how often I am able to get in with root toor or root no password. Mysql? Remember to change the root password (because there is none by default) 2) Learn OWASP top 10 and write good code. They have code RIGHT ON THE SITE for how to write a better more secure web-app. There aren't a whole lot of sites out there that make it hard to break their web-app 3)Keep your stuff updated. There was a apache php 0day today. You better believe everyone needs to update their services. 4) Disable extra services you don't need. Telnet, FTP, 53, 445, the list is long depending on what you're running. IF you don't need it, disable it. Don't set a firewall in front of it and call it secure, disable it. To top it off. 5) 2 factor your ssh (and make sure you're using ssh2 always.) if you don't have a VPN set up. Make it so an attacker needs the key and your password. If you do this minimal stuff you should be fairly secure. edit: Securing particular services takes a lot of experience and knowledge about the service. nginx, apache, etc. To do special things to it you need expertise. This is why out of the box, nginx and apache run with low privileges and are fairly secure.

by theboss 13y ago

memset 13y ago

How, or where, does one learn how to implement a secure application (say, nginx + uwsgi + python + mongodb)? This is a serious question - the best that I'm aware of are blog posts, but every time someone writes a post about security, HN comments (et al) give contradictory advice.

deleted 13y ago
[deleted]
theboss 13y ago
things like nginx and apache are quite secure out of the box. There are three or four main things you need to do for your architecture though. 1) Change default passwords. You might be surprised how often I am able to get in with root toor or root no password. Mysql? Remember to change the root password (because there is none by default) 2) Learn OWASP top 10 and write good code. They have code RIGHT ON THE SITE for how to write a better more secure web-app. There aren't a whole lot of sites out there that make it hard to break their web-app 3)Keep your stuff updated. There was a apache php 0day today. You better believe everyone needs to update their services. 4) Disable extra services you don't need. Telnet, FTP, 53, 445, the list is long depending on what you're running. IF you don't need it, disable it. Don't set a firewall in front of it and call it secure, disable it. To top it off. 5) 2 factor your ssh (and make sure you're using ssh2 always.) if you don't have a VPN set up. Make it so an attacker needs the key and your password. If you do this minimal stuff you should be fairly secure. edit: Securing particular services takes a lot of experience and knowledge about the service. nginx, apache, etc. To do special things to it you need expertise. This is why out of the box, nginx and apache run with low privileges and are fairly secure.