3 ms·
This is the elephant in the room and I'm surprised it hasn't been mentioned by any of the other comments. When it comes to infrastructure as a service, it appe
by julian37 13y ago
This is the elephant in the room and I'm surprised it hasn't been mentioned by any of the other comments.
When it comes to infrastructure as a service, it appears to me that there is an imbalance between the sensitivity of information entrusted to external systems on one hand, and the standards such systems are held up to on the other.
EDIT: case in point, on http://mongohq.com http://mongohq.com I can't find a single mention of the word "security". The language is all about ease of use, performance, scalability, disaster recovery, and low cost, but as far as I can tell not a single word is spent on what procedures are in place to safeguard your data from unwanted access.
EDIT: removed inflammatory comment.
- jumby 13y ago"security" is always left for after-the-fact ---- exactly as evidenced by this disclosure and their poor in-house practices.
- deleted 13y ago[deleted]
- enko 13y agoWhile I can see your point of view, and the grandparent's, let's be fair. These are startups in a rapidly evolving, highly competitive marketplace and they have limited resources. If they spent months triple checking every dotted i and crossed t they might never even launch, and there'd be no company. Like everything in software it's about tradeoffs. Maybe they erred a little too far on one side of the curve, so let's learn from that. But it's unfair to expect startups to be in the same league as banks security-wise. Do you have any idea how much a good pentest costs?
- jumby 13y agoI reject the tradeoff that your internal customer support 'impersonate user' web app would be available via simple password on the open internet.