4 ms·
"security" is always left for after-the-fact ---- exactly as evidenced by this disclosure and their poor in-house practices.
by jumby 13y ago
"security" is always left for after-the-fact ---- exactly as evidenced by this disclosure and their poor in-house practices.
- deleted 13y ago[deleted]
- enko 13y agoWhile I can see your point of view, and the grandparent's, let's be fair. These are startups in a rapidly evolving, highly competitive marketplace and they have limited resources. If they spent months triple checking every dotted i and crossed t they might never even launch, and there'd be no company. Like everything in software it's about tradeoffs. Maybe they erred a little too far on one side of the curve, so let's learn from that. But it's unfair to expect startups to be in the same league as banks security-wise. Do you have any idea how much a good pentest costs?
- jumby 13y agoI reject the tradeoff that your internal customer support 'impersonate user' web app would be available via simple password on the open internet.