3 ms·
These sound like really basic security measures any startup that isn't about sharing cat pictures should take. I disagree completely with the strategy of using
by gizmo 13y ago
These sound like really basic security measures any startup that isn't about sharing cat pictures should take. I disagree completely with the strategy of using security@ as a cheap way to get other people to do your homework. When somebody finds an XSS flaw in your system that's a big deal! It can be easily used to take over entire accounts. Not something you shrug at and put on your TODO list until a new XSS error is found 2 minutes later. Besides, good abstractions deal with XSS problems nearly completely, so that vulnerable code looks wrong.
I also find the view that smaller startups should just get a product out the door and neglect security completely abhorrent. Waiting until you're at 10 employees before you start hashing passwords? Are you kidding me? Are we professionals or what?
So based on those observations my confidence in the security of Evernote has decreased substantially. Their philosophy represents much of what's wrong with VC-style startups. Imagine a restaurant saying "just forget about hygiene until you're profitable"!
- bowlofpetunias 13y agoThank you. My first reaction was: start by firing the first 3 employees who couldn't be arsed to encrypt passwords, and replace them with people you can trust. Being aware of the current best practices in password encryption is part of your job. Checking if your knowledge is still up to date takes 30 minutes, tops. Implementing it in your stack of choice, provided you've made a sane choice to start with, is trivial. Hell, you can probably just cut and paste from one of the articles you've found in the aforementioned 30 minutes. None of this will slow you down when getting the first alpha release out of the door.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- alberth 13y agoDon't underestimate the need to data protection Just look to this [1] example of hot trouble 37signals got themselves in 2 years ago. [1] http://37signals.com/svn/posts/3078-trust-is-fragile#all_comments http://37signals.com/svn/posts/3078-trust-is-fragile#all_com...
- eli 13y agoI took that more as a lesson about PR and public perception, but true enough that strict security could have prevented it.
- andrewb 13y agoI'm a regular user of Evernote and it certainly makes me reconsider that decision if that's the mentality of the CTO. Time to look into alternatives.