3 ms·
Look for building the full stacks of the app from the really down ground up. Any cloud hosting will be vulnerable. If you can provide powerful in-house infrastr
by sgy 13y ago
Look for building the full stacks of the app from the really down ground up. Any cloud hosting will be vulnerable.
If you can provide powerful in-house infrastructure and platform, you're good to go.
You might end up inventing a new security protocol, which is an interestingly big deal (http://ycombinator.com/rfs3.html http://ycombinator.com/rfs3.html) .
- fabulist 13y agoI agree that cloud hosting opens up many new vectors of attack, but I completely disagree about building the app from the ground up. The larger your app is, the less likely it is to be secure. A better strategy is to keep your app lean and mean, and build it off of existing security technologies which have proven to be reliable. But as we've seen with Heartbleed, some of your security measures will fail. Its important to follow the principle of least privileged, and to isolate your system as much as possible; for instance, Colin Percival uses stunnel to isolate OpenSSL from his webserver[1]. This solution is far from perfect, and it still puts your private key at risk in a Heartbleed-like event. But that majority of your user's data is kept away from OpenSSL; it limits your exposure. [1] http://www.daemonology.net/blog/2009-09-28-securing-https.html http://www.daemonology.net/blog/2009-09-28-securing-https.ht...