5 ms·

> The decision to no longer store any private/personal information in no way reflects a lack in confidence of the steps we have taken to make the new website se

by jonahx 12y ago

> The decision to no longer store any private/personal information in no way reflects a lack in confidence of the steps we have taken to make the new website secure, but if history teaches us one thing it is that for every "unsinkable" Titanic built there will always be icebergs. I love PE and I don't intend this question snarkily at all, but am genuinely curious why securing a database of emails for a site as simple as PE would be such a perilous problem? I know security in general is always more difficult that it appears, but in this case I would have thought we were dealing with a solved problem. I'd love to hear about why my assumptions are wrong.

michaelmior 12y ago
Unfortunately security is never a solved problem as there are always new attack vectors beings discovered. I think the statement just reflects their desire to take zero risk. The only way to do so is to avoid storing this information entirely.
Kenji 12y ago
Security is never a 'solved problem'. There is always a trade-off between usability, performance and security. Think of it this way: You run a server on hardware that no single human understands fully. On top of that, you have some devices for which pretty much the same applies. On top of that you have an operating system consisting of millions of lines of code, and again, nobody can fully grasp everything. On top of that, you have your webstack which adds even more complexity. You are hooked up 24/7 to a network filled with criminals. Security is not just intrusion prevention, it's also detection and recovery. PE chose to reduce the negative effects of a successful intrusion.
Igglyboo 12y ago
I'd have to agree, PE isn't a huge website and it isn't really storing sensitive data. I don't see why they're acting like it's impossible to secure their data.
parennoob 12y ago
The problem is clearly not simple enough that you can, say, show us a CLI two-liner which will deploy a database and frontend that are unbreakable. Ergo, I find it quite plausible that people who are doing this in their spare time chose to avoid this task.
rmc 12y ago
Keep It Simple. Not storing personal information now removes a whole class of work you have to do. While you store personal information, you need to spend time keeping on top of security patches and issues. It means you need to worry about legal obligations. If you just don't store it, you don't have to worry about that. You need to spend less time per month maintaining the project. If you're a volunteer project, you might not have the time available to keep on top of it.

by jonahx 12y ago

michaelmior 12y ago

Unfortunately security is never a solved problem as there are always new attack vectors beings discovered. I think the statement just reflects their desire to take zero risk. The only way to do so is to avoid storing this information entirely.

Kenji 12y ago

Security is never a 'solved problem'. There is always a trade-off between usability, performance and security. Think of it this way: You run a server on hardware that no single human understands fully. On top of that, you have some devices for which pretty much the same applies. On top of that you have an operating system consisting of millions of lines of code, and again, nobody can fully grasp everything. On top of that, you have your webstack which adds even more complexity. You are hooked up 24/7 to a network filled with criminals. Security is not just intrusion prevention, it's also detection and recovery. PE chose to reduce the negative effects of a successful intrusion.

Igglyboo 12y ago

I'd have to agree, PE isn't a huge website and it isn't really storing sensitive data. I don't see why they're acting like it's impossible to secure their data.

parennoob 12y ago

The problem is clearly not simple enough that you can, say, show us a CLI two-liner which will deploy a database and frontend that are unbreakable. Ergo, I find it quite plausible that people who are doing this in their spare time chose to avoid this task.

rmc 12y ago

Keep It Simple. Not storing personal information now removes a whole class of work you have to do. While you store personal information, you need to spend time keeping on top of security patches and issues. It means you need to worry about legal obligations. If you just don't store it, you don't have to worry about that. You need to spend less time per month maintaining the project. If you're a volunteer project, you might not have the time available to keep on top of it.