4 ms·

Many people suggest that startups not over-optimize on issues like security and performance when it's not their core business. And that's a fucking stupid thin

Many people suggest that startups not over-optimize on issues like security and performance when it's not their core business. And that's a fucking stupid thing to say in those cases, so it's a fucking stupid thing to say here. Things like security and performance should be given. This is akin to arguing that small restaurants shouldn't care about food safety, or that small construction firms shouldn't worry about building codes. If you ignore these things, you'll fuck it up and people will get hurt.

jdimov 12y ago
When it comes to start-ups it's not stupid - it's wise. The food safety analogy is inappropriate. Security is about risk management. Low risks do not justify high expenses. When it comes to a company with hundreds of millions in revenues, however, they have clearly underestimated the risks and have been irresponsible.
- phySi0 12y ago
  I would say even the food safety analogy is appropriate. Sure, food safety is important; that doesn't mean you have to spend hundreds of millions of pounds in "food safety researchers" who will conduct rigorous scientific experiments to find out the best ways to limit the spread of germs and implement them, an in-house doctor with medical supplies who will treat customers that get food poisoning, etc. It just means there's a minimum, a bar, that they shouldn't go below. Everyone has a different bar, but most people generally agree on things like don't pick up food off the floor, don't leave things open or out, put things in the right places, make sure you wash your hands, etc. (I am not a food safety expert). Of course, for a startup, it depends on the product or service they're offering. A startup payment processor should be very security conscious, as the stakes are high. A movie logger should have the bare minimum that all startups should have, i.e. strong encryption, basic security protocols, etc.
  - atmosx 12y ago
    > I would say even the food safety analogy is appropriate. I think it's NOT appropriate. Of course, in the end, it's a matter of value: Do you value your health equally with your digital privacy, your money, etc.? If 'yes' then the analogy yes, if 'no' then it doesn't. I don't so, to me, it doesn't.
    - TillE 12y ago
      Analogies are not meant to be precisely equivalent in every respect. They're just a tool to illustrate a certain point.
      - benmcnelly 12y ago
        Oh so like, Analogies are like butterflies! Not everyone understands them, and sometimes people who do still miss the point of them.
        ethbro 12y ago
        Analogies are exactly like butterflies. Someone uses one once, and it causes a hurricane in a different comment thread. ;)
- deleted 12y ago
  [deleted]
- geon 12y ago
  You are assuming that the risk is only to the company, not it's customers.
- sarciszewski 12y ago
  > Low risks do not justify high expenses. What is the expense associated with, for example, not concatenating user-supplied input in SQL queries?
  - Ded7xSEoPKYNsDd 12y ago
    I don't know, what does a low-skill developer who doesn't know better cost compared to someone actually qualified for the job?
    - sarciszewski 12y ago
      At my previous job, I made $25k less per year than the idiot who nearly exposed us to RFI risks before I looked over his code. Developers are developers. If you're going out of your way to hire extremely untalented people, because they're cheap, you're going to get owned. If you're hiring people who understand their own craft, you can get a junior developer for under $70k and a senior for under $100k. Unless you're in SF in which case multiply everything by 2 or 3.
- Justsignedup 12y ago
  A better analogy: A start up is like a restaurant with 2 doors into the kitchen. 1 door from the outside, 1 door for servers to enter/exit. In a restaurant the workers can easily spot problems. And if someone walks in usually you kick them out, or lose a batch of food. The cost is much smaller than hiring 2 full-time bouncers. If, however, you now have a giant catering hall with 50 entrances to the kitchen and hundreds of people there, security / bouncers are necessary. The problem is how to go from one to the other, and not realize you need security when it is too late.
dasil003 12y ago
You're acting like there are no tradeoffs for these things. There are always tradeoffs.
- matthewmacleod 12y ago
  Yes, there are. You can over-invest into security and performance. That doesn't mean that should shouldn't meet a competent standard!
  - snowwrestler 12y ago
    Did Sony fail to meet a competent standard? The fact that they got hacked is not sufficient proof they failed that standard. "Competent" does not mean invulnerable.
    - stouset 12y ago
      The exfiltration of 100TB of data from systems across their entire organization suggests so. On a 100Mbit/s pipe that would take something like 3 months of full saturation to get that amount of data out. Realistically, we're probably talking about a hack spanning nearly every one of their systems for upwards of a year.
tomp 12y ago
> Things like security and performance should be given. This is akin to arguing that small restaurants shouldn't care about food safety, or that small construction firms shouldn't worry about building codes. No, it's completely different. Food safety and building codes is akin to good software engineering; on the other hand, security against hacks is more like a restaurant protecting you from a third party poisoning your food, or a building withstanding planes crashing into it. Most building and most restaurants don't offer such protection.
- adventured 12y ago
  If we're talking about security and a small restaurant, it would be more like the restaurant never bothering to lock its doors after hours, having no security cameras, and not bothering to put its money in a safe place, leaving it out in the open to be stolen.
deleted 12y ago
[deleted]
WorldWideWayne 12y ago
Firstly - What's with the fucking attitude? Secondly - Did you see the words over optimize? There is certainly such a thing as too much optimization in terms of security. Would you hire police men to patrol your kid's lemonade stand startup? No.
- akshatpradhan 12y ago
  Yeah but this was clearly UNDER optimized for the security of 100 TB of SSNs, Salaries, and Movies leaked. All of which is classified as sensitive (i.e. anything that can be considered a financial loss to the business).
  - blhack 12y ago
    Think about who would have access to: 1) 100Tb of storage on presumably short notice 2) The bandwidth required to move all of that before sony noticed This [likely] wasn't some script kiddie that exploited some obvious security hole. Of course their security was under optimized. Every single theft in the history of time has been a result of "under optimized" security. Ocean's 11 is about "under optimized" security.
    - skorgu 12y ago
      Figure a hacking group is a dozen people. That's ~8.3T per person to stash. I know plenty of folks with that kind of storage lying around, it doesn't seem insane that folks deep in infosec might have even more idle capacity. Alternatively the first newegg hit for a 6T hard drive is $300 even. That's 17 of them so $5k plus shipping. Either add in a chassis with enough slots or enough smaller machines to distribute it so say double to $10k or less than $1k per person. Or even lazier, to store all 100T on S3 for a month and pull it back out is ~$12k, again maybe plus a bit for an EC2 instance to do the shuffling. Again, ~$1k per person. And of course if you're a hacking group the chances that you've got root on some small business servers scattered around the world are probably a bit better than zero.
dcole2929 12y ago
this entire thread of conversations is a joke. Do you know more about this breach than what was written in the article because they clearly state they don't know exactly what happened. Which isn't to say that Sony doesn't know more but from details released how can you know anything about what Sony does or doesn't do security wise that they should have been? Like literally the first rule of Security is that as the person trying to defend, protect, secure something you are always at a disadvantage. Of course Sony has money to hire top notch Security Engineers to protect their interests and I'm sure they do but like anyone else they can be beat. This is all not even accounting for the security black hole that is user idiocy, or the fact that the article makes several references to potential inside help. In short Sony's past exploits don't give them a ton of credit but it's also a bit ridiculous to go from they could have done better to where this whole thread went.
- matthewmacleod 12y ago
  * Of course Sony has money to hire top notch Security Engineers to protect their interests and I'm sure they do but like anyone else they can be beat.* Maybe they do; I don't know. That's not really relevant to the point which I'm making, which is more along the lines of: "Disregarding security as a startup because it's not a 'core competency' is ill-advised. History suggests that you're likely to be compromised, and it causes harm not only to your business, but also to your users, and is absolutely irresponsible."

jdimov 12y ago

When it comes to start-ups it's not stupid - it's wise. The food safety analogy is inappropriate. Security is about risk management. Low risks do not justify high expenses. When it comes to a company with hundreds of millions in revenues, however, they have clearly underestimated the risks and have been irresponsible.

phySi0 12y ago
I would say even the food safety analogy is appropriate. Sure, food safety is important; that doesn't mean you have to spend hundreds of millions of pounds in "food safety researchers" who will conduct rigorous scientific experiments to find out the best ways to limit the spread of germs and implement them, an in-house doctor with medical supplies who will treat customers that get food poisoning, etc. It just means there's a minimum, a bar, that they shouldn't go below. Everyone has a different bar, but most people generally agree on things like don't pick up food off the floor, don't leave things open or out, put things in the right places, make sure you wash your hands, etc. (I am not a food safety expert). Of course, for a startup, it depends on the product or service they're offering. A startup payment processor should be very security conscious, as the stakes are high. A movie logger should have the bare minimum that all startups should have, i.e. strong encryption, basic security protocols, etc.
- atmosx 12y ago
  > I would say even the food safety analogy is appropriate. I think it's NOT appropriate. Of course, in the end, it's a matter of value: Do you value your health equally with your digital privacy, your money, etc.? If 'yes' then the analogy yes, if 'no' then it doesn't. I don't so, to me, it doesn't.
  - TillE 12y ago
    Analogies are not meant to be precisely equivalent in every respect. They're just a tool to illustrate a certain point.
    - benmcnelly 12y ago
      Oh so like, Analogies are like butterflies! Not everyone understands them, and sometimes people who do still miss the point of them.
      - ethbro 12y ago
        Analogies are exactly like butterflies. Someone uses one once, and it causes a hurricane in a different comment thread. ;)
deleted 12y ago
[deleted]
geon 12y ago
You are assuming that the risk is only to the company, not it's customers.
sarciszewski 12y ago
> Low risks do not justify high expenses. What is the expense associated with, for example, not concatenating user-supplied input in SQL queries?
- Ded7xSEoPKYNsDd 12y ago
  I don't know, what does a low-skill developer who doesn't know better cost compared to someone actually qualified for the job?
  - sarciszewski 12y ago
    At my previous job, I made $25k less per year than the idiot who nearly exposed us to RFI risks before I looked over his code. Developers are developers. If you're going out of your way to hire extremely untalented people, because they're cheap, you're going to get owned. If you're hiring people who understand their own craft, you can get a junior developer for under $70k and a senior for under $100k. Unless you're in SF in which case multiply everything by 2 or 3.
Justsignedup 12y ago
A better analogy: A start up is like a restaurant with 2 doors into the kitchen. 1 door from the outside, 1 door for servers to enter/exit. In a restaurant the workers can easily spot problems. And if someone walks in usually you kick them out, or lose a batch of food. The cost is much smaller than hiring 2 full-time bouncers. If, however, you now have a giant catering hall with 50 entrances to the kitchen and hundreds of people there, security / bouncers are necessary. The problem is how to go from one to the other, and not realize you need security when it is too late.

dasil003 12y ago

You're acting like there are no tradeoffs for these things. There are always tradeoffs.

matthewmacleod 12y ago
Yes, there are. You can over-invest into security and performance. That doesn't mean that should shouldn't meet a competent standard!
- snowwrestler 12y ago
  Did Sony fail to meet a competent standard? The fact that they got hacked is not sufficient proof they failed that standard. "Competent" does not mean invulnerable.
  - stouset 12y ago
    The exfiltration of 100TB of data from systems across their entire organization suggests so. On a 100Mbit/s pipe that would take something like 3 months of full saturation to get that amount of data out. Realistically, we're probably talking about a hack spanning nearly every one of their systems for upwards of a year.

tomp 12y ago

> Things like security and performance should be given. This is akin to arguing that small restaurants shouldn't care about food safety, or that small construction firms shouldn't worry about building codes. No, it's completely different. Food safety and building codes is akin to good software engineering; on the other hand, security against hacks is more like a restaurant protecting you from a third party poisoning your food, or a building withstanding planes crashing into it. Most building and most restaurants don't offer such protection.

adventured 12y ago
If we're talking about security and a small restaurant, it would be more like the restaurant never bothering to lock its doors after hours, having no security cameras, and not bothering to put its money in a safe place, leaving it out in the open to be stolen.

deleted 12y ago

[deleted]

WorldWideWayne 12y ago

Firstly - What's with the fucking attitude? Secondly - Did you see the words over optimize? There is certainly such a thing as too much optimization in terms of security. Would you hire police men to patrol your kid's lemonade stand startup? No.

akshatpradhan 12y ago
Yeah but this was clearly UNDER optimized for the security of 100 TB of SSNs, Salaries, and Movies leaked. All of which is classified as sensitive (i.e. anything that can be considered a financial loss to the business).
- blhack 12y ago
  Think about who would have access to: 1) 100Tb of storage on presumably short notice 2) The bandwidth required to move all of that before sony noticed This [likely] wasn't some script kiddie that exploited some obvious security hole. Of course their security was under optimized. Every single theft in the history of time has been a result of "under optimized" security. Ocean's 11 is about "under optimized" security.
  - skorgu 12y ago
    Figure a hacking group is a dozen people. That's ~8.3T per person to stash. I know plenty of folks with that kind of storage lying around, it doesn't seem insane that folks deep in infosec might have even more idle capacity. Alternatively the first newegg hit for a 6T hard drive is $300 even. That's 17 of them so $5k plus shipping. Either add in a chassis with enough slots or enough smaller machines to distribute it so say double to $10k or less than $1k per person. Or even lazier, to store all 100T on S3 for a month and pull it back out is ~$12k, again maybe plus a bit for an EC2 instance to do the shuffling. Again, ~$1k per person. And of course if you're a hacking group the chances that you've got root on some small business servers scattered around the world are probably a bit better than zero.

dcole2929 12y ago

this entire thread of conversations is a joke. Do you know more about this breach than what was written in the article because they clearly state they don't know exactly what happened. Which isn't to say that Sony doesn't know more but from details released how can you know anything about what Sony does or doesn't do security wise that they should have been? Like literally the first rule of Security is that as the person trying to defend, protect, secure something you are always at a disadvantage. Of course Sony has money to hire top notch Security Engineers to protect their interests and I'm sure they do but like anyone else they can be beat. This is all not even accounting for the security black hole that is user idiocy, or the fact that the article makes several references to potential inside help. In short Sony's past exploits don't give them a ton of credit but it's also a bit ridiculous to go from they could have done better to where this whole thread went.

matthewmacleod 12y ago
* Of course Sony has money to hire top notch Security Engineers to protect their interests and I'm sure they do but like anyone else they can be beat.* Maybe they do; I don't know. That's not really relevant to the point which I'm making, which is more along the lines of: "Disregarding security as a startup because it's not a 'core competency' is ill-advised. History suggests that you're likely to be compromised, and it causes harm not only to your business, but also to your users, and is absolutely irresponsible."