3 ms·

You are assuming that because the poster asked this question that they can't figure out how to keep their sever secure. The person is clearly making an effort t

You are assuming that because the poster asked this question that they can't figure out how to keep their sever secure. The person is clearly making an effort to learn how to secure a server and they came to a good place to start learning. I still do not feel they should hire someone because you came up with an example where trusted binaries were being hosted got hacked. It depends on the data. If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. You have to weigh what the worst case scenario hack would cost based on your data and decide if it is worth the money saved by doing it yourself. In my opinion, for many new SaaS bootstrap products, it is totally worth doing the security yourself. At least now the poster has multiple perspectives on the matter.

yeukhon 12y ago
> If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. Yes and no. Running a business is different. Sure it may be too early to hire someone right now, but not the worst thing to think of. If OP can secure funding, get someone who has good knowledge with system and security. It's important. I am jack-of-all-trade to many, but as a devops I can't do everything at once. > storing some web analytics and personal finance information Fair. My company's finance data would be under compliance regulation, but even as a SaaS to provide easy-access easy-to-understand web analytics means you are going to have access to customer's data, or the customer is passing you data that the customer doesn't wish to share with others. Take an analytic SaaS to see your AWS usage. That requires a separate READ-ONLY access to your AWS account. Twitter recently dropped employee access to internal data. People suggest this was done to avoid insider trading. I don't know if that was the real intent, but let's take that as a yes, then web analytic is just sensitive as one's financial information. Security is not easy, just like writing code is not easy. I am suggesting OP to do some security audit before the launch. If OP ever hire someone to join the startup, try to secure a seat for someone good at security. FYI, I did some whitehat for some startup and had found numerous serious security bugs (no I am not here for hire, no time and definitely NOT as good as others, and I am 100% happy with my current job...). Just my genuine advice: don't just focus on features :)

yeukhon 12y ago

> If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. Yes and no. Running a business is different. Sure it may be too early to hire someone right now, but not the worst thing to think of. If OP can secure funding, get someone who has good knowledge with system and security. It's important. I am jack-of-all-trade to many, but as a devops I can't do everything at once. > storing some web analytics and personal finance information Fair. My company's finance data would be under compliance regulation, but even as a SaaS to provide easy-access easy-to-understand web analytics means you are going to have access to customer's data, or the customer is passing you data that the customer doesn't wish to share with others. Take an analytic SaaS to see your AWS usage. That requires a separate READ-ONLY access to your AWS account. Twitter recently dropped employee access to internal data. People suggest this was done to avoid insider trading. I don't know if that was the real intent, but let's take that as a yes, then web analytic is just sensitive as one's financial information. Security is not easy, just like writing code is not easy. I am suggesting OP to do some security audit before the launch. If OP ever hire someone to join the startup, try to secure a seat for someone good at security. FYI, I did some whitehat for some startup and had found numerous serious security bugs (no I am not here for hire, no time and definitely NOT as good as others, and I am 100% happy with my current job...). Just my genuine advice: don't just focus on features :)