4 ms·

Yeah... sorry for that.. We will fix it on Monday also HTTPS. It's not good, but we tried to open product faster!

by lastbackend 12y ago

lclarkmichalek 12y ago
Fair enough. Regardless, congrats on the release.
subway 12y ago
Security should not be an afterthought. Especially not when you're trying to get me to trust my data to your platform.
- lastbackend 12y ago
  You are right. But you can play with our platform this weekends, and on next week we'll opening agent to open-source and enable security. We have some delay with SSL delivery. :(
  - antocv 12y ago
    I, for one, aint playin with anything you build. You aint coming close to having sudo on any of my machines if I can help it. This shit with "enable security" as after-thought has to stop.
    - deleted 12y ago
      [deleted]
    - meddlepal 12y ago
      I agree. Basically makes me distrust the whole thing inside and out; who knows what other bs engineering practices were used in non visible parts of the stack? Shipping is great, but please don't ship insecure stuff as a product you want customers to use. Please.
      - lastbackend 12y ago
        We are enabled HTTPS. THX for your comments. Next: installer update. Give us few minutes.
        meddlepal 12y ago
        Great. Glad to see you're taking this seriously and hopefully it is a good lesson learned for the future!
        pauloschilling 12y ago
        Here: https://www.ssllabs.com/ssltest/analyze.html?d=app.lastbackend.com https://www.ssllabs.com/ssltest/analyze.html?d=app.lastbacke... Overall Rating: C This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. Grade capped to C.
  - tpg 12y ago
    When I see security as a second-class citizen on user-visible elements, I assume that the same philosophy was applied on the parts I can't audit, even after the front-end stuff was fixed.
    - deleted 12y ago
      [deleted]
  - runlevel1 12y ago
    Just get a free cert from StartSSL while you wait for your other cert to go through. It's better than nothing. Asking people on HN to send their passwords in the clear is suicide.
tlrobinson 12y ago
That attitude might work for a social network for cats, but it's not going to fly if you're asking users to trust you with their production servers.
giovannibonetti 12y ago
You can get HTTPS for free (and hassle-free) if you use Cloudflare as your DNS server. Disclaimer: I am doing this publicity as a happy customer, without earning anything in return.
- tokenizerrr 12y ago
  It's a bit more than DNS. It's sending all of your traffic through cloudflare, and they cache content/act as a CDN. But they can theoretically inspect/modify all traffic.

Yeah... sorry for that.. We will fix it on Monday also HTTPS. It's not good, but we tried to open product faster!

lclarkmichalek 12y ago

Fair enough. Regardless, congrats on the release.

subway 12y ago

Security should not be an afterthought. Especially not when you're trying to get me to trust my data to your platform.

lastbackend 12y ago
You are right. But you can play with our platform this weekends, and on next week we'll opening agent to open-source and enable security. We have some delay with SSL delivery. :(
- antocv 12y ago
  I, for one, aint playin with anything you build. You aint coming close to having sudo on any of my machines if I can help it. This shit with "enable security" as after-thought has to stop.
  - deleted 12y ago
    [deleted]
  - meddlepal 12y ago
    I agree. Basically makes me distrust the whole thing inside and out; who knows what other bs engineering practices were used in non visible parts of the stack? Shipping is great, but please don't ship insecure stuff as a product you want customers to use. Please.
    - lastbackend 12y ago
      We are enabled HTTPS. THX for your comments. Next: installer update. Give us few minutes.
      - meddlepal 12y ago
        Great. Glad to see you're taking this seriously and hopefully it is a good lesson learned for the future!
      - pauloschilling 12y ago
        Here: https://www.ssllabs.com/ssltest/analyze.html?d=app.lastbackend.com https://www.ssllabs.com/ssltest/analyze.html?d=app.lastbacke... Overall Rating: C This server is vulnerable to the POODLE attack. If possible, disable SSL 3 to mitigate. Grade capped to C.
- tpg 12y ago
  When I see security as a second-class citizen on user-visible elements, I assume that the same philosophy was applied on the parts I can't audit, even after the front-end stuff was fixed.
  - deleted 12y ago
    [deleted]
- runlevel1 12y ago
  Just get a free cert from StartSSL while you wait for your other cert to go through. It's better than nothing. Asking people on HN to send their passwords in the clear is suicide.

tlrobinson 12y ago

That attitude might work for a social network for cats, but it's not going to fly if you're asking users to trust you with their production servers.

giovannibonetti 12y ago

You can get HTTPS for free (and hassle-free) if you use Cloudflare as your DNS server. Disclaimer: I am doing this publicity as a happy customer, without earning anything in return.

tokenizerrr 12y ago
It's a bit more than DNS. It's sending all of your traffic through cloudflare, and they cache content/act as a CDN. But they can theoretically inspect/modify all traffic.