3 ms·

This is just some amateur hour shit. They're a well established and well funded company. How do venture funds not do better technical due diligence(or any at

This is just some amateur hour shit. They're a well established and well funded company. How do venture funds not do better technical due diligence(or any at all)? I wouldn't release an app for 32 of my friends to test, let alone 32 million people to use with plain text passwords. Enough of my bitching, because it's inaction. Now for words of action/openings for suggestion: How do we make sure companies don't do dumb things like this?

tptacek 17y ago
My answer to this question is effective but very self-serving.
- ephermata 17y ago
  Train our runtimes to detect and reject attempts to store user passwords in plaintext?
  - anigbrowl 17y ago
    I think the correct answer is 'hire tptacek' :)
    - tptacek 17y ago
      ^ people like
bootload 17y ago
"... How do venture funds not do better technical due diligence(or any at all)? ... How do we make sure companies don't do dumb things like this? ..." Because it's not seen by "management" or "VC's" as a priority. Extra programming is seen as a time and monetary cost, not a necessity. One company I worked for used plain-text for customer passwords and mandated Microsoft technology in the same breath. When I talked to the lead tech, I got a shrug. Not because of lack of technical smarts but politically tied hands from management. When I contacted the MBA minted CEO I got a blunt - "it's not a problem, don't worry about it". A physical loss is perceived more tangible than something ephemeral. Things did happen when people walking off the street stole "stuff" from the office. Swipe cards were quickly introduced. I'd broached such arrangements before the incident but that wasn't seen as a problem either.
- tptacek 17y ago
  The few times I've been through VC and acquirer due diligence, the actual technical depth to it was extremely minimal. They aren't validating your design; they're just determining whether you can actually build working stuff.
gojomo 17y ago
How do venture funds not do better technical due diligence(or any at all)? They trust people and credentials -- it's not about the technical details. There's a great chapter in Randall Stross's "EBoys" about TriStrata -- which raised millions based on essentially nonsense claims of an "unbreakable" encryption technology. (The chapter is excerpted at the bottom of this message: http://www.xent.com/FoRK-archive/april00/0460.html http://www.xent.com/FoRK-archive/april00/0460.html )

tptacek 17y ago

My answer to this question is effective but very self-serving.

ephermata 17y ago
Train our runtimes to detect and reject attempts to store user passwords in plaintext?
- anigbrowl 17y ago
  I think the correct answer is 'hire tptacek' :)
  - tptacek 17y ago
    ^ people like

bootload 17y ago

"... How do venture funds not do better technical due diligence(or any at all)? ... How do we make sure companies don't do dumb things like this? ..." Because it's not seen by "management" or "VC's" as a priority. Extra programming is seen as a time and monetary cost, not a necessity. One company I worked for used plain-text for customer passwords and mandated Microsoft technology in the same breath. When I talked to the lead tech, I got a shrug. Not because of lack of technical smarts but politically tied hands from management. When I contacted the MBA minted CEO I got a blunt - "it's not a problem, don't worry about it". A physical loss is perceived more tangible than something ephemeral. Things did happen when people walking off the street stole "stuff" from the office. Swipe cards were quickly introduced. I'd broached such arrangements before the incident but that wasn't seen as a problem either.

tptacek 17y ago
The few times I've been through VC and acquirer due diligence, the actual technical depth to it was extremely minimal. They aren't validating your design; they're just determining whether you can actually build working stuff.

gojomo 17y ago

How do venture funds not do better technical due diligence(or any at all)? They trust people and credentials -- it's not about the technical details. There's a great chapter in Randall Stross's "EBoys" about TriStrata -- which raised millions based on essentially nonsense claims of an "unbreakable" encryption technology. (The chapter is excerpted at the bottom of this message: http://www.xent.com/FoRK-archive/april00/0460.html http://www.xent.com/FoRK-archive/april00/0460.html )