Comment by gxs | Hacker News Reader

Comment by gxs | Hacker News Reader

Throughtout my career the interesting thing about the level of scrutiny the "cloud" receives is that people rarely ever applied that scrutiny to themselves.

Is it secure? Hm..I'm sure Salesforce does more work around security than the vast majority of their customers would even be capable on their own.

Similarly, these types of catastrophic events will happen and I am just as confident in saying that Salesforce was able to diagnose and fix this problem better than the vast majority of their customers would have been able to do on their own systems. I've seen JIRA on prem go down several times.

I've worked building enterprise applications my entire career. Unless you have an extremely lean and engineering oriented organization, it's almost always better to buy than to build in house. There are exceptions, but for the most part this holds.

Having said all that, every single place that I've worked at has had it's own data lake/warehouse and having your own backup of your data is critical.

> I'm sure Salesforce does more work around security than the vast majority of their customers would even be capable on their own

This is a fallacy that people like to believe because they are not doing the work themselves. The fact is SalesForce hires the same type of developer/admin that any company would hire and that person is trying to do their best like everyone else. Because it's behind a curtain people feel its more secure, when in reality it's probably the same level of competence/incompetence that anyone can do hosted on-prem.

I understand what you're saying, but most companies (not all) don't have dedicated staff to this sort of thing.

They usually take other precautions like VPNs, etc.

I'm not saying it's perfect, but for MOST people, this is a better alternative.

Does that make sense? If companies made a concerted effort to hire for this and take it seriously, it makes sense. But large enterprise customers with the resources to do this aren't the majority of saleforce users.

But giving this service is the main product of salesforce, therefore intrinsic quality measures (like security) are more important to their management (for their well understood need for customer trust), than if you were developing an in-house product.

In the latter case intrinsic quality of a biproduct of your operation would not matter to your management, because they primarily think in order to give the best quality to the customers of the company's product, and the intrinsic quality of that product matters to them (eg. to use BPA free materials for the rubber ducks they manufacture). This is why they will feel spending on security of the in-house development unjustified, until a major security breach happens.

> therefore intrinsic quality measures (like security) are more important to their management

Right, I agree, but just because it is important doesn't mean they are good at it. And there is the fact that there is now likely 1 or 2 people attending to 1000 customers, than 1 or 2 people in house tending to 1 customer.

Except that security engineer : customer ratio doesn't make sense as a metric. Those 1000 customers all need the same thing - for their data in the cloud to be secure. They don't have differing security requirements that pull the engineers apart in different directions.

So it really is a comparison of 1-2 security engineers vs 100-200 security engineers.

> Those 1000 customers all need the same thing

This is completely not true, many customers often need specific custom tailored security for business specific needs (This is something most startup SaaS developers dont realize or care about because they are usually just starting development and care about growth and base product). This is where the problem lies, you paint with a broad brush and get the 80%, the other 20% is a nightmare usually. Most the time the 80% has holes in it too, like we saw here with SalesForce.

Whenever Im architecting a system, I always tell the execs you can either pay for it now (going on-prem) or pay for it later (with Saas) because at the end of 5 years you always end up paying just about the same, its just a matter of where. With payroll, downtime, customer losses, hardware, DR, wasted time with project managers from your SaaS providers.

Id always rather have control and know my system than depend on someone else's hire who behind a curtain of three, four or five nines of marketing jargon. It's always a pay me now or pay me later situation.

That doesn't entirely work. Most companies that use Salesforce or other cloud services (thus would be the ones doing on-prem instead of SaaS) aren't hiring huge security teams geared around cloud security. Even if they are hiring security teams, they're both smaller and probably focused around internal security issues (enterprise security teams).

And I also don't accept the premise that it's the same type of engineers that the companies would hire. The security teams at cloud companies are made up of very specialized engineers that are vastly different from the average dev you'd hire to run your internal on-prem servers.

Security is one of the things that sets SaaS (by the big players) apart. Running something on-prem will not have nearly the same security resources looking at it.

Hiring technical people is one of the hardest problems in technology and you're just going to blithely assume that a software company will do no better at it than a non-technical business with an IT department? Even setting aside the difficulties of screening and interviewing, more top-tier technical workers will prefer to work for a software or SaaS company in SF that pampers its employees than for a paper company in Duluth, Michigan.

Reply on news.ycombinator.com