Hacker News Reader

Comment by johnmarcus | Hacker News Reader

This isn't an uber problem - it's a startup tech problem - no one wants to take security seriously because it's a cost sink that only averts risk, does not actually make a company revenue. I have seen ssn's store insecurely, open api's with customer data, old frameworks and languages that no longer receive security patches. Nearly every startup says they take security seriously, because that's the right answer to say, but very very very few actually do. This is just another minor blip in the otherwise very large system of data available everywhere. Your data is not safe, trust me on that.

View on HN

People right here on HN advocate against start-ups taking security seriously because it slows them down. Really bugs me.

That's standard issue advice. "No company ever failed because of a security breach."

Mt. Gox failed due to a security breach.

Well, I imagine that's an edge case. Most startups aren't handling money(sans payments ofcourse).

No, but most start-ups are handling their customers' data and that translates into substantial value.

I've done InfoSec for a bunch of startups, none seem to grasp the importance of security by design and how it can play an integral role in the business. It's exhausting to have to battle a neon-haired developer that wants to just write code (rightfully so,) not following a process or standards often engaging in arguments just to be right. Imagine one person going asking an entire engineering org to create security priorities until business gets a hold of those and comes back to yell at you for delaying sprints, yep, that's InfoSec for you. Also, any business that says "We take security seriously" isn't. That's a boilerplate they plucked out of the legalese to CYA.

This.

Nothing is secure by design because anyone that can make it secure by design can get a job somewhere they're taken seriously.

I certainly agree with your comment, since it reflects my experience in a lot of cases. But

  "We take security seriously"

Why would such a statement legally cover your ass? From a legal perspective it sounds as dubious as warnings on a Truck "Stay back 10 metres. Truck is not responsible for damage"

I can't disagree. However, it doesn't deter businesses from using it as it demonstrates intent to maintain certain security posture, regardless of how ill-conceived that posture might be. That said, the statement is touchy feely, and will more than likely not hold true in the court of law when pressure tested.

edit: ah, nevermind, just a reference that went over my head

It's a play on words about the pointy haired boss

I meant not offense to those with neon-colored hair, correct on the PHB read. Also, Wally is based on a person I worked with. Apparently, he worked with Scott Adams back in the PacBell days.

Aw, I feel bad about pointing it out now. I don't even have neon colored hair, but perhaps I am a bit jealous of the people who do.

This is largely a usability issue. There have been folks in the performance community complaining in the same way for years. Then all of a sudden React comes along and lots of people started talking about performance because the framework made their primary task (building a website) easier.

Security is much harder than it needs to be currently. Every time I deal with an OpenSSL error I die a little inside. We have scam "security researchers" distracting us on Twitter with spurious reports every week.

Asking people to "think more" is a lost cause. We need better tools that make it easier to solve problems in the critical path that encourage more secure defaults than the last ones did. Most other solutions are unlikely to make an impact.

this isn't a startup tech problem - it's a startup customer problem. no customer wants to pay significantly more for a good or service to ensure that the company takes security seriously because they want the lowest cost.

Reply on news.ycombinator.com