Hacker News Reader

Because that not only adds operational expense but also requires engineering teams to have a level of systems engineering expertise and diligence that virtually no line-of-business software project has.

View on HN

*adds operational expense without a counterparty willing to pay for that expense

Those with data on Equifax's servers aren't Equifax's customers, so other than "not having a PR cluster&#@_" economic incentives are not aligned to prevent this.

It's probably best to treat Equifax specially rather than making an example out of them for the rest of the industry to follow.

If they aren't qualified to design with least privilege, what are they qualified for, beyond maybe cat videos?

I've spent about half my professional career finding vulnerabilities in the software of developers who are convinced they're "qualified to design with least privilege".

And, even if you know what you are doing, this is intrinsically a hard problem, you need to know exactly what information should be accessible to each server

Reply on news.ycombinator.com