Hacker News Reader

Comment by l0b0 | Hacker News Reader

When does it not? Seriously, has anyone here worked somewhere security actually was front and center but people were also able to build new things?

View on HN

Kind of. Normally network access is fairly restricted, as well as administration rights on machines but developers quickly are exempt from this for productive work. I remember sins like modifying SSL checks for several package managers.

lie isValidTLSCert(){return true;//suuure}

Today is is mostly a configuration issue. Of course you will never be praised for the security of a solution. If something bad happens security quickly becomes the most important thing of course.

My current job at Google working on virtualization?

Can't be that secure if you go around telling people that's what you do.

Don't think it counts. That's a neccisary condition to multi tenancy cloud tech. It's a product feature that customers require and ask for.

The health technology space is kind of like this; HIPAA concerns etc. makes security a business continuity imperative.

Fair point. On the other hand, do these ever go beyond the basic checklists which provide the absolute minimum to certify the software? I doubt it.

Seems like more of a pessimist's take. I know the company I work at[1], at least has an ingrained culture of security that permeates through the org and dictates software development practices and tech stack. It probably helps to be a startup, where smaller missteps would be a bigger deal than for an established player.

[1] https://www.commure.com/

And the state of EMR software pretty much supports the point that it is, indeed, nearly impossible to build new things under those constraints....

Well, EMRs are generally part of older, established presences which have inertia. But companies like Apple and Alto are innovating in the medical space, and they're still governed by HIPAA.

- I know one company in SV that has done that for regulatory reasons, at huge, on-going financial expense. It's not normal.

- if you have engineers with previous implementation experience on HITRUST or similar, it can be done. But it's hard to retrofit if everything that's installed is stale.

- otherwise you end up with "paper certifications" without the engineering to support it. That works for a while, but eventually becomes a problem if an on-site audit is scheduled.

https://en.wikipedia.org/wiki/HITRUST

Reply on news.ycombinator.com