Ask HN: Is it the norm for companies/startups to not give a damn about security?

No, this isn't normal in my considerable experience. What you are experiencing signals that something is fundamentally lacking in the thinking and prioritization of the leadership.

The unfortunate reality is the class of companies called "startups" only requirement is that someone convinced someone else to give them money, and now they're the boss. This can lead to all sorts of things.. like what you're seeing.

I'd bail to somewhere else with more professional leadership. Even if this one instance gets fixed, the deficit is indicative of a cultural problem that I've not yet seen ever really change.

Not taking the security of your customers seriously is guaranteed poison in the medium to long term.

Unless your company is doing things on the level of trafficking minors or racketeering, then the information that comes out will be run-of-the-mill oopsies. Having worked a bit in DevSecOps, I can tell you that storing clear-text passwords in places like version control files is much more common in companies than anyone would hope. Also, auth is just hard, in part because it forces servers to be stateful.

Because companies have a wide range of options for dealing with the consequences of leaks, they'll prioritize security last instead of shifting left. Some common responses by companies include:

- denying there's a problem

- covering up the problem

- acknowledging the problem in a blog and demand to be praised for the disclosure

- blaming employees for the mistake

To make a good plan, you can break down concerns piecemeal. What's the worst case scenario if attackers get a hold of employee passwords? What happens when users trust tampered content?

> Some common responses by companies include:

Yes and I would say I often see the responses come out in that order.

In my experience, start-ups play fast and loose with all sorts of things like security, data integrity etc. It's how they can quickly build a service an offer it to larger companies who would never get it done due to internal management inertia, politics, architecture reviews, project management, processes, audits, controls and regulations. However, it shouldn't be "that" bad. For example, I worked at a start-up that successfully made it to $8+b valuation, and they had tons of extremely scary shit. But generally when someone found a critical issue, everybody sighed, rolled up their sleeves and fixed it. Because a security breach, data leakage or data loss that is caused by such negligence is a company extinction event for a start-up. These guys are playing Russian Roulette. Get out before the inevitable occurs.

"Is it the norm for companies/startups to not give a damn about security?"

More or less, yes. They generally talk about security, but it's mostly just lip service. Although I will say your examples are pretty extreme.

I once worked on a team as the security champion for a major financial system the company uses internally (thankfully) for trading. There was a problem with SQL injection on every page/input we built in that system. And it had schema owner privileges, so you could drop tables and stuff. This is a possibility to happen by accident since there are trade desk devs who could have a tablename collision and accidentslly paste SQL into a field, let alone the malicious possibilities

I brought this up with the principle to see which of the two remediation plans he wanted to pursue and what resources he would provide me with for the work. Apparently they wanted to go with their own option of do nothing. They said there's an automatic backup of the database in near realtime (forget the name). Would it duplicate dropping tables? How far back can you restore? Has it ever been tested? What are the procedures for restoring? How long to restore (even a 15 minute outage is the end of the world according to the business)? They didn't know any of it, and they didn't really care to.

I promptly left that team. They just wanted a security champion to do paperwork for regulatory compliance. I had no real power to make improvements beyond the smaller stuff could do myself.

Your examples seem pretty extreme, and I would say they are definitely not normal. I'd guess the leadership and engineering quality at this company is sub-par and they probably don't even realize the extent of the problem.

With that said, my experience is that security issues get taken care of when they are very dangerous, or only after the main product tasks get done. Fixing minor issues in a (NEW) product/company that might not survive the year is a comparative waste of time... survival comes first usually.

It sounds like you care, not no one, so you could assign yourself to these issues and fix them. It’s easier to ask for forgiveness than permission.

If you can’t do that, or people get upsets because you did, you should probably start looking for a better job.

I worked in a etablished PHP shop that only worked with middle sized to big companies. There was no security other than the default options shipped with the used products.

I guess it's less about startup culture but more about bad culture in general.

I haven't experienced anything this bad. I've seen security lapses and have been able to fix them on my own or with a team, and I don't remember ever getting pushback.

It's probably time to start interviewing. Ideally before your employer's security woes become headline news. (Of course, if you've only been there a few months you can easily leave them off your resume once word of the flaws gets out.)

Without laws, companies are more concerned about their bottom line before user security. And you can't blame them for that - people would rather put food on their table after all, vs something that's going to slow you down or at most cause something that causes less damage then you think.

This seems to happen more in B2B startups in my experience. I think it's because there's just more blind trust in B2B, and the success bar is a little lower than B2C. I worked at a company which was testing on production, didn't use source control. They messed up hard and frequent with critical customers, including a major media company that could have slandered the hell out of them.

That company still didn't die and are popular in the community. Natural selection applies in the business world, but some startups really are the cockroaches of the world.

That said, it's not common. It happens in maybe 2-3 jobs out of 10. Often these are the guys who say yes to everything the customer asks for, which puts them in a peculiar niche.

Many will justify it as we will be lucky to survive and grow to a point where a security incident will be a problem.

AppSec is never the most important thing on any product manager or product owners list. No one says AppSec isn't important, just other things are more important. Sometimes the best you can do is talk them into letting the people that care dedicate some of their time to fixing security issues. While it seems bad, if this is a product or company you care about, working to make it better makes sense. You also might consider adding security concerns into requirements, acceptance criteria, and code reviews (if you have those) to stop it from getting worse.

Yes and no. They'll throw a big wad of cash at some provider to get some badly hacked together SSO auth and endpoint monitoring solution but then release insecure garbage running on an ancient copy of android, debian or whatever.

Yes. Startups are deeply focused on revenue. Developing security for a product is considered "extra" and "nice to have", not essential. That goes double for operations. I have never seen a startup actually practice security unless in preparation for an audit.

No, in 15 years working I haven't seen anything of that magnitude be ignored. You seem to have found a really bad organization. Something that large always was a drop everything and assign one person to fix it immediately kind of thing.

Some things at certain scales are just not the main priority.

This means security might not be valued, but that is a risk the business is taking in order to more resources towards the multitude of problems start-ups face...

I wouldn't say it's abnormal -- startups are in a constant state of SNAFU (situation normal: all fucked up) -- but it's definitely not acceptable.

I would say that it isn't normal and it seems pretty bad.

Out of interest, why haven't you fixed it?

Not OP, but sometimes a problem isn't in a person's domain. Like, if you had a conversation with an engineer who knows "a little about databases" and they tell you that the hardware isn't up to the task, so they've had to enable disk write buffering even though they don't have battery backed caches, and they don't backup WAL logs, and the replicas are still falling behind the primaries during peak usage. Would you get stuck in yourself? Where would you start? You'd have to petition management for hardware upgrades or maybe shard the databases. This is why critical issues sometimes hang around for months or years until (if you're lucky) you have a "near miss", where a database dies, the secondary is hours behind and your untested backups didn't work for the last 2 weeks, and there's no point in time recovery anyway because there are no WAL logs. And after a 1 hour outage and major panic, someone reboots the dead primary database and or magically comes back to life. (Of course, you then have to worry about transactions that might have been lost when the system for rebooted, since the disk buffers could have had unwritten data...)

Not sure it's a good analogy. Poster found the vulnerability in 1. 2 is plaintext passwords. 3 it's unclear exactly what is going on. This person seems to find security issues, and cares about them. It appears to be in his/her domain.

> When it's brought up people are like "ooh yeah that's like really really bad, but what about [tiny useless feature than one user asked about]?we don't have the time to fix that!"

For important things you have to take the initiative. Take a couple hours every day for however long. Just get it done.

Unfortunately, if a company's culture is bad, initiative won't help. In some companies, product managers and tech leads actively discourage initiative. Time just becomes a convenient excuse to discourage. I suspect this is the case in OP's company, given how systematic the negligence is.

> Unfortunately, if a company's culture is bad, initiative won't help

That's the chicken and egg problem. If you perceive that the company's culture is bad, you won't have initiative. If you (anyone) don't have initiative, then company's culture is kept the same.

I don't know how big the change is but assuming it's not crazy big, if you make a pull request with the relevant changes and send it to another eng who isn't a dick, you are going to get it in. If someone asks why you spent time on it, you say it took 45 mins.

Then the unauthorized fix is blamed for unrelated issues and believed because no one is really technical in leadership.

Who said unauthorized? There is a ticket. You create a pull request, another engineer approves the request.

A single person can patch an issue or two, but security can be cultural and unless you're in leadership you probably can't change that. And depending on how the business operates, spending too much time on bugs you weren't assigned can be considered by a PM as a performance issue.

It's a startup. Why can't this person be the one who creates a stronger security culture? Great way to start - fix the plaintext passwords, write a quick memo on why you don't want to do that and what you do to change it.

Yup “security third” is a very real idea, most startups don’t have time to worry about security much, they have to get a product launched

Yes even big companies don't care about security.... it's all facade and compliance

Hmm, i work for a bigcorp that has truckloads of software, and I've yet to see plaintext passwords anywhere.

Infosec doing their job should smack that down.

Obligatory GDPR

Poorly securing personal data in the UK/EU is rather illegal. So no, any reputable shop *will* care about security, ensuring personal data is kept secure and bugs patched as a priority.

Going up the food chain, "huge clients which you all heard of, multinationals, some parts of governments" will not be impressed if you are found to be slack when it comes to leaking customers data.

This sounds very bad and not normal. I would resign ASAP.