Hacker News Reader

Saying everything is ok because there are third-parties handling security is a major red flag.

Technically a tool like Snyk or Dependabot is a third-party security vendor, but would you trust your financial & personal information with a company that says their security posture relies solely on those tools?

View on HN

Such third parties arent the third parties that you are thinking about. Think of contracted security vendors in finance sector, with experts auditing things etc. Not some subscription-powered bot running some scripts somewhere.

The point I’m making is that the statement made is vague enough that you don’t know whether or not that is the case.

Yeah. Similarly the arguments against Patreon's move are vague enough. Nobody defines what is the objective standard for 'enough security'. Nobody even asks "Why Patreon had a 5-person security team and multiple security vendors up until this point".

Reply on news.ycombinator.com