Hacker News Reader

Comment by eastbound | Hacker News Reader

On the other hand, Atlassian’s stock lost 66% of its value, and it could be because investors notice that converting people to the Cloud is not currently working.

Atlassian should have better bet on their Server solutions, but they really really wanted to be a cloud operator. “For strategic reasons.” Maybe for governmental reasons, who knows.

View on HN

It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. There are SLAs for how long the vendors can retain the source code they scan, but many clients are not aware of how much of these scans are performed manually behind the scenes by humans and how few of the vendors have their compliance audited. The possibility of a vendor failing to properly secure your source code is risky enough on its own, but it being accompanied by detailed reports of the security vulnerabilities in the code should cause some hair to stand on end.

> It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans.

Write the source code in some Assembler language (or even binary code ;-) ). Or use some obscure programming language that the vendor cannot scan, thus having a reason not to upload it.

In case you weren't being tongue in cheek, the purpose of the scan is to find security vulnerabilities so they can be rectified. If the scan cannot understand the code, it can't find the vulns that need remediation. Unfortunately, you don't even need to pick an obscure language. Almost all vendors of SAST products are chronically behind schedule on supporting the latest versions of languages and frameworks, and some of the biggest names have significant gaps in which commonly used languages they support.

> it could be because investors notice that converting people to the Cloud is not currently working

Given the barn storming financial performance of other cloud operators and Atlassian's impressive record in (un)reliability, I think investors are quite aware that converting people to the cloud is going swimmingly most places that aren't Atlassian.

Reply on news.ycombinator.com