"Security is our top priority" is meaningless

The computer industry is determined to relearn the well-known lessons the hard way.

For example, we still have a single password breach brings down the entire system. It's like building a battleship that would sink if a 2 inch hole in the hull happened.

The way to make systems secure is not to devise a perfect password system. The way is to make the system secure in spite of password breaches. It's a completely different mindset.

To return to the battleship analogy, it isn't about preventing holes in the hull. It's about surviving holes in the hull.

In my time as a computer security specialist, this has been the most difficult thing to get other computer people to understand.

Especially when it comes to cryptography. No cryptographic system can, or is intended to, keep something secret indefinitely. The whole point is to keep the secret for long enough that by the time it's cracked, the information itself is out of date and therefore disclosure is no longer harmful (or, at least, is much less harmful).

All security, computer or otherwise, is like a fire door. No fire door will hold back a fire forever. They are all rated in terms of the number of hours they'll be effective in a fire. Security must be thought of in similar terms.

But I understand. People want perfect security and wishful thinking is seductive. People also want security "for free" -- meaning something they can install or configure and then not have to worry about it anymore. But that's impossible, in large part because actual security doesn't have a technological solution. Security is a process that depends on proper human behavior. Technology can and does act as a "force multiplier" here, but a security approach that is 100% technological is a security approach that will be subverted sooner or later.

E.g., OFFICIAL let's say is $1,000,000 PRIVATE becomes $10,000,000 SECRET becomes $100,000,000

What we did experience was the cost in time to deliver a service doubled however. E.g., OFFICIAL was 3 years, PRIVATE was 6 years and so on. I expect it varies significantly between types of system, ours was a SaaS platform that read telemetry from embedded systems on assets in the field, so I'd assume that would be one of the drivers for my differing experience than yours.

Underneath, someone had stencilled in slightly smaller script 'second only to profit'

(Somewhat less common, but refreshingly honest. Or cynical. Or both)

Art of the Deal indeed.

It depends on which audience you want to reach when you want to advertise how secure your product/service is. Most people outside IT security have no idea what a penetration test is nor can they make sense of jargon-heavy post-mortems.

> I'd rather a company not just give self-appraisals of security

Companies routinely lie right to your face. No company's self-appraisal about anything is worth paying any attention to.

arsa Grace Hopper, who was quoting John Shedd.

Vs, here's 10 to 20 steps you can follow to give us the minimum permissions to use our service with a single repo. Go manually make repo specific tokens with specific permissions (10 steps) then go paste those tokens into our service (4-5 steps), now go add these actions to your repo (4-5 steps) and set these settings in that repo (5-15 steps)

So in this case, security is at odds with UX.

IMO, this is github's fault. Instead of providing an API and UX that would let users specify specific repos and choose specific permissions per repo, they did the more obvious and technically simpler thing. But, unfortunately, the more obvious easier thing, means the path of least resistance for integrations to do is ask for all permissions.

I would argue you could paint that as github has not made security their top priority. If they cared about security then the path of least resistance would lead to the most secure integrations instead of what they have now which leads to the least secure integrations.

I can't prove this is a fact, but I do know that I have yet to see an exception to it.

A company can't just do profit. Profits aren't a thing that a company can choose (typically), they aren't an input, they're an output. You can't choose your outputs, you can only choose your inputs and aim them towards specific outputs.

How do you achieve profits? Well you do things that your customers want, and one of those things might be security. For some companies, the input of investment in security will result in the output of profits. For others it won't, or the two will be less correlated. If security does convert well into profits then it follows that it should be a priority input for the company, because that's how they will achieve profits.

This is still a huge generalisation, but perhaps less of one than "profit is the top priority".

Big tech companies generally care about security because most of the time, it aligns with their self-preservation. They don't want their secret sauce leaked, they don't want internal mails and payroll posted on the internet, they don't want their users hurt. It's not "top priority", but security probably shouldn't be your top priority; if it is, there is only one winning move: don't build anything. That said, security often ranks high, especially if the company had a couple of close calls before.

In contrast, preserving privacy is often in direct contrast to business goals. You want to preserve it to some limited extent to maintain user trust and avoid offending the regulators, but there is a constant business pressure to get real close to that line.

A more apt analogy would be a restaurant saying "food safety is our top priority". To me that sounds like a restaurant that wastes a lot of plastic and produces a lot of food waste that might spoil soon.