8 ms·
When it comes to start-ups it's not stupid - it's wise. The food safety analogy is inappropriate. Security is about risk management. Low risks do not justify hi
by jdimov 12y ago
When it comes to start-ups it's not stupid - it's wise. The food safety analogy is inappropriate. Security is about risk management. Low risks do not justify high expenses.
When it comes to a company with hundreds of millions in revenues, however, they have clearly underestimated the risks and have been irresponsible.
- phySi0 12y agoI would say even the food safety analogy is appropriate. Sure, food safety is important; that doesn't mean you have to spend hundreds of millions of pounds in "food safety researchers" who will conduct rigorous scientific experiments to find out the best ways to limit the spread of germs and implement them, an in-house doctor with medical supplies who will treat customers that get food poisoning, etc. It just means there's a minimum, a bar, that they shouldn't go below. Everyone has a different bar, but most people generally agree on things like don't pick up food off the floor, don't leave things open or out, put things in the right places, make sure you wash your hands, etc. (I am not a food safety expert). Of course, for a startup, it depends on the product or service they're offering. A startup payment processor should be very security conscious, as the stakes are high. A movie logger should have the bare minimum that all startups should have, i.e. strong encryption, basic security protocols, etc.
- atmosx 12y ago> I would say even the food safety analogy is appropriate. I think it's NOT appropriate. Of course, in the end, it's a matter of value: Do you value your health equally with your digital privacy, your money, etc.? If 'yes' then the analogy yes, if 'no' then it doesn't. I don't so, to me, it doesn't.
- TillE 12y agoAnalogies are not meant to be precisely equivalent in every respect. They're just a tool to illustrate a certain point.
- benmcnelly 12y agoOh so like, Analogies are like butterflies! Not everyone understands them, and sometimes people who do still miss the point of them.
- ethbro 12y agoAnalogies are exactly like butterflies. Someone uses one once, and it causes a hurricane in a different comment thread. ;)
- deleted 12y ago[deleted]
- geon 12y agoYou are assuming that the risk is only to the company, not it's customers.
- sarciszewski 12y ago> Low risks do not justify high expenses. What is the expense associated with, for example, not concatenating user-supplied input in SQL queries?
- Ded7xSEoPKYNsDd 12y agoI don't know, what does a low-skill developer who doesn't know better cost compared to someone actually qualified for the job?
- sarciszewski 12y agoAt my previous job, I made $25k less per year than the idiot who nearly exposed us to RFI risks before I looked over his code. Developers are developers. If you're going out of your way to hire extremely untalented people, because they're cheap, you're going to get owned. If you're hiring people who understand their own craft, you can get a junior developer for under $70k and a senior for under $100k. Unless you're in SF in which case multiply everything by 2 or 3.
- Justsignedup 12y agoA better analogy: A start up is like a restaurant with 2 doors into the kitchen. 1 door from the outside, 1 door for servers to enter/exit. In a restaurant the workers can easily spot problems. And if someone walks in usually you kick them out, or lose a batch of food. The cost is much smaller than hiring 2 full-time bouncers. If, however, you now have a giant catering hall with 50 entrances to the kitchen and hundreds of people there, security / bouncers are necessary. The problem is how to go from one to the other, and not realize you need security when it is too late.