I'm in a situation in which I have to decide between security of the application and shipping fast. The idea that we're working is not yet evaluated but we believe it has the potential to go viral. What would be the ideal thing to do here, build the product perfectly or to ship fast and fix later?
Ask HN: How much do you care about security while building an MVP?
1–10 of 17 posts
Re: Ask HN: How much do you care about security while building an MVP?
#2What will you do if/when it's in the hands of 100K users, you are working as hard as you can to keep up with bug reports, and some 14 year old figures how to exploit a security hole to do something that will make everyone angry with you?
Security is really, really hard to back-patch - some would say impossible. If it's not there at the beginning then you will either never have it, or you will have to do a complete re-write.
Re: Ask HN: How much do you care about security while building an MVP?
#3It's a balance. To paraphrase Steve Yegge: if you dial up security to 100 and accessibility (or in your case, working MVP) to 0, you die. If you dial up working to 100 and security to 0, you can win.
If you have no idea if this MVP has any promise, I'd seek the answer to that and do the barest of minimum security, provided you'll have the willingness to do it right immediately after getting any traction. That can be easy to say and hard to do, of course.
Re: Ask HN: How much do you care about security while building an MVP?
#4You can simply do the best to merely record what's going on (ship your logs off to a system that's super well secure and basically write-only with minimal services as fiat). Additionally, somehow protect data sufficiently well that the problem would not cause catastrophic loss of data. A start-up went under after attackers managed to get their AWS access keys and wiped out everything in all their accounts after refusing to pay the ransom fee.
Huge difference between terribly stupid and realistically aware of pros and cons.
Re: Ask HN: How much do you care about security while building an MVP?
#5With all due respect, doesn't everyone think their product might go viral? It probably won't. You'll have time to fix the security after you launch.
Re: Ask HN: How much do you care about security while building an MVP?
#6It depends. What sort of security issue is at stake here?
Re: Ask HN: How much do you care about security while building an MVP?
#7Frameworks will give you security best-practices and a faster shipping time. Of course, frameworks aren't bulletproof; but if your understanding of security isn't up-to-date then a framework will provide you some shielding against SQL injection, CSRF, etcetera – and will almost certainly help you ship a product faster since you will reduce the amount of boilerplate you're writing.
Re: Ask HN: How much do you care about security while building an MVP?
#8With all due respect, doesn't everyone think their product might go viral? It probably won't. You'll have time to fix the security after you launch.
That's a fucking terrifying suggestion
Re: Ask HN: How much do you care about security while building an MVP?
#9It really depends a lot on the type of information you store on people. Is it very personal/sensitive? Is there money involved?
Re: Ask HN: How much do you care about security while building an MVP?
#10Well it all comes down to what bug holes you will release and what type of data you will be handling.
If you will be handling sensitive people information then you need to make sure that those are safe. Last thing you want is you new startup to be easily exposed and get a beating.
If someone might just game the site and get something that wont affect anyone else, then you might ignore the fix for a while.
But you should try and build whatever you are with a relative safety net. You cannot have bugs and holes in your system that will expose the system to hackers that will take over everything. Cause then it will be game over for you. No one will trust you afterwards.