Poll: Does your startup try to write secure software?

#1

Post by Haskell » Thu, Dec 11, 2008, 7:30 PM UTC

I would like to capture the general perception about secure development in startups.

Please, also keep in mind that even if your startup doesn't process users' private information (such as financial data or email), your website/application could still be hacked to distribute malware, either exploiting users' browsers or inserting trojans to be downloaded.

For instance, I browse sites I trust with javascript and flash enabled in Noscript, increasing the surface attack.

Also, users are taught to avoid only untrusted websites/applications - and they could blindly trust your startup downloading trojans.

Re: Poll: Does your startup try to write secure software?

#2

Post by lincolnq » Thu, Dec 11, 2008, 9:26 PM UTC

Security is a high priority for us (2 people). We are careful to write secure code, and we discuss security specifically and do code reviews for any risky parts. This process isn't formalized, but we don't just trust ourselves -- we also expect each other to find any problems we've missed. This doesn't seem to fit into any of your responses.

(If you're going to make a poll, I would recommend choosing answers which don't presuppose so much)

Re: Poll: Does your startup try to write secure software?

#3

Post by [deleted] » Thu, Dec 11, 2008, 9:50 PM UTC

lincolnq wrote: post #2

Security is a high priority for us (2 people). We are careful to write secure code, and we discuss security specifically and do code reviews for any risky parts. This process isn't formalized, but we don't just trust ourselves -- we also expect each other to find any problems we've missed. This doesn't seem to fit into any of your responses. (If you're going to make a poll, I would recommend choosing answers which do…

[deleted]

Re: Poll: Does your startup try to write secure software?

#4

Post by Haskell » Thu, Dec 11, 2008, 10:04 PM UTC

lincolnq wrote: post #2

Security is a high priority for us (2 people). We are careful to write secure code, and we discuss security specifically and do code reviews for any risky parts. This process isn't formalized, but we don't just trust ourselves -- we also expect each other to find any problems we've missed. This doesn't seem to fit into any of your responses. (If you're going to make a poll, I would recommend choosing answers which do…

You can interpret formal process as systematic process.

The logic for each answer is this:

Answer 2. If you claim to care about security, you should understand the security implications of what you are doing and you are an expert. You can take care of it on your own.

A 1. If you care about security and you aren't an expert, then you don't really understand all security implications of what you are doing and should be basing your judgment on the recommendations of those that do using a systematic process created by experts. You don't need to hire a consultant to do it. You can just buy a few books or read it for free in the Internet.

A 3. If you care about secure software but aren't an expert nor use a systematic process created by experts, then you aren't checking all security implications of what you are doing, but instead checking only for a few generally know flaws.

A 4, 5, 6. You don't understand the security implications of what you are doing and refuses to take the recommendations of those that do.

Re: Poll: Does your startup try to write secure software?

#5

Post by tptacek » Thu, Dec 11, 2008, 10:53 PM UTC

lincolnq wrote: post #2

Security is a high priority for us (2 people). We are careful to write secure code, and we discuss security specifically and do code reviews for any risky parts. This process isn't formalized, but we don't just trust ourselves -- we also expect each other to find any problems we've missed. This doesn't seem to fit into any of your responses. (If you're going to make a poll, I would recommend choosing answers which do…

Why would you spend a lot of time writing secure code for a news recommendation site?

Re: Poll: Does your startup try to write secure software?

#6

Post by tptacek » Thu, Dec 11, 2008, 10:54 PM UTC

I'm eager to see what people here have to say about this poll, but it's so badly constructed that I'm not hopeful about the quality of the results. I've thought about posting a similar poll, but it would be self-serving.

Re: Poll: Does your startup try to write secure software?

#7

Post by Haskell » Thu, Dec 11, 2008, 10:57 PM UTC

tptacek wrote: post #5

lincolnq wrote: post #2

Security is a high priority for us (2 people). We are careful to write secure code, and we discuss security specifically and do code reviews for any risky parts. This process isn't formalized, but we don't just trust ourselves -- we also expect each other to find any problems we've missed. This doesn't seem to fit into any of your responses. (If you're going to make a poll, I would recommend choosing answers which do…

Why would you spend a lot of time writing secure code for a news recommendation site?

That is why I have placed that introduction.

If this news recommendation site is being constantly hacked to the point in which it has more malware than a porn site, then the developer should consider making it more secure. Otherwise users would not visit it anymore, unless the owner starts to place some hot picures to serve together with the exploits.

Re: Poll: Does your startup try to write secure software?

#8

Post by Haskell » Thu, Dec 11, 2008, 11:01 PM UTC

tptacek wrote: post #6

I'm eager to see what people here have to say about this poll, but it's so badly constructed that I'm not hopeful about the quality of the results. I've thought about posting a similar poll, but it would be self-serving.

Why do you think it is badly constructed?

Re: Poll: Does your startup try to write secure software?

#9

Post by tptacek » Thu, Dec 11, 2008, 11:08 PM UTC

Haskell wrote: post #8

tptacek wrote: post #6

I'm eager to see what people here have to say about this poll, but it's so badly constructed that I'm not hopeful about the quality of the results. I've thought about posting a similar poll, but it would be self-serving.

Why do you think it is badly constructed?

It's too detailed and it has an agenda.

Re: Poll: Does your startup try to write secure software?

#10

Post by tptacek » Thu, Dec 11, 2008, 11:10 PM UTC

Haskell wrote: post #7

tptacek wrote: post #5

Earlier quoted context omitted.

Why would you spend a lot of time writing secure code for a news recommendation site?

That is why I have placed that introduction. If this news recommendation site is being constantly hacked to the point in which it has more malware than a porn site, then the developer should consider making it more secure. Otherwise users would not visit it anymore, unless the owner starts to place some hot picures to serve together with the exploits.

That's nice. In reality, the security quality of a typical web application is quite low, especially compared to F500 enterprise standards --- few would survive a pentest. And yet most of them are not hacked in that manner.

Indie developers need to get better at writing software that is secure by default, but they do not need the whole process-driven juggernaut that Microsoft runs internally with things like SWI.

So, I asked because it sounded strange to me that a two-person news-recommendation startup would be spending serious time on security, as opposed to figuring out ways to make money on their property.