points by solyin 1 day ago | 0 comments
What you must understand is business. Bad security practices haven't resulted in punishment that makes businesses take security seriously. At the end of the day, they may even be right about it. If it costs $10,000 to break down the door, but behind the door is only $100, why are you spending $10,000?
[–] Imustaskforhelp 22 hours ago
[–] solyin 7 hours ago
Who's the engineer that fucked up at Equifax and leaked all our data? Or VW Dieselgate? How many people know his/her name? Does anyone? When you're a cog in a large machine, it doesn't necessarily come from a place of incompetence or malice, though it might. Usually you're busy fighting the fires on your team and your scope and have to just assume someone else is fighting their fires competently. Which, if we're looking at Replit, as far as I know, aside from having the AI go rogue in a widely publicized incident which wasn't company ending, they weren't hacked before this announcement, so other than telling someone to wearing their seatbelt, it seems like they got lucky and got away with it.
At the executive level, look at it as a resource allocation board game. If you put points (money) into security, that's points you can't use elsewhere (sales & marketing). If you don't make any sales, it doesn't matter how cool and secure the product is. No sales means no money to pay for rent or food.
Is the cost analysis of the situation treated it as a "worth it" situation? That, being fast and breaking things and bad security practices are a part of cost cutting and having more revenue faster, something without which a startup may fail.
Have they recognized some deeper secret where for the startup, it is much better to fail big than failing small? (especially so when in some sense most founders who went big and failed, are actually rewarded for it in their future more often than those who failed small)
I have no question in mind that for the executives, the situation is wildly different.
Though, I have a question to ask: What about the engineers working there?
Is it that management stresses them to not work on fixing it and if that is the case, then how are they able to rationalize it upon and their contributions to it (if the end result of it is that the company gets customers into such a system and ends up with their systems compromised because of following such bad practices?)