undefined | Better HN

0 pointsbastawhiz1y ago0 comments

> Google isn't to blame if you ship a paid product without running a security audit.

Arguably, if you provide a service that makes it trivial to create security issues (that is to say, you have to go out of your way to use it correctly) then it's your fault. If making it secure means making it somewhat less convenient, it's 100% your fault for not making it less convenient.

0 comments

9999000009991y ago

What if I need to hack together a POC for 3 people to look at.

It's my responsibility to make sure when we scale from 3 users to 30k users we take security seriously.

As my old auto shop teacher used to say, if you try to idiot proof something they'll build a better idiot.

Even if Google warns you in big bold print "YOU ARE DOING SOMETHING INSECURE", someone out there is going to click deploy anyway. You're arguing Google disable the deploy button, which I simply disagree with.

prophesi1y ago

I think that's throwing the baby out with the bathwater; sane defaults are still an important thing to think about when developing a product. And for something as important as a database, which usually requires authentication or storing personal information, let your tutorials focus on these pain points instead of the promise of a database-driven app with only clientside code. It's awesome, but I think it deserves the notoriety for letting you shoot yourself in the foot and landing on the front page of HN. Author also found a similar exploit via Firebase for the Arc Browser[0]

I have a similar qualm with GraphQL.

[0] https://kibty.town/blog/arc/

cdmyrm1y ago

Any purported expert who uses software without considering its security is simply negligent. I'm not sure why people are trying to spin this to avoid placing the blame on the negligent programmer(s).

2 more replies

9999000009991y ago

I don't know what exactly happened here, but Firebase has two defaults. Test access rules which auto expire and are insecure, or production rules which require auth.

If you do something stupid, like keep ignoring the insecure warning and updating them so they don't expire, that's your fault.

In no other industry do workers blame their tools.

1 more reply

IshKebab1y ago

Then you should have to click a big red button labelled "Enable insecure mode".

Defaults should be secure. Kind of blows my mind people still don't get this.

withinboredom1y ago

I’ve seen devs deploy production software with the admin password being “password”. I don’t think you are listening when they are saying “they’ll build a better idiot”.

1 more reply

bell-cot1y ago

Legal Dept: +10, Favorite

Marketing Dept: -10, Flag

jbverschoor1y ago

Oh they are. Just like mongo and others. It’s a deliberate decision to remove basic security features in order to get traction.

Remove as much hurdles to increase adoption.

pcthrowaway1y ago

To be fair, Cursor does this quite handily also.

cdmyrm1y ago

Should we outlaw C because it lets you dereference null pointers, too?

IshKebab1y ago

Erm yes! Even the White House has said that.

The only reason we didn't for so long was because we didn't have a viable alternative. Now we do, we should absolutely stop writing C.

withinboredom1y ago

The white house recently said a lot of things. But of all things, I don’t think they’re even qualified to have an opinion about software, or medical advice, or… well, anything that generally requires an expert.

1 more reply

bastawhizOP1y ago

I've never paid a company for C

j / k navigate · click thread line to collapse

0 comments

9999000009991y ago

What if I need to hack together a POC for 3 people to look at.

It's my responsibility to make sure when we scale from 3 users to 30k users we take security seriously.

As my old auto shop teacher used to say, if you try to idiot proof something they'll build a better idiot.

prophesi1y ago

I have a similar qualm with GraphQL.

[0] https://kibty.town/blog/arc/

cdmyrm1y ago

Any purported expert who uses software without considering its security is simply negligent. I'm not sure why people are trying to spin this to avoid placing the blame on the negligent programmer(s).

2 more replies

9999000009991y ago

I don't know what exactly happened here, but Firebase has two defaults. Test access rules which auto expire and are insecure, or production rules which require auth.

If you do something stupid, like keep ignoring the insecure warning and updating them so they don't expire, that's your fault.

In no other industry do workers blame their tools.

1 more reply

IshKebab1y ago

Then you should have to click a big red button labelled "Enable insecure mode".

Defaults should be secure. Kind of blows my mind people still don't get this.

withinboredom1y ago

I’ve seen devs deploy production software with the admin password being “password”. I don’t think you are listening when they are saying “they’ll build a better idiot”.

1 more reply

bell-cot1y ago

Legal Dept: +10, Favorite

Marketing Dept: -10, Flag

jbverschoor1y ago

Oh they are. Just like mongo and others. It’s a deliberate decision to remove basic security features in order to get traction.

Remove as much hurdles to increase adoption.

pcthrowaway1y ago

To be fair, Cursor does this quite handily also.

cdmyrm1y ago

Should we outlaw C because it lets you dereference null pointers, too?

IshKebab1y ago