News for hackers. Stuff that matters.

A comment on Coding in the open: how to do it securely. Parent comment

Re:Coding in the open: how to do it securely by robin_reala on Wednesday September 27, 2017 @12:05PM (#15349170)
I’m not disagreeing with you outright, but your argument is on the ad infinitum scale. For instance, GOV.UK PaaS uses AWS as a host[1]. Is that worrying? Should we not be using Cisco gear because of US govt backdoors? Should we not be using Chinese manufactured chips? These considerations are ones the military has daily, but they hinder the ability to deliver. Analytics is arguable both ways (and I lean towards your argument at this point in time) but there are good reasons past and present for GA.

[1] https://www.cloud.service.gov.uk

[ Parent | on HN ]
Re:Coding in the open: how to do it securely by Nursie on Wednesday September 27, 2017 @12:20PM (#15349322)
These aren't really equivalent to actively sending out data to overseas entities by anyone using your pages.

You absolutely should be taking precautions to make sure that what you're doing on AWS is secure. And in fact erring on the side of using providers who host in European countries, preferably European organisations.

(addendum - I spent a lot of the early part of this year working on AWS-based data processing systems for a large bank, they took massive precautions with the transport and storage of their data within the AWS system, including IPSec overlays, 14 day maximum node lifetimes and various other things. I realise that at some point you're trusting amazon, but there's a lot can be done to avoid having problems in the first place. "Not sending data to places you don't absolutely have to" seems pretty basic)

[ Parent | on HN ]
Re:Coding in the open: how to do it securely by Symbiote on Wednesday September 27, 2017 @12:09PM (#15349202)
Those are all maybes.

Google Analytics is a certainty, and reasonable alternatives are available.

I think it shows a terrible attitude from the department responsible to use GA. Not everything should be done by the lowest bidder, regardless of the costs. Maybe I'll write to my MP...

[ Parent | on HN ]