Re:Major exploit found on reddit
by tuukkah on Sunday May 27, 2007 @04:38PM
(#24966)
You provide a good list of features to remember to implement, I didn't know of HMACs for example. I was thinking more about the process though: Are startups able to review all their code for bugs before pushing it online? When you code long hours, do you still write down all your assumptions to allow for audits later? What if none of the founders have experience in network security? When you don't have formal and clear processes in place, how easy is social engineering among customers?
[ Parent
| on HN ]
Actually to handle security is very hard. I think startups usually can't handle security as a process because time is little, stress in implementing features high and so on, so the best founders can do is probably to have security-aware programmers and try to don't introduce too much bugs.
Then if/when you become a mainstream site start doing planned security auditing from time to time.