Comment by Imustaskforhelp
10 hours ago
WHAT? I had once went into an absolute rabbithole into a similar topic and not in my wildest dreams could I have imagined that Replit (or others) are just using normal docker for the workload.
I thought that the case of security was better within the industry and that the industry would be punished for bad security practices.
What were the engineers of Replit doing then? Even with a generous perspective, I fail to understand how they couldn't have pushed back against it just until now. This is unacceptable in many ways.
The engineers must have realized that the security that they had was mostly just all duct tape? (because if not then it's a bigger problem)
or is it just something about how startups operate or the incentive structures of the corporation that I am failing to understand?
What you must understand is business. Bad security practices haven't resulted in punishment that makes businesses take security seriously. At the end of the day, they may even be right about it. If it costs $10,000 to break down the door, but behind the door is only $100, why are you spending $10,000?
But doesn't the business realize that it's valuation is based on some level of trust including trust of data. Failure of properly securing that data and their customers hurts the brand in a more permanent manner.
Is the cost analysis of the situation treated it as a "worth it" situation? That, being fast and breaking things and bad security practices are a part of cost cutting and having more revenue faster, something without which a startup may fail.
Have they recognized some deeper secret where for the startup, it is much better to fail big than failing small? (especially so when in some sense most founders who went big and failed, are actually rewarded for it in their future more often than those who failed small)
I have no question in mind that for the executives, the situation is wildly different.
Though, I have a question to ask: What about the engineers working there?
Is it that management stresses them to not work on fixing it and if that is the case, then how are they able to rationalize it upon and their contributions to it (if the end result of it is that the company gets customers into such a system and ends up with their systems compromised because of following such bad practices?)