Comment by solyin
9 hours ago
What you must understand is business. Bad security practices haven't resulted in punishment that makes businesses take security seriously. At the end of the day, they may even be right about it. If it costs $10,000 to break down the door, but behind the door is only $100, why are you spending $10,000?
But doesn't the business realize that it's valuation is based on some level of trust including trust of data. Failure of properly securing that data and their customers hurts the brand in a more permanent manner.
Is the cost analysis of the situation treated it as a "worth it" situation? That, being fast and breaking things and bad security practices are a part of cost cutting and having more revenue faster, something without which a startup may fail.
Have they recognized some deeper secret where for the startup, it is much better to fail big than failing small? (especially so when in some sense most founders who went big and failed, are actually rewarded for it in their future more often than those who failed small)
I have no question in mind that for the executives, the situation is wildly different.
Though, I have a question to ask: What about the engineers working there?
Is it that management stresses them to not work on fixing it and if that is the case, then how are they able to rationalize it upon and their contributions to it (if the end result of it is that the company gets customers into such a system and ends up with their systems compromised because of following such bad practices?)