zlacker

>>cbtacy+(OP)
All these recent hacks. Cant any of these companies use proper security experts? I mean they have the funds, why skip this and avoid all the backlash that comes with this. Its expensive but not as much as letting everyone know you messed up hard

>>jungle+hX
Implementing security guidelines is not as easy as paying a security expert. You then have to follow their advice, which means security practice for all employees. It can be costly and cumbersome.

Of course, it would have reduced damaged, such as pointing out that unhashed or unsalted MD5 passwords in a database is... what we've stopped doing 20 years ago for good reasons? :)

But well, if you're a big hosting provider tailoring to white supremacist content, you usually don't need so much security, since apart from anonymous-adjacent antifascists pretty much everyone is licking your boots, including law enforcement. The biggest neonazi forums have been around for decades, and their biggest proponents are well hidden behind the walls of our police stations, banks and parliaments.

Love the reference to Woody Guthrie, too https://en.wikipedia.org/wiki/This_machine_kills_fascists

>>southe+6Z
Yup. Security is a lot of time an after-thought and a burden to quiet a few companies since security is something that is not of immediate value. Last spring we had a speaker from northrup-grunman who talked about the need to push for a DevSecOps strategy.