Hacker News Reader

Comment by dotancohen | Hacker News Reader

My server is an attack vector for my 10k+ users, and all their contacts. A 1% ransomware infection rate could net them $1 million USD worst case, and potentially an order of magnitude more if one of my users is browsing from a work machine in their network.

Don't underestimate the security value of people hitting your servers, even if all you think you're serving is emojis.

View on HN

I'm not underestimating. All I'm saying if someone pays 10k or more for an exploit against ssh/nginx/whatever, nobody is gonna pepper your server with it. They will sell it to a broker and pocket the money, end of story.

You will be targeted if your server seems to be the lowest hanging fruit or most easily exploitable or the target is most easily reachable through your site. Otherwise noone will bother with your setup.

Yeah, this is also a huge concern of mine. There's also nearly no standardization / information as to how to harden just a bit more than is commonly suggested by web devs / bad tutorial sites.

Seriously. When you find something, please let me know too!

Reading the manual.

This is very much so sticking your head in the sand. Some attacks are sold to highest bidder, others are deployed wide and fast. Some of us are responsible for securing high-sensitivity systems where such a shoot from the hip and trust everything will be okay attitude isn't acceptable.

Reply on news.ycombinator.com