Hacker News Reader

Comment by dangoodmanUT | Hacker News Reader

As I mentioned in the Northflank breach post:

Unfortunately for infra startups, I think we're going to see a convergence back to hyperscalers as a result of incidents like this and railway.

There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprises

Also, a trick i've started doing is encrypting my env vars, then hard-code the decryption key in the code

View on HN

Is your implication that hyperscalers (big companies) will always do better at this than smaller companies?

Just becuase a company has more money doesn’t mean they direct that money well, and even money directed well at the wrong people will result in failures.

No one ever got fired for putting creds in AWS Secrets Manager. I'd take the hyperscaler every time because even if something happens, it is a very defensible decision.

It is probably safer if you enable HSM.

Sometimes compliance do help improve security. Hyperscalers have resources for that. They have resources and they do security well. Hyperscalers are treated as critical infrastructure.

One person's machine being compromised does not bring the whole org down.

Not necessarily _always_ (Azure anyone?) but for the others - absolutely.

Yes, I’d say any infra provider that can't afford to have their own hardware security module should probably not be storing sensitive customer data.

Unfortunately the cost of HSM is the cost of two of them, overprovisioned for your projected needs over years, and staff who know how to use them safely both in terms of security design and not losing access to everything in case of an issue.

Just having HSM is not good enough. You also need a process around it to keep it secure. you can also use Cloud HSM solutions.

Reply on news.ycombinator.com