Hacker News Reader

Comment by ryandrake | Hacker News Reader

It takes zero effort to have your public relations department issue a press release claiming that your company "takes something seriously". That claim rings hollow when it comes right after you demonstrate the opposite. As I said in the other thread, these companies falling all over themselves to say how seriously they take security after they've been compromised are like companies gushing about how seriously they take quality--after issuing a major recall (or getting sued) over faulty parts. The proof is in the pudding.

View on HN

In my experience you are wrong. Two examples, one on security the other on quality and recalls. On security, we were building an Home Gateway, the modem you have at home to access Internet. Before releasing it we realized the web page was vulnerable to a CSS attack. Since through the attack was possible to change the WiFi or the Firewall configuration we released the first version without these functionalities despite they were required by the users. The next release went through a two week pen test (consider that many of the competitors had the same CSS issue and were available on the market). Just a couple of day before releasing the new version, after the pen test was ok, I notice a phrase in the release note, I investigated a little bit and I discovered that the CSS issue was still there, it was just more difficult to reproduce (and a 2 week penetration test failed to spot it). What do I mean? That also the best security practice aren't enough to protect from all the possible issues. On product recall, same product, but on the hardware. Our hardware vendor was Chinese but we inserted in the contract strict clause on tests, product performance etc etc... After around a year we discovered that a huge product lot used a capacitor with problems and we have to recall all of them. The capacitor was produced by a reputable company and matched all the production standard when new. Lesson learned? Even if we obsessed over quality, you could have problems. The difference between a mediocre company and a good one is not that it doesn't make error, but that it is quick to solve its mistake and learn the lesson for the future.

I'm certainly not trying to defend them. I'm just saying that a serious commitment to security doesn't preclude breaches any more than a serious commitment to quality precludes recalls. You only need to screw a minute detail up to get in trouble, and so far no distinction has been made between companies that have actually been incompetent/irresponsible and others.

How about instead of just saying "We take security seriously," disclose some evidence. What specific things do we normally do to keep customer data secure and prepare for attacks? How did that preparation fail this time? What was this particular attack vector? What exactly was compromised, and when? What specific, verifiable steps are we taking to make the victims (customers) whole? What specific, verifiable corrective action are we taking in order to prevent this kind and other kinds of breaches going forward?

Just saying "We take security seriously" is like saying (to quote Chris Rock) "I take CARE of my kids!" What do you want, a cookie? That's what you're supposed to do.

So are you saying that if someone hasn't experienced a security issue, it doesn't ring hollow? That it's just a matter of time?

Most corporate communication is hollow, but these PR platitudes are especially absurd when juxtaposed with evidence to the contrary. It's like AT&T telling me "Your call is important to us" every 5 minutes for a half an hour while I wait on hold.

On the other hand, I can think of a number of companies that have a track record of making high quality products, and none of them regularly feel the need to issue press releases touting their commitment to quality.

Reply on news.ycombinator.com