[internetcitizen]

"Although it takes many, many years to become a great hacker, you can learn to be good enough to build your site or app in a few months."

Yeah, just don't run it in production.

[cjhanks]

I have known founders with 0 experience hack together god awful C++ programs that ran their business long enough for them to fund competent programmers.

Never underestimate the value of a persistent person!

[coralreef]

Running it in production is the point. An idea is pursued to validate the market for it, not to accomplish building a scalable, secure solution for which nobody wants.

[internetcitizen]

Respectfully disagree :)

90 percent of the users who reuse passwords for your app will end up on a list and finding themselves on haveibeenpwned months too late, or never.

[coralreef]

This is an unfortunate consequence of having a free and openly distributed internet. Unless you're auditing and compiling your own builds from open source, you have no idea where your data is going.

I'm all for best practices and due diligence. But from the startup founder perspective, you can't let yourself be paralyzed by the fear that everything will go horribly wrong.

[Ace17]

> But from the startup founder perspective, you can't let yourself be paralyzed by the fear that everything will go horribly wrong.

Some middle ground here is definitely needed.

Even for startups, things going "horribly wrong" can kill people (medical devices, biochemistry, robotics, transportation) or send people to jail (accounting, banking).

And if you think your web startup doesn't deal with "dangerous" things, I suggest googling for "life-threatening grindr security flaw".

There's never a good reason to ignore security.