[salviati]

Bunny.net explicitly names third parties handling user data, while Cloudflare’s policy is more vague, referring only to "third-party service providers" without listing specific companies.

I like the bunny policy more. It is more transparent.

[0x073]

Yes and yes.

But still good to know if someone pick a service with this intention: "I’ve been looking at European alternatives to my current hosting situation, which is Cloudflare."

[ta1243]

Don't let perfect be the enemy of good

[rolandog]

Haven't we learned that in the security and privacy domains that maxim requires its inversion? Especially with the passing of time! "Don't let temporary adequacy undermine lasting protection."

[ta1243]

Not really. Defence in depth is an example.

If things were perfect you only need 1 layer of security. Things aren't perfect, that doesn't mean we should just give up and have no security, we have multiple layers of good security as while it's not perfect, it's better than nothing.

[0x073]

And if we don't talk about things that aren't perfect, there will never be a improvement.

[rolandog]

Right. I think we're all in agreement about the end goal,... The "how we get there" is another story.

I'm partial to aiming for perfection — when there's time for it — after having been the person paying down the tech debt across different domains (i.e. untangle spaghetti code to unravel subtle logic errors, fix them, and write down documentation).

But I agree that sometimes you just need to ship a workable solution ASAP... I am of the opinion that that should be an exception, and that it isn't a sustainable modus operandi.