Ask HN: is it possible to build large scale systems that are secure?

I think it is, but I think security has to be architected into the system from the beginning, and you have to be willing to pay the price in flexibility and development time that that introduces. It's not really something solvable by entrepreneurs, other than security consultants (which is a booming but not all that scalable business).

Building secure software means that you have to think carefully at all levels about precisely what inputs may enter your software, and gracefully reject anything that you're not prepared to handle. The flip side is that you can't easily readjust your software when business needs change, because you've built your system to avoid unintended consequences and everything has to be specified out in careful detail.

The reason systems aren't secure isn't because they can't be - some very secure systems were built way back in the 60s (eg. Multics). It's because it's not economic for them to be. Insecurity is a conscious design decision, and for many markets, it's the right choice.

false. don't hire incompetent coders who don't know what they are doing. Security is easy, don't assume any input is safe, clean and verify before doing anything with it. Be aware of security issues and best practices. Ah yeah, don't let untrusted people access your db.

I think a lot of it is short development times and/or lack of code maintenance.