3 ms·

How does the requirements NDA thingy work? Does every single tester/bidder need to sign an NDA? At what point of the process does the NDA need to be signed? I

How does the requirements NDA thingy work? Does every single tester/bidder need to sign an NDA? At what point of the process does the NDA need to be signed? I feel a little uncomfortable signing an NDA unless the work has been outlined and the work is to begin. Also I think you're really cutting out a significant portion of the market with LinkedIn requirements. I understand it's probably needed to filter the plebs, but you should probably allow for an alternative sign-up approach (ie combination of phone verification, require business email, etc). Altogether very cool! I'm trying to get into InfoSec myself. Good to see innovation in the industry!

kenbaylor 11y ago
The LinkedIn approach is to validate people are who they say they are. We have a number of people who have very limited LinkedIn profiles, and some that have 'skeleton profiles'. Once you authenticate the profile you fill out is only seen by us for the purpose of finding you work. We take the 'stealth' very seriously. We also didn't want to store people's creds.
kenbaylor 11y ago
The NDA is mutual. It might say 'company x failed our pic-audit, we need help fast'. It guarantees we keep that secret but use that info to find the right match. Also on the pen test side, we wont't say vendor C put in a $10k bid, you should put one in at $9k. It just means we value trust and privacy, as everyone in the security field should. Testers would also sign an NDA when they take a job, so that they won't leak things they learned in confidence.
- Mandatum 11y ago
  > The NDA is mutual. It might say 'company x failed our pic-audit, we need help fast'. It guarantees we keep that secret but use that info to find the right match. Sorry, I'm not sure I exactly understand that. ELI5?
  - kenbaylor 11y ago
    1 Way NDA: Let's have an open honest conversation, but as you signed MY NDA, written in MY favor then: I CAN tell everyone about YOUR secrets, but you CANNOT tell anyone about my secrets 2 Way NDA (also called Mutual NDA):Let's have an open honest conversation, and as you signed MY NDA, written in neither party's favor then: I CANNOT tell anyone about YOUR secrets, and you CANNOT tell anyone about my secrets. It enables honest dialogs. TLDR>> 1 Way NDA's suck

kenbaylor 11y ago

The LinkedIn approach is to validate people are who they say they are. We have a number of people who have very limited LinkedIn profiles, and some that have 'skeleton profiles'. Once you authenticate the profile you fill out is only seen by us for the purpose of finding you work. We take the 'stealth' very seriously. We also didn't want to store people's creds.

kenbaylor 11y ago

The NDA is mutual. It might say 'company x failed our pic-audit, we need help fast'. It guarantees we keep that secret but use that info to find the right match. Also on the pen test side, we wont't say vendor C put in a $10k bid, you should put one in at $9k. It just means we value trust and privacy, as everyone in the security field should. Testers would also sign an NDA when they take a job, so that they won't leak things they learned in confidence.

Mandatum 11y ago
> The NDA is mutual. It might say 'company x failed our pic-audit, we need help fast'. It guarantees we keep that secret but use that info to find the right match. Sorry, I'm not sure I exactly understand that. ELI5?
- kenbaylor 11y ago
  1 Way NDA: Let's have an open honest conversation, but as you signed MY NDA, written in MY favor then: I CAN tell everyone about YOUR secrets, but you CANNOT tell anyone about my secrets 2 Way NDA (also called Mutual NDA):Let's have an open honest conversation, and as you signed MY NDA, written in neither party's favor then: I CANNOT tell anyone about YOUR secrets, and you CANNOT tell anyone about my secrets. It enables honest dialogs. TLDR>> 1 Way NDA's suck