5 ms·

Unfortunately, our current agreement with the security company we hired prevents us from sharing the details unless under NDA. We may revisit those terms so tha

Unfortunately, our current agreement with the security company we hired prevents us from sharing the details unless under NDA. We may revisit those terms so that we can publish it now that Teleport is garnering more interest. Edit: tried to add more clarification to address jtchang's question.

jtchang 10y ago
Why is this? Doesn't it make sense to publish which company did the audit? I mean for financial companies like KPMG they definitely do it.
- sethhochberg 10y ago
  I'd guess it is something like "pay us $XX for an audit for your information; pay us $XXXX to tell other people we audited you"
  - developer2 10y ago
    It's exactly this. A private audit is generally cheap. The truth with these is that the audit really doesn't mean anything - you will often find such audits performing such a superficial sweep of the software that even glaring problems may not be found. Publicly releasing an audit puts the auditor's reputation on the line. As such, the audit will always be performed very seriously, digging into the code and scrutinizing every possible angle - at a level usually not even remotely done for a private audit. All said: a private audit means squat all.
- dsr_ 10y ago
  My company pays for an annual external audit, and I do most of the negotiations. About half the companies don't want the audit results going anywhere else. About half are OK with distribution under NDA. In between, there are companies which will negotiate the right to distribute, usually with an explicit indemnity clause, and on the far end are a minority of companies that tell you that the results are work for hire and entirely your prerogative. The major concern is that the customer will misrepresent the results in some way, or even represent them accurately but then change the underlying service to open up a vulnerability. Either way, nobody really wants to be in the news...

jtchang 10y ago

Why is this? Doesn't it make sense to publish which company did the audit? I mean for financial companies like KPMG they definitely do it.

sethhochberg 10y ago
I'd guess it is something like "pay us $XX for an audit for your information; pay us $XXXX to tell other people we audited you"
- developer2 10y ago
  It's exactly this. A private audit is generally cheap. The truth with these is that the audit really doesn't mean anything - you will often find such audits performing such a superficial sweep of the software that even glaring problems may not be found. Publicly releasing an audit puts the auditor's reputation on the line. As such, the audit will always be performed very seriously, digging into the code and scrutinizing every possible angle - at a level usually not even remotely done for a private audit. All said: a private audit means squat all.
dsr_ 10y ago
My company pays for an annual external audit, and I do most of the negotiations. About half the companies don't want the audit results going anywhere else. About half are OK with distribution under NDA. In between, there are companies which will negotiate the right to distribute, usually with an explicit indemnity clause, and on the far end are a minority of companies that tell you that the results are work for hire and entirely your prerogative. The major concern is that the customer will misrepresent the results in some way, or even represent them accurately but then change the underlying service to open up a vulnerability. Either way, nobody really wants to be in the news...