3 ms·

My guess is he still had a network connection up when he did the copy. These kind of things like JAMF, osquery and so on upload what you do on your computer on

by mahyarm 10y ago

My guess is he still had a network connection up when he did the copy. These kind of things like JAMF, osquery and so on upload what you do on your computer on a fairly frequent basis. After a certain company size all of them do something like this, and most of them do not spell out the amount of spying they do on their employee's work devices and office space. Or he didn't do a secure wipe when he reformatted the drive and google inspected the computer when he returned it. OR google modifies their laptops and has separate chips logging this stuff, which would be fairly impressive! Or he didn't actually do any of this alledged stuff and it's all innocent. We will find out in the court case either way!

jsprogrammer 10y ago
Could Google's records be fabricated? If there are separate logging chips, one would get access to all schematics, fabrication facilities, etc. in order to even consider any Google claims based on data collected through such methods.
x0x0 10y ago
I would imagine there are IDS systems running, given Google's state level adversaries. Accessing large amounts of files you haven't previously accessed and shortly thereafter attaching an external drive should trip a competent IDS.
jlgaddis 10y ago
Or, you know, syslog.
brazzledazzle 10y ago
Unless it's changed since the last time I played with it osquery doesn't upload anything on its own–it's just a local tool/agent that you can use to gather data. Carbon black is a good example of something like that. JAMF I believe gathers application usage data but nothing as in depth as what's being discussed. It's also comically handicapped. It somehow manages to do a poor job of everything it tries to do so "the world's largest online Mac administrator community" is forum post after forum post of half understood franken-scripts. I used to think it was milquetoast but after sitting through their sales reps crapping all over open source software (despite extensive use of OSS libs in their products) and seeing it fail to do the most basic stuff out of the box my opinion is that it's over priced crap.

by mahyarm 10y ago

jsprogrammer 10y ago

Could Google's records be fabricated? If there are separate logging chips, one would get access to all schematics, fabrication facilities, etc. in order to even consider any Google claims based on data collected through such methods.

x0x0 10y ago

I would imagine there are IDS systems running, given Google's state level adversaries. Accessing large amounts of files you haven't previously accessed and shortly thereafter attaching an external drive should trip a competent IDS.

jlgaddis 10y ago

Or, you know, syslog.

brazzledazzle 10y ago

Unless it's changed since the last time I played with it osquery doesn't upload anything on its own–it's just a local tool/agent that you can use to gather data. Carbon black is a good example of something like that. JAMF I believe gathers application usage data but nothing as in depth as what's being discussed. It's also comically handicapped. It somehow manages to do a poor job of everything it tries to do so "the world's largest online Mac administrator community" is forum post after forum post of half understood franken-scripts. I used to think it was milquetoast but after sitting through their sales reps crapping all over open source software (despite extensive use of OSS libs in their products) and seeing it fail to do the most basic stuff out of the box my opinion is that it's over priced crap.