4 ms·
That self-hosted appliance would have to undergo a year-long security review process. Basically we'd have to know all the internals, how things are implemented,
by athenot 9y ago
That self-hosted appliance would have to undergo a year-long security review process. Basically we'd have to know all the internals, how things are implemented, with which libs, which versions, how it gets updated...
For something that really should be a piece of desktop software, that most likely won't fly.
I understand your business decision to go for a SaaS model instead of a fixed price, but the added value of the service (vs. a product) doesn't justify it on the user's side.
- kovek 9y agoI wonder, would you be able to check if the self-hosted appliance is making requests to IPs other to the one that hosts your Github Entreprise instance? If you can check for this, you can be more confident that your data is not being sent out to machines you do not control.
- athenot 9y agoThat would help build a case for mitigation, but it would still have to undergo the entire scrutiny process.