4 ms·

> This made clear that offering the tool as a cloud service is an issue in corporate environments. To mitigate this, the CLI now encrypts all source code on you

> This made clear that offering the tool as a cloud service is an issue in corporate environments. To mitigate this, the CLI now encrypts all source code on your machine, the service decrypts it only in memory to run the analyzer and then all sources are immediately deleted. That wouldn't cover any of the corporate policies I've seen. It's a total no go for companies under government regulation like HIPAA. Company lawyers will block devs from using your service. IMHO, you have to provide an enterprise version of your platform that can run on in house servers.

paulddraper 9y ago
This will satisfy tons of corporate reviews. Businesses put code on Github and Bitbucket all the time. And why are you putting HIPAA information in your code?!?
- fortythirteen 9y ago
  HIPAA isn't only about personal health information. Your application can never run on shared servers at any time.
  - paulddraper 9y ago
    (1) That's not true. (2) Even if it were true, it would only pertain to running your application with PHI.
  - gmiller123456 9y ago
    This is a development environment, not a production one. There should be no HIPPA issues developing and testing your code in public. If there is, then you're doing it wrong. Your point about corporate policies is right on the mark though. Not many corporations are going to want their code sent to a 3rd party in any form, encrypted or otherwise.
  - EpicEng 9y ago
    Yeah that's not true. See AWS's HIPAA certified services for one example.
slackingoff2017 9y ago
If none of the data is visible server side why is this a service in the first place? Everything is a bunch of js running in-browser. Just sell it like JetBrains. Sure home users will pirate it but with IDE's the money is made with companies and enterprise versions anyways.
michaelbuckbee 9y ago
Agreed completely. A similar situation occurs with things like ransomware which technically count as a data breach since they requirement is loss of control of the underlying data (despite no data actually be transmitted out of the network).
roywiggins 9y ago
Aka "we are using SSL and not persisting the code to disk once we have it". Not all that reassuring, other than maybe protecting them from someone stealing a hard drive...

paulddraper 9y ago

This will satisfy tons of corporate reviews. Businesses put code on Github and Bitbucket all the time. And why are you putting HIPAA information in your code?!?

fortythirteen 9y ago
HIPAA isn't only about personal health information. Your application can never run on shared servers at any time.
- paulddraper 9y ago
  (1) That's not true. (2) Even if it were true, it would only pertain to running your application with PHI.
- gmiller123456 9y ago
  This is a development environment, not a production one. There should be no HIPPA issues developing and testing your code in public. If there is, then you're doing it wrong. Your point about corporate policies is right on the mark though. Not many corporations are going to want their code sent to a 3rd party in any form, encrypted or otherwise.
- EpicEng 9y ago
  Yeah that's not true. See AWS's HIPAA certified services for one example.

slackingoff2017 9y ago

If none of the data is visible server side why is this a service in the first place? Everything is a bunch of js running in-browser. Just sell it like JetBrains. Sure home users will pirate it but with IDE's the money is made with companies and enterprise versions anyways.

michaelbuckbee 9y ago

Agreed completely. A similar situation occurs with things like ransomware which technically count as a data breach since they requirement is loss of control of the underlying data (despite no data actually be transmitted out of the network).

roywiggins 9y ago

Aka "we are using SSL and not persisting the code to disk once we have it". Not all that reassuring, other than maybe protecting them from someone stealing a hard drive...