4 ms·

I typically do not like Google and a lot of ways the company acts and performs. However, recently I moved into sysadmin-type work, partly doing work for state

I typically do not like Google and a lot of ways the company acts and performs. However, recently I moved into sysadmin-type work, partly doing work for state governments. Cybersecurity is really bad everywhere, and it’s scary, and it’s frustrating how abstract and very theoretical all the risk is as it makes hard (justifiably) to take seriously. Anyway, Google’s reputation with security is (fingers crossed) nothing short of “almost bulletproof”, and I’d love to see more IoT devices from them. With the recent rollout of Nest Security System, we’ve actually been advising lots of small businesses to combine this system, along with Nest cameras + fire alarms as a solution to actual physical security and fulfilling compliance alarms. Since Nest also does cellular backup in case of internet outage, we just hook everything up to an APC and the whole system can run for 10+ hours without power or internet. Also also, Android security sucks. Not Google’s fault, but thank god they moved to making their own phones. Maybe that will encourage better behaviors from other manufacturers.

throwawayfinal 9y ago
If Google is using GCP internally, then their infrastructure is as you said. The GCP "best practices" sections in the docs* have been top tier in my experience and you can learn a lot, even if you're using AWS or Azure. * my one complaint is that searching for the docs almost always ends you up on marketing pages, which you then have to find the docs link on.
ocdtrekkie 9y ago
Android security is Google's fault. Any kidding yourself that might occur through believing that OEMs deserve any blame for an update mechanism (or lack thereof) in a system designed by Google is pretty easily discredited, especially when you consider it took Google five months to patch KRACK in the Pixel 2, when third party ROM authors did it in two days. Also, Google's "reputation with security" needs some serious nuance: They are very good at preventing types of exploits they care about, but they are a literal joke when it comes to security that interfaces with submitted content and user choice. Consider that the Chrome Web Store is a literal cesspool of malware, and that a lot of websites blatantly try to force you to install extensions through the Chrome Web Store which steal your browsing data. Since extensions are permitted to request such a huge security hole, Google doesn't consider it their problem that extensions do it maliciously. Because Google doesn't consider something they gave permission to do malicious things to be an exploit or vulnerability, Google can simultaneously claim that Chrome is the most secure browser, and it be literally the easiest browser to get malware with. I can definitely agree with you that state level government security has a long way to go and is a pretty scary place. But Google can't fix it, because the biggest problem in government security is still humans, a security layer that Google has repeatedly demonstrated no understanding of.
- Bucephalus355 9y ago
  Thanks for your reply, and that sucks to hear about Google. My positive perception mainly comes from this super paranoid dude, Michael Bazzell: https://inteltechniques.com/experience.html https://inteltechniques.com/experience.html. He both hates Google for their data collection and also respects it for their security practices. Ugh I also hate to hear they’re doing the “we’re secure but who knows about our 3rd parties” practice. State IT does this as well. As long as you sign some contract with them that promises them you do NSA-style security, they’ll buy anything from you. Of course what 5-man IT shop wouldn’t sign a $20,000,000 IT contract when worst case, they get a bad audit and have to spend 50k really quickly to get up to SOC II? You can literally find a list of State IT contractors for most govs, and just go through them finding all the fly-by-night shops. That being said, the big vendors aren’t that much better either... tl;dr: everyone sucks and be afraid and use mfa
  - ocdtrekkie 9y ago
    I am floored when I tell some vendor they can't do something because it isn't secure, and they look at me like nobody's ever told them that before. My general impression is "I can't seriously be the first person who's ever said this, can I?" The thing people need to remember is that the CIA Director's AOL email account got hacked. In 2015. We are so far as a society from where we should be.
  - bitmapbrother 9y ago
    You should research his post history. His angle is to disparage Google every opportunity he gets.
    - Bucephalus355 9y ago
      Wait is this about me? Dude my opening line is about how I disparage Google almost all of the time.
      - joshuamorton 9y ago
        No, he's likely referring to ocdtrekkie.
euyyn 9y ago
I think if you look at the work we're doing to make Android Things secure, you'll like it too.
conception 9y ago
I just wanted to throw out for folks this - nest secure does not appear to support fire monitoring via the protect with a Mo tutoring service - The Nest Protect Smoke & CO sensor does not qualify as a 24 hour monitored fire protection device. This is due to the requirement from Nest that the user must first verify that the Nest protect fire alarm signal is or could be real before the monitoring service will receive the fire alarm signal and dispatch the fire department -- This was a deal breaker for me using the nest eco system for home security -and- fire protection. Other systems don't suffer from this. It's too bad as I like the tech but it's not bulletproof yet.
pjmlp 9y ago
> Not Google’s fault, b 100% Google's fault when they don't do contracts enforcement with OEMs. No upgrades, no access to Play store and other related Google services, easy they just don't want to do it, plain and simple.

throwawayfinal 9y ago

If Google is using GCP internally, then their infrastructure is as you said. The GCP "best practices" sections in the docs* have been top tier in my experience and you can learn a lot, even if you're using AWS or Azure. * my one complaint is that searching for the docs almost always ends you up on marketing pages, which you then have to find the docs link on.

ocdtrekkie 9y ago

Android security is Google's fault. Any kidding yourself that might occur through believing that OEMs deserve any blame for an update mechanism (or lack thereof) in a system designed by Google is pretty easily discredited, especially when you consider it took Google five months to patch KRACK in the Pixel 2, when third party ROM authors did it in two days. Also, Google's "reputation with security" needs some serious nuance: They are very good at preventing types of exploits they care about, but they are a literal joke when it comes to security that interfaces with submitted content and user choice. Consider that the Chrome Web Store is a literal cesspool of malware, and that a lot of websites blatantly try to force you to install extensions through the Chrome Web Store which steal your browsing data. Since extensions are permitted to request such a huge security hole, Google doesn't consider it their problem that extensions do it maliciously. Because Google doesn't consider something they gave permission to do malicious things to be an exploit or vulnerability, Google can simultaneously claim that Chrome is the most secure browser, and it be literally the easiest browser to get malware with. I can definitely agree with you that state level government security has a long way to go and is a pretty scary place. But Google can't fix it, because the biggest problem in government security is still humans, a security layer that Google has repeatedly demonstrated no understanding of.

Bucephalus355 9y ago
Thanks for your reply, and that sucks to hear about Google. My positive perception mainly comes from this super paranoid dude, Michael Bazzell: https://inteltechniques.com/experience.html https://inteltechniques.com/experience.html. He both hates Google for their data collection and also respects it for their security practices. Ugh I also hate to hear they’re doing the “we’re secure but who knows about our 3rd parties” practice. State IT does this as well. As long as you sign some contract with them that promises them you do NSA-style security, they’ll buy anything from you. Of course what 5-man IT shop wouldn’t sign a $20,000,000 IT contract when worst case, they get a bad audit and have to spend 50k really quickly to get up to SOC II? You can literally find a list of State IT contractors for most govs, and just go through them finding all the fly-by-night shops. That being said, the big vendors aren’t that much better either... tl;dr: everyone sucks and be afraid and use mfa
- ocdtrekkie 9y ago
  I am floored when I tell some vendor they can't do something because it isn't secure, and they look at me like nobody's ever told them that before. My general impression is "I can't seriously be the first person who's ever said this, can I?" The thing people need to remember is that the CIA Director's AOL email account got hacked. In 2015. We are so far as a society from where we should be.
- bitmapbrother 9y ago
  You should research his post history. His angle is to disparage Google every opportunity he gets.
  - Bucephalus355 9y ago
    Wait is this about me? Dude my opening line is about how I disparage Google almost all of the time.
    - joshuamorton 9y ago
      No, he's likely referring to ocdtrekkie.

euyyn 9y ago

I think if you look at the work we're doing to make Android Things secure, you'll like it too.

conception 9y ago

I just wanted to throw out for folks this - nest secure does not appear to support fire monitoring via the protect with a Mo tutoring service - The Nest Protect Smoke & CO sensor does not qualify as a 24 hour monitored fire protection device. This is due to the requirement from Nest that the user must first verify that the Nest protect fire alarm signal is or could be real before the monitoring service will receive the fire alarm signal and dispatch the fire department -- This was a deal breaker for me using the nest eco system for home security -and- fire protection. Other systems don't suffer from this. It's too bad as I like the tech but it's not bulletproof yet.

pjmlp 9y ago

> Not Google’s fault, b 100% Google's fault when they don't do contracts enforcement with OEMs. No upgrades, no access to Play store and other related Google services, easy they just don't want to do it, plain and simple.