7 ms·

>"And we wanted to put our money where our mouth was, so we committed to retaining KPMG, the well-respected auditing firm, to audit our code and practices annua

>"And we wanted to put our money where our mouth was, so we committed to retaining KPMG, the well-respected auditing firm, to audit our code and practices annually and publish a public report confirming we're doing what we said we would." It's worth pointing out that KPMG was Wells Fargo's independent auditor while the bank recently committed fraud on a massive scale by creating more than a million fake deposit accounts and 560,000 credit card applications for customers without their knowledge or approval.[1] Calling KPMG a "well-respected auditing firm" when they failed to detect over a million fake bank accounts is a joke. See: https://www.reuters.com/article/wells-fargo-kpmg/lawmakers-question-quality-of-kpmgs-wells-fargo-audits-idUSL1N1HX0XL https://www.reuters.com/article/wells-fargo-kpmg/lawmakers-q... [1] https://www.warren.senate.gov/files/documents/2016-10-27_Ltr_to_KPMG_re_Wells_Fargo_Audits_FINAL.pdf https://www.warren.senate.gov/files/documents/2016-10-27_Ltr...

thenewwazoo 9y ago
Speaking as a former KPMG employee who did infosec, the financial audit and controls people are far removed from anyone with technical skill in this domain. It may be cold comfort, but these kinds of special purpose attestations may as well be done by a different company (insert BearingPoint joke here).
- bogomipz 9y ago
  Right, that's why it's amusing to think we're supposed to believe that KPMG are going to audit a code base and logging infrastructure.
  - ismail 9y ago
    Agreed. Anecdotal but... We have had to supply information to KPMG “IT Auditors” at a client due to some software we wrote. In most cases the auditors are young grads who have never worked in an actual IT/software dev team. So they have very naive view and never ask the right questions. If one wanted to hide something it would be super easy.
    - sameyolo 9y ago
      Audits provide reasonable assurance, not total. When auditors test access controls for a homegrown application for example, it is unreasonable to ask that a full code review is done to check 100% that checking the box next to Admin confers that, and that checking Read Only restricts it always. In my experiences performing these tests (as a young grad who had never worked on a software dev team), we would ask what the permissions were designed to provide and limit, and observe in the system that they did that. If a developer had programmed a backdoor that when you press A+B+3 and whisper into a microphone grants unlogged admin access, our test would miss that. But that's why we also test change controls and who has access to push to live, etc. Edit - and to speak more to the topic at hand, there were plenty of people at the firm I worked with who absolutely had the technical expertise to perform such an in depth audit. They are simply engaged when higher levels of assurance are required. What level of scrutiny should your auditors provide your bathroom time monitoring system?
      - deleted 9y ago
        [deleted]
      - fjsolwmv 9y ago
        The audit checks your documented procedures, not your actual practices.
avip 9y ago
I've worked with KPMG subsidiary for security audit. This is an E&Y kind of company, where you pay x4 to work with the least competent people because you need a familiar name stamped on some report.
- minxomat 9y ago
  KPMG has earned a few nickname acronyms because of this in Germany: "Keiner Prüft Mehr Genau" or "Kinder Prüfen Meine Gesellschaft" ("no one audits carefully anymore" and "children audit my company" respectively). We have a few former KPMG employees. They have many stories to tell, about everything from glass ceilings to harassment.
  - rattray 9y ago
    I don't do business in Germany, but I'm curious; which firms would you say are most-respected there?
    - minxomat 9y ago
      All in all, KPMG is still well respected (so is E&Y and smaller firms). We regularly receive government grants, and the best audit experiences I've had was with the small, EU-funded auditors. They have a high level of integrity and technical/financial knowledge. But that is a very specific niche.
jumelles 9y ago
Genuinely asking, what are some companies that would be a good choice for this sort of thing?
- chrissnell 9y ago
  Many privacy activists believe that the best proof of a no-logging assertion is for a court to order a provider to turn over logs and for the company to be unable to do so.
  - biot 9y ago
    And to prove that they are unable to do so, would they need to get audited?
  - ethics_gradient 9y ago
    Signal did a version of that with the help of aclu.
  - geofft 9y ago
    Isn't the court system mostly powered by the threat of serious jail time if you're found to be lying, and penalties for your lawyers, too? If you say "We don't have those logs," and you swear to it and a lawyer puts their name on the filing, it's not like Judge Alsup will start pentesting your company to find the one employee who accidentally has Dropbox pointed at an sftp mount of some production server.
- tialaramex 9y ago
  As genuine as your question is, there are no good answers. The way we ended up with a Big Four is that the Fifth member of the Big Five (Arthur Andersen) audited Enron, essentially telling everybody that it wasn't an enormous fraud, but it was. All the senior people at AA avoided jail but the audit firm was so obviously untrustworthy it folded. But that doesn't mean the other Four are fine, it just means the "Too Big To Fail" problem is far worse for audit firms than for banking. If we took down one of the Big Four it would probably tank the whole world economy, and they know that, which is Not Good.
thaumasiotes 9y ago
> the bank recently committed fraud on a massive scale by creating more than a million fake deposit accounts and 560,000 credit card applications for customers without their knowledge or approval. Suppose you were a Wells Fargo depositor and a Wells Fargo teller opened a fake account in your name without consulting you. What harm did you suffer? How massive is this fraud if you measure it in a more useful way than "number of accounts"?
- function_seven 9y ago
  The harm to consumers is phony credit history and random fees on many of those fake accounts. The harm to WF shareholders was inflated metrics inflating the value of the company. The whole point of KPMG was to validate these types of metrics for shareholders.
- bogomipz 9y ago
  >"Suppose you were a Wells Fargo depositor and a Wells Fargo teller opened a fake account in your name without consulting you. What harm did you suffer?" Are you joking? The fake accounts were set up in order to bilk customers out of money in the form of overdrafts fees and penalties. "Some customers noticed the deception when they were charged unexpected fees, received credit or debit cards in the mail that they did not request, or started hearing from debt collectors about accounts they did not recognize. But most of the sham accounts went unnoticed, as employees would routinely close them shortly after opening them. Wells has agreed to refund about $2.6 million in fees that may have been inappropriately charged."[1] It also probably impossible to quantify the time customers lost having to deal this. But I think it safe to say it was significant. >"How massive is this fraud if you measure it in a more useful way than "number of accounts" OK lets use dollar amounts as a metric - $2.6 million dollars in fees, levied against your own customers? And considering Well Fargo found an additional 1.4 million previously undisclosed fake accounts as recently as August[2] and that the regulatory probe has now widened beyond their retail banking unit and not includes their private wealth division I would say pretty fucking massive. It's really interesting that you seek to trivialize the scope and severity of a story you seem to know so very little about. [1] https://www.nytimes.com/2016/09/09/business/dealbook/wells-fargo-fined-for-years-of-harm-to-customers.html https://www.nytimes.com/2016/09/09/business/dealbook/wells-f... [2] http://money.cnn.com/2017/08/31/investing/wells-fargo-fake-accounts/index.html http://money.cnn.com/2017/08/31/investing/wells-fargo-fake-a... [3] https://www.barrons.com/articles/federal-probe-expands-to-wells-fargo-wealth-management-1521559054 https://www.barrons.com/articles/federal-probe-expands-to-we...
ismail 9y ago
This has not been the only incident of them having turned a “blind eye” or doing things that were questionable. 1. They looked the other way when 100+ million of public money was laundered out of South Africa. 2. The scheme literally stole money destined to uplift poor rural communities 3. To top it off, a portion of the money was used to write of an extravagant wedding as a business expense. 4. When a junior auditor raised his concerns about the audit he was shut down. http://amabhungane.co.za/article/2017-06-29-guptaleaks-the-dubai-laundromat http://amabhungane.co.za/article/2017-06-29-guptaleaks-the-d... http://amabhungane.co.za/article/2017-06-30-guptaleaks-the-dubai-laundromat-how-kpmg-saw-no-evil-at-the-sun-city-wedding-1 http://amabhungane.co.za/article/2017-06-30-guptaleaks-the-d... http://amabhungane.co.za/article/2017-11-26-guptaleaks-kpmg-missed-more-money-laundering-red-flags http://amabhungane.co.za/article/2017-11-26-guptaleaks-kpmg-... 6. They put out false reports that were partly used as motivation to get rid of ministers fighting corruption. https://www.timeslive.co.za/politics/2017-09-15-kpmg-cans-sars-rogue-unit-report-apologises-to-gordhan/ https://www.timeslive.co.za/politics/2017-09-15-kpmg-cans-sa... KPMG were not the only multinational firm that were complicit in fleecing the South African tax payer of billions. See Mckinsey: http://amabhungane.co.za/article/2017-09-14-how-mckinsey-and-trillian-ripped-r16bn-from-eskom-and-planned-to-take-r78bn-more http://amabhungane.co.za/article/2017-09-14-how-mckinsey-and... SAP: http://amabhungane.co.za/article/2017-07-24-guptaleaks-another-software-giant-implicated-in-kickback-payments http://amabhungane.co.za/article/2017-07-24-guptaleaks-anoth... T-systems: http://amabhungane.co.za/article/2017-11-14-exclusive-gupta-negotiator-and-the-r4bn-transnet-it-deal http://amabhungane.co.za/article/2017-11-14-exclusive-gupta-...
- fjsolwmv 9y ago
  Auditors are never "independent". They work for someone. If that someone is government or a client, great. If the auditor works for management, maybe OK for finding employee malfeasance, but no good for management malfeasance. And of course, like tests, no audit can prove correctness, only can find flaws.
buyx 9y ago
KPMG was also implicated in the massive South African "state capture" scandal involving the (now fugitive) Gupta family and former president Jacob Zuma. Among other things, KPMG issued a-later withdrawn-report that was used to undermine the well-respected finance minister, so that a more malleable person could be installed, while also auditing the Guptas during their worst excesses. Lest we choose to dismiss this as crimes in an insignificant country, KPMG SA has been part of the worldwide group since the 70's, and South Africa's supposedly high auditing standards were a source of national pride. The story seems to have gone dead after some senior leaders fell on their swords, but six months ago, there was serious talk about the firm being shut down in South Africa.
- sizzle 9y ago
  Sounds interesting, got any sources for further reading?
  - mmsimanga 9y ago
    Two links should give you a summary of the issues. I worked one of the biggest retailers in South Africa until a month ago. We dropped KPMG as our auditors because of all the unethical issues relating to them. https://mg.co.za/article/2017-09-15-gordhan-weighs-in-on-kpmg https://mg.co.za/article/2017-09-15-gordhan-weighs-in-on-kpm... And https://www.dailymaverick.co.za/article/2017-09-11-op-ed-the-kpmg-failure-ethical-test-for-sa-business-and-company-directors/ https://www.dailymaverick.co.za/article/2017-09-11-op-ed-the...
  - buyx 9y ago
    FT had a lot of coverage, if you're looking for a non-South African source (linking behind the paywall is probably not going to work, but you can Google for it). https://www.bloomberg.com/news/articles/2017-09-22/kpmg-under-fire-in-south-africa-for-work-done-for-gupta-family https://www.bloomberg.com/news/articles/2017-09-22/kpmg-unde... https://www.telegraph.co.uk/business/2017/09/15/kpmg-south-africa-managers-resign-gupta-scandal/ https://www.telegraph.co.uk/business/2017/09/15/kpmg-south-a... https://www.reuters.com/article/us-kpmg-safrica/kpmgs-south-africa-bosses-purged-over-gupta-scandal-idUSKCN1BQ16P https://www.reuters.com/article/us-kpmg-safrica/kpmgs-south-... http://www.bbc.com/news/business-41283462 http://www.bbc.com/news/business-41283462 It's also been extensively covered in the South African media.
lossolo 9y ago
> to audit our code and practices annually and publish a public report confirming we're doing what we said we would Some exec to developer: Hey John, KPMG wrote to us that they will be here on friday to make an audit, lets just remove those 10 lines that <do whatever that you don't want to be shown in audit> until audit finishes. I don't want to imply anything about Cloudflare here, just a comment about how useful that kind of private audits are generally.
- gsich 9y ago
  That's just it, it's not verifiable. Proving something by letting one audit doesn't change that. It's similar when companies get certified by ISO9001 or 270001, it doesn't prove much. Publishing the full source code could help a little bit, but not much; one doesn't know what code is actually running.
ksk 9y ago
>It's worth pointing out that KPMG was Wells Fargo's independent auditor while the bank recently committed fraud on a massive scale by creating more than a million fake deposit accounts and 560,000 credit card applications for customers without their knowledge or approval.[1] Why is it worth point out? Please detail the work you've done in establilshing that KPMG had access to the data and willfully ignored it.
- hueving 9y ago
  An auditing company is pointless if they can't find fraud on such a massive scale or recognize that something is being hidden from them.
  - ksk 9y ago
    Thats like saying Linux is a useless project because of giant security holes that stay hidden for decades. I prefer to live in the real world, which is a lot more nuanced, and my question still stands.
    - hueving 9y ago
      That's a bad analogy because the Linux project isn't dedicated to auditing the Linux project. It's like calling a home security system pointless if it doesn't detect any forced entries.
      - ksk 9y ago
        I think its a perfect analogy. >because the Linux project isn't dedicated to auditing the Linux project. Huh? Code Review? Testing? The entire point of open source especially w.r.t security is to have millions of eyes on the source. Heck with the entire world being able to audit and review the source code, people still find bugs that were introduced decades ago. >It's like calling a home security system pointless if it doesn't detect any forced entries. I'm afraid that didn't make much sense to me. Anyway, why are we focusing on irrelevant minutia or language anyway. I simply asked a commentor to show the work they've done for basing their opinion.
lillesvin 9y ago
Not that I really want to defend KPMG here, and this is obviously entirely anecdotal, but my team had our application code assessed by them (by request of the customer, so they could get some pointers on what kind of development they needed to focus on). I spent 2 days talking to them, answering questions, showing them data flows, database layouts, system diagrams, etc. They also required access to our source control (making the "let's remove this before the audit" idea pretty useless), issue tracker, etc. The 2 people that I was in contact with were both competent and experienced. Definitely not "young grads who have never worked in an actual IT/software dev team" as someone claimed elsewhere.
reledi 9y ago
Definitely worth pointing out, but I don't take issue with their wording. KPMG has a worldwide presence and is an incredibly popular auditing firm. It's certainly possible for KPMG to be a "well-respected auditing firm" in the public's perception and for them to fail to detect all unethical practices during an audit. While hiring them doesn't prove that Cloudflare's code and practices are sound, it does reduce the risk that they aren't.

thenewwazoo 9y ago

Speaking as a former KPMG employee who did infosec, the financial audit and controls people are far removed from anyone with technical skill in this domain. It may be cold comfort, but these kinds of special purpose attestations may as well be done by a different company (insert BearingPoint joke here).

bogomipz 9y ago
Right, that's why it's amusing to think we're supposed to believe that KPMG are going to audit a code base and logging infrastructure.
- ismail 9y ago
  Agreed. Anecdotal but... We have had to supply information to KPMG “IT Auditors” at a client due to some software we wrote. In most cases the auditors are young grads who have never worked in an actual IT/software dev team. So they have very naive view and never ask the right questions. If one wanted to hide something it would be super easy.
  - sameyolo 9y ago
    Audits provide reasonable assurance, not total. When auditors test access controls for a homegrown application for example, it is unreasonable to ask that a full code review is done to check 100% that checking the box next to Admin confers that, and that checking Read Only restricts it always. In my experiences performing these tests (as a young grad who had never worked on a software dev team), we would ask what the permissions were designed to provide and limit, and observe in the system that they did that. If a developer had programmed a backdoor that when you press A+B+3 and whisper into a microphone grants unlogged admin access, our test would miss that. But that's why we also test change controls and who has access to push to live, etc. Edit - and to speak more to the topic at hand, there were plenty of people at the firm I worked with who absolutely had the technical expertise to perform such an in depth audit. They are simply engaged when higher levels of assurance are required. What level of scrutiny should your auditors provide your bathroom time monitoring system?
    - deleted 9y ago
      [deleted]
    - fjsolwmv 9y ago
      The audit checks your documented procedures, not your actual practices.

avip 9y ago

I've worked with KPMG subsidiary for security audit. This is an E&Y kind of company, where you pay x4 to work with the least competent people because you need a familiar name stamped on some report.

minxomat 9y ago
KPMG has earned a few nickname acronyms because of this in Germany: "Keiner Prüft Mehr Genau" or "Kinder Prüfen Meine Gesellschaft" ("no one audits carefully anymore" and "children audit my company" respectively). We have a few former KPMG employees. They have many stories to tell, about everything from glass ceilings to harassment.
- rattray 9y ago
  I don't do business in Germany, but I'm curious; which firms would you say are most-respected there?
  - minxomat 9y ago
    All in all, KPMG is still well respected (so is E&Y and smaller firms). We regularly receive government grants, and the best audit experiences I've had was with the small, EU-funded auditors. They have a high level of integrity and technical/financial knowledge. But that is a very specific niche.

jumelles 9y ago

Genuinely asking, what are some companies that would be a good choice for this sort of thing?

chrissnell 9y ago
Many privacy activists believe that the best proof of a no-logging assertion is for a court to order a provider to turn over logs and for the company to be unable to do so.
- biot 9y ago
  And to prove that they are unable to do so, would they need to get audited?
- ethics_gradient 9y ago
  Signal did a version of that with the help of aclu.
- geofft 9y ago
  Isn't the court system mostly powered by the threat of serious jail time if you're found to be lying, and penalties for your lawyers, too? If you say "We don't have those logs," and you swear to it and a lawyer puts their name on the filing, it's not like Judge Alsup will start pentesting your company to find the one employee who accidentally has Dropbox pointed at an sftp mount of some production server.
tialaramex 9y ago
As genuine as your question is, there are no good answers. The way we ended up with a Big Four is that the Fifth member of the Big Five (Arthur Andersen) audited Enron, essentially telling everybody that it wasn't an enormous fraud, but it was. All the senior people at AA avoided jail but the audit firm was so obviously untrustworthy it folded. But that doesn't mean the other Four are fine, it just means the "Too Big To Fail" problem is far worse for audit firms than for banking. If we took down one of the Big Four it would probably tank the whole world economy, and they know that, which is Not Good.

thaumasiotes 9y ago

> the bank recently committed fraud on a massive scale by creating more than a million fake deposit accounts and 560,000 credit card applications for customers without their knowledge or approval. Suppose you were a Wells Fargo depositor and a Wells Fargo teller opened a fake account in your name without consulting you. What harm did you suffer? How massive is this fraud if you measure it in a more useful way than "number of accounts"?

function_seven 9y ago
The harm to consumers is phony credit history and random fees on many of those fake accounts. The harm to WF shareholders was inflated metrics inflating the value of the company. The whole point of KPMG was to validate these types of metrics for shareholders.
bogomipz 9y ago
>"Suppose you were a Wells Fargo depositor and a Wells Fargo teller opened a fake account in your name without consulting you. What harm did you suffer?" Are you joking? The fake accounts were set up in order to bilk customers out of money in the form of overdrafts fees and penalties. "Some customers noticed the deception when they were charged unexpected fees, received credit or debit cards in the mail that they did not request, or started hearing from debt collectors about accounts they did not recognize. But most of the sham accounts went unnoticed, as employees would routinely close them shortly after opening them. Wells has agreed to refund about $2.6 million in fees that may have been inappropriately charged."[1] It also probably impossible to quantify the time customers lost having to deal this. But I think it safe to say it was significant. >"How massive is this fraud if you measure it in a more useful way than "number of accounts" OK lets use dollar amounts as a metric - $2.6 million dollars in fees, levied against your own customers? And considering Well Fargo found an additional 1.4 million previously undisclosed fake accounts as recently as August[2] and that the regulatory probe has now widened beyond their retail banking unit and not includes their private wealth division I would say pretty fucking massive. It's really interesting that you seek to trivialize the scope and severity of a story you seem to know so very little about. [1] https://www.nytimes.com/2016/09/09/business/dealbook/wells-fargo-fined-for-years-of-harm-to-customers.html https://www.nytimes.com/2016/09/09/business/dealbook/wells-f... [2] http://money.cnn.com/2017/08/31/investing/wells-fargo-fake-accounts/index.html http://money.cnn.com/2017/08/31/investing/wells-fargo-fake-a... [3] https://www.barrons.com/articles/federal-probe-expands-to-wells-fargo-wealth-management-1521559054 https://www.barrons.com/articles/federal-probe-expands-to-we...

ismail 9y ago

This has not been the only incident of them having turned a “blind eye” or doing things that were questionable. 1. They looked the other way when 100+ million of public money was laundered out of South Africa. 2. The scheme literally stole money destined to uplift poor rural communities 3. To top it off, a portion of the money was used to write of an extravagant wedding as a business expense. 4. When a junior auditor raised his concerns about the audit he was shut down. http://amabhungane.co.za/article/2017-06-29-guptaleaks-the-dubai-laundromat http://amabhungane.co.za/article/2017-06-29-guptaleaks-the-d... http://amabhungane.co.za/article/2017-06-30-guptaleaks-the-dubai-laundromat-how-kpmg-saw-no-evil-at-the-sun-city-wedding-1 http://amabhungane.co.za/article/2017-06-30-guptaleaks-the-d... http://amabhungane.co.za/article/2017-11-26-guptaleaks-kpmg-missed-more-money-laundering-red-flags http://amabhungane.co.za/article/2017-11-26-guptaleaks-kpmg-... 6. They put out false reports that were partly used as motivation to get rid of ministers fighting corruption. https://www.timeslive.co.za/politics/2017-09-15-kpmg-cans-sars-rogue-unit-report-apologises-to-gordhan/ https://www.timeslive.co.za/politics/2017-09-15-kpmg-cans-sa... KPMG were not the only multinational firm that were complicit in fleecing the South African tax payer of billions. See Mckinsey: http://amabhungane.co.za/article/2017-09-14-how-mckinsey-and-trillian-ripped-r16bn-from-eskom-and-planned-to-take-r78bn-more http://amabhungane.co.za/article/2017-09-14-how-mckinsey-and... SAP: http://amabhungane.co.za/article/2017-07-24-guptaleaks-another-software-giant-implicated-in-kickback-payments http://amabhungane.co.za/article/2017-07-24-guptaleaks-anoth... T-systems: http://amabhungane.co.za/article/2017-11-14-exclusive-gupta-negotiator-and-the-r4bn-transnet-it-deal http://amabhungane.co.za/article/2017-11-14-exclusive-gupta-...

fjsolwmv 9y ago
Auditors are never "independent". They work for someone. If that someone is government or a client, great. If the auditor works for management, maybe OK for finding employee malfeasance, but no good for management malfeasance. And of course, like tests, no audit can prove correctness, only can find flaws.

buyx 9y ago

KPMG was also implicated in the massive South African "state capture" scandal involving the (now fugitive) Gupta family and former president Jacob Zuma. Among other things, KPMG issued a-later withdrawn-report that was used to undermine the well-respected finance minister, so that a more malleable person could be installed, while also auditing the Guptas during their worst excesses. Lest we choose to dismiss this as crimes in an insignificant country, KPMG SA has been part of the worldwide group since the 70's, and South Africa's supposedly high auditing standards were a source of national pride. The story seems to have gone dead after some senior leaders fell on their swords, but six months ago, there was serious talk about the firm being shut down in South Africa.

sizzle 9y ago
Sounds interesting, got any sources for further reading?
- mmsimanga 9y ago
  Two links should give you a summary of the issues. I worked one of the biggest retailers in South Africa until a month ago. We dropped KPMG as our auditors because of all the unethical issues relating to them. https://mg.co.za/article/2017-09-15-gordhan-weighs-in-on-kpmg https://mg.co.za/article/2017-09-15-gordhan-weighs-in-on-kpm... And https://www.dailymaverick.co.za/article/2017-09-11-op-ed-the-kpmg-failure-ethical-test-for-sa-business-and-company-directors/ https://www.dailymaverick.co.za/article/2017-09-11-op-ed-the...
- buyx 9y ago
  FT had a lot of coverage, if you're looking for a non-South African source (linking behind the paywall is probably not going to work, but you can Google for it). https://www.bloomberg.com/news/articles/2017-09-22/kpmg-under-fire-in-south-africa-for-work-done-for-gupta-family https://www.bloomberg.com/news/articles/2017-09-22/kpmg-unde... https://www.telegraph.co.uk/business/2017/09/15/kpmg-south-africa-managers-resign-gupta-scandal/ https://www.telegraph.co.uk/business/2017/09/15/kpmg-south-a... https://www.reuters.com/article/us-kpmg-safrica/kpmgs-south-africa-bosses-purged-over-gupta-scandal-idUSKCN1BQ16P https://www.reuters.com/article/us-kpmg-safrica/kpmgs-south-... http://www.bbc.com/news/business-41283462 http://www.bbc.com/news/business-41283462 It's also been extensively covered in the South African media.

lossolo 9y ago

> to audit our code and practices annually and publish a public report confirming we're doing what we said we would Some exec to developer: Hey John, KPMG wrote to us that they will be here on friday to make an audit, lets just remove those 10 lines that <do whatever that you don't want to be shown in audit> until audit finishes. I don't want to imply anything about Cloudflare here, just a comment about how useful that kind of private audits are generally.

gsich 9y ago
That's just it, it's not verifiable. Proving something by letting one audit doesn't change that. It's similar when companies get certified by ISO9001 or 270001, it doesn't prove much. Publishing the full source code could help a little bit, but not much; one doesn't know what code is actually running.

ksk 9y ago

>It's worth pointing out that KPMG was Wells Fargo's independent auditor while the bank recently committed fraud on a massive scale by creating more than a million fake deposit accounts and 560,000 credit card applications for customers without their knowledge or approval.[1] Why is it worth point out? Please detail the work you've done in establilshing that KPMG had access to the data and willfully ignored it.

hueving 9y ago
An auditing company is pointless if they can't find fraud on such a massive scale or recognize that something is being hidden from them.
- ksk 9y ago
  Thats like saying Linux is a useless project because of giant security holes that stay hidden for decades. I prefer to live in the real world, which is a lot more nuanced, and my question still stands.
  - hueving 9y ago
    That's a bad analogy because the Linux project isn't dedicated to auditing the Linux project. It's like calling a home security system pointless if it doesn't detect any forced entries.
    - ksk 9y ago
      I think its a perfect analogy. >because the Linux project isn't dedicated to auditing the Linux project. Huh? Code Review? Testing? The entire point of open source especially w.r.t security is to have millions of eyes on the source. Heck with the entire world being able to audit and review the source code, people still find bugs that were introduced decades ago. >It's like calling a home security system pointless if it doesn't detect any forced entries. I'm afraid that didn't make much sense to me. Anyway, why are we focusing on irrelevant minutia or language anyway. I simply asked a commentor to show the work they've done for basing their opinion.

lillesvin 9y ago

Not that I really want to defend KPMG here, and this is obviously entirely anecdotal, but my team had our application code assessed by them (by request of the customer, so they could get some pointers on what kind of development they needed to focus on). I spent 2 days talking to them, answering questions, showing them data flows, database layouts, system diagrams, etc. They also required access to our source control (making the "let's remove this before the audit" idea pretty useless), issue tracker, etc. The 2 people that I was in contact with were both competent and experienced. Definitely not "young grads who have never worked in an actual IT/software dev team" as someone claimed elsewhere.

reledi 9y ago

Definitely worth pointing out, but I don't take issue with their wording. KPMG has a worldwide presence and is an incredibly popular auditing firm. It's certainly possible for KPMG to be a "well-respected auditing firm" in the public's perception and for them to fail to detect all unethical practices during an audit. While hiring them doesn't prove that Cloudflare's code and practices are sound, it does reduce the risk that they aren't.