3 ms·
> to audit our code and practices annually and publish a public report confirming we're doing what we said we would Some exec to developer: Hey John, KPMG wrot
by lossolo 9y ago
> to audit our code and practices annually and publish a public report confirming we're doing what we said we would
Some exec to developer: Hey John, KPMG wrote to us that they will be here on friday to make an audit, lets just remove those 10 lines that <do whatever that you don't want to be shown in audit> until audit finishes.
I don't want to imply anything about Cloudflare here, just a comment about how useful that kind of private audits are generally.
- gsich 9y agoThat's just it, it's not verifiable. Proving something by letting one audit doesn't change that. It's similar when companies get certified by ISO9001 or 270001, it doesn't prove much. Publishing the full source code could help a little bit, but not much; one doesn't know what code is actually running.