3 ms·

Ernst & Young also give a positive audit to Startssl/Wosign even though they had problems at the time. For that reason Mozilla "no longer accept audits carried

by Leace 8y ago

Ernst & Young also give a positive audit to Startssl/Wosign even though they had problems at the time. For that reason Mozilla "no longer accept audits carried out by Ernst & Young Hong Kong." [0]. [0]: https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...

bsder 8y ago
To be fair, I have never seen an external security audit do anything useful. Either they bend to the folks paying the bills, or they flag a zillion, generally known to engineers, issues. If you really want to make you security audit useless, hand the auditors C code. They will stare at you as though you just handed them the head of a small child.
- mahemm 8y ago
  I have personally been a part of security audits that have found critical vulnerabilities in some of the best-known tech companies on the globe. Just because there exists a world of auditors who function as rubber stamps does not mean we all do.
  - cptskippy 8y ago
    I've been part to numerous audits during my career and there's always an initial findings report with the opportunity to explain away findings such that they never show up on the final report.
    - mahemm 8y ago
      If that's the case then you haven't been working with good auditors. That said, the opportunity to do this (scrub reports) is a driving decision behind many companies' choice to work with more permissive firms. If you want a rubber stamp, you can certainly get it, but if you want a true partner who will find and exploit issues you can get that too.
      - Leace 8y ago
        > if you want a true partner who will find and exploit issues you can get that too. Could you name such a company? This is a perfect opportunity to get to know a good auditor, actually I can't imagine how would one look for a good auditor otherwise.

by Leace 8y ago

bsder 8y ago

To be fair, I have never seen an external security audit do anything useful. Either they bend to the folks paying the bills, or they flag a zillion, generally known to engineers, issues. If you really want to make you security audit useless, hand the auditors C code. They will stare at you as though you just handed them the head of a small child.

mahemm 8y ago
I have personally been a part of security audits that have found critical vulnerabilities in some of the best-known tech companies on the globe. Just because there exists a world of auditors who function as rubber stamps does not mean we all do.
- cptskippy 8y ago
  I've been part to numerous audits during my career and there's always an initial findings report with the opportunity to explain away findings such that they never show up on the final report.
  - mahemm 8y ago
    If that's the case then you haven't been working with good auditors. That said, the opportunity to do this (scrub reports) is a driving decision behind many companies' choice to work with more permissive firms. If you want a rubber stamp, you can certainly get it, but if you want a true partner who will find and exploit issues you can get that too.
    - Leace 8y ago
      > if you want a true partner who will find and exploit issues you can get that too. Could you name such a company? This is a perfect opportunity to get to know a good auditor, actually I can't imagine how would one look for a good auditor otherwise.