3 ms·
Nothing changes. No matter what certification, there’s a scope of what parts of the business and product are in and out of scope of the audit. Fleetsmith having
by ejcx 6y ago
Nothing changes. No matter what certification, there’s a scope of what parts of the business and product are in and out of scope of the audit. Fleetsmith having SOC2 doesn’t bring the rest of Apple into scope
- gsn 6y agoSorry, perhaps I was a bit too pithy in the way I phrased that. I wasn't trying to call into question the certifications, as they were conducted, at the time they were conducted, or implying their scope would change. What I was (perhaps too snarkily) trying to point out is that by unifying—vertically integrating—a previously independent MDM provider with the company that provides the MDM platform, that the promise "we are committed to operating our business in compliance with these standards every year going forward" is highly questionable at this point, unless Apple is committed to maintaining Fleetsmith's independence. Perhaps I should loosen my point even further by asking: how many more papers like https://i.blackhat.com/us-18/Thu-August-9/us-18-Endahl-A-Deep-Dive-Into-macOS-MDM-And-How-It-Can-Be-Compromised-wp.pdf https://i.blackhat.com/us-18/Thu-August-9/us-18-Endahl-A-Dee... should we expect Mr. Endahl to be releasing in the future?
- gsn 6y agoAnd, in the interest of full disclosure, the only real reason I commented at all: I was following the some of the "advice" at "https://news.ycombinator.com/item?id=12897921" https://news.ycombinator.com/item?id=12897921" in hopes of being able to gain all of one additional karma, so I can verify this account with Keybase.
- gsn 6y agoGuess I'll try writing something in LISP instead...