8 ms·
"I wonder if they have any sales to large enterprises or similar institutions." Yes, certainly. We frequently fill out very detailed checklists and questionna
by rsync 6y ago
"I wonder if they have any sales to large enterprises or similar institutions."
Yes, certainly.
We frequently fill out very detailed checklists and questionnaires related to our quality policy, standards, internal policies, etc.
We're also very honest about how we approach these issues:
https://www.rsync.net/resources/regulatory/pci.html https://www.rsync.net/resources/regulatory/pci.html
... and they generally appreciate the honesty.
- chris_wot 6y agoMan, everything about your service is simple and direct! Amazing.
- learn_more 6y agoFYI, your "pricing" link at the top of that pci.html page 404's. The pricing link works from other pages however.
- rsync 6y agoI see that that has now been fixed - thanks for pointing it out.
- punnerud 6y agoThe “burger menu” does not work on iPhone. Works from the front page.
- colejohnson66 6y agoIf we’re discussing website bugs, the “SSAE16 / SAS70” page[0] mentions 2015 as “upcoming” [0]: https://www.rsync.net/resources/regulatory/sas70.html https://www.rsync.net/resources/regulatory/sas70.html
- deleted 6y ago[deleted]
- divbzero 6y agoThis is extremely honest and transparent. In addition to being good marketing, it probably attracts customers who won’t make BS support requests.
- high_byte 6y ago> Our platform only answers on port 22 with OpenSSH. I do security and I title this "Most secured platform in the world."
- StavrosK 6y agoOh yeah? Well I run one where no ports are open. In fact, I haven't even connected it to the network.
- navaati 6y agoIt’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_report.pdf https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.
- vidarh 6y agoI once had a someone report responding to ping as a vulnerability. For the public facing firewall. We sent them back a link of prominent servers that respond to ping. Including the web server of the expensive agency that had produced the report. And whose web server had an expired SSL certificate.
- Alupis 6y agoWell, PCI compliance is different from regular server administration (a lot of it being smoke and mirrors, yes). I do not believe ICMP (ping) is an automatic-fail condition for PCI (at least for certain SAQ levels that I'm familiar with) - however they do show up as warnings, particularly if you can get a timestamp response (to be used in timing-based attacks). PCI prefers systems that handle CHD be "invisible" to the outside world, in an attempt to hide the systems an attacker might take interest in. Not always feasible (eCommerce, for example), but you gotta jump through the PCI hoops if you don't want to be stuck holding the bag if there's some breach.
- darkarmani 6y agoPCI compliance is to reduce the chances of legal liability. Better security is sometimes a side-effect of that compliance.
- humaniania 6y agoTo reduce the liability of the credit card company maybe, by making the process so complex and onerous that it is virtually impossible to complete a survey without some error or omission that would almost assuredly be used as a reason to invalidate any liability for the credit card company should some bad event take place. Source: have had to complete PCI surveys from multiple vendors.
- ornornor 6y agoBeen a happy customer for a while now, really love what you’re doing. I wish more companies were as direct and competent.
- tinco 6y agoIsn't the nice thing about having an access fortress, that you can monitor the access more simply? Or is it just as simple for you to monitor access to all the identically configured machines? I suppose it might be.
- kubanczyk 6y agoI believe the usual name is a bastion host, not an access fortress.
- TheTaytay 6y agoI was just lamenting the state of these forms today. I feel like many of the questions are variations on the theme of “what antivirus software do you use to protect your basement mainframe from your corporate network traffic?” “N/A” isn’t a long enough answer, so it feels like you need to keep explaining “the Internet”, LLC of a centralized corporate network, SaaS, etc. Is there a modern, no-nonsense guide to filling these out honestly without telling the person doing the checkbox checking that their form is dumb? I realize there’s a lot of rent seeking and money to be made by consultants in this space - I’m looking for the GitHub published guide or wiki to help smaller no-nonsense shops navigate the phrasing and map these vendor security questionnaires to “modern” technology.
- TheTaytay 6y agoThis is going to look like I'm a plant with the timing of my comment and this "Launch HN" post that just made it to the front page, but with that out of the way: https://news.ycombinator.com/item?id=26513040 https://news.ycombinator.com/item?id=26513040 Looks like Stacksi is aiming to fix this pain point.