5 ms·

> no source code on your laptop Cybersecurity policies and work from home has always been extraordinarily strange to me. Optical character recognition exists.

by urthor 4y ago

> no source code on your laptop Cybersecurity policies and work from home has always been extraordinarily strange to me. Optical character recognition exists. Big Corp, trust me, if I wanted to steal your stuff, I'd have it already. Stop locking my laptop down, we both know that's mostly a scare tactic.

formercoder 4y ago
The definition of “on laptop” is pretty ambiguous also
- cmrdporcupine 4y ago
  It's also almost entirely arbitrary since Google lets iOS and Android app developers work off laptop (there isn't much a choice with iOS because the toolchain won't run on a gLinux workstation anyways).
giantg2 4y ago
I think the main concern is theft of the laptop. They do trust you. They don't want someone to have your drive with proprietary source, even if the drive is encrypted.
- prepend 4y ago
  Sounds like they should fix this with better laptop encryption. There’s many cheap methods to make source code on a stolen laptop useless. Using this as an excuse may mean that the org is stupid or lies to employees. Since this is Google, I think this just means that they don’t trust employees. And that’s a bad situation. If you can’t trust employees to not do bad things with the tools required for their jobs, then it’s going to result in unhappy and unproductive people. It’s like not giving carpenters nail guns because someone killed someone.
  - giantg2 4y ago
    "Sounds like they should fix this with better laptop encryption." I'm not aware of any security experts that share this reasoning, if the information is truly sensitive and high value. "There’s many cheap methods to make source code on a stolen laptop useless." Such as?
    - prepend 4y ago
      I have a security clearance and follow protocols on my device to process sensitive data. Here’s something that came back fro Google, https://www.esd.whs.mil/Portals/54/Documents/DD/iss_process/Processing_TS_and_SCI_Issuances.pdf?ver=cQ46hb5Fz9ZqL_eDnt6Cag%3D%3D https://www.esd.whs.mil/Portals/54/Documents/DD/iss_process/... If my laptop is stolen and the thief doesn’t have my keys the data contained is worthless and isn’t a breach notification at all.
      - giantg2 4y ago
        Where is that in that document?
  - KaiserPro 4y ago
    > Since this is Google, I think this just means that they don’t trust employees Since this is google, the repo is hundreds of terabytes. Not only that, having lots of copies hanging around on laptops is a big risk, even with encryption. Considering that google's likely threat model involves state actors, not having code on laptops is a reasonable mitigation. But I suspect the biggest issue is that most of the tooling is design to run on whatever version of linux Google runs, not OSX/Windows/ubuntu.
    - prepend 4y ago
      As a developer, I don’t see a situation where I need the whole codebase, just the portion I work with. State actors have security clearances for employees with equipment that allows them to contain state secrets on devices. This is a solved problem and Google not allowing any on device source code is not a security issue, it’s a control issue.

by urthor 4y ago

formercoder 4y ago

The definition of “on laptop” is pretty ambiguous also

cmrdporcupine 4y ago
It's also almost entirely arbitrary since Google lets iOS and Android app developers work off laptop (there isn't much a choice with iOS because the toolchain won't run on a gLinux workstation anyways).

giantg2 4y ago

I think the main concern is theft of the laptop. They do trust you. They don't want someone to have your drive with proprietary source, even if the drive is encrypted.

prepend 4y ago
Sounds like they should fix this with better laptop encryption. There’s many cheap methods to make source code on a stolen laptop useless. Using this as an excuse may mean that the org is stupid or lies to employees. Since this is Google, I think this just means that they don’t trust employees. And that’s a bad situation. If you can’t trust employees to not do bad things with the tools required for their jobs, then it’s going to result in unhappy and unproductive people. It’s like not giving carpenters nail guns because someone killed someone.
- giantg2 4y ago
  "Sounds like they should fix this with better laptop encryption." I'm not aware of any security experts that share this reasoning, if the information is truly sensitive and high value. "There’s many cheap methods to make source code on a stolen laptop useless." Such as?
  - prepend 4y ago
    I have a security clearance and follow protocols on my device to process sensitive data. Here’s something that came back fro Google, https://www.esd.whs.mil/Portals/54/Documents/DD/iss_process/Processing_TS_and_SCI_Issuances.pdf?ver=cQ46hb5Fz9ZqL_eDnt6Cag%3D%3D https://www.esd.whs.mil/Portals/54/Documents/DD/iss_process/... If my laptop is stolen and the thief doesn’t have my keys the data contained is worthless and isn’t a breach notification at all.
    - giantg2 4y ago
      Where is that in that document?
- KaiserPro 4y ago
  > Since this is Google, I think this just means that they don’t trust employees Since this is google, the repo is hundreds of terabytes. Not only that, having lots of copies hanging around on laptops is a big risk, even with encryption. Considering that google's likely threat model involves state actors, not having code on laptops is a reasonable mitigation. But I suspect the biggest issue is that most of the tooling is design to run on whatever version of linux Google runs, not OSX/Windows/ubuntu.
  - prepend 4y ago
    As a developer, I don’t see a situation where I need the whole codebase, just the portion I work with. State actors have security clearances for employees with equipment that allows them to contain state secrets on devices. This is a solved problem and Google not allowing any on device source code is not a security issue, it’s a control issue.