3 ms·

It’s hard to sign off SOC2 compliance when you know that npm and maven packages can be introduced by any mistake on your team and contain an “Upload all files f

It’s hard to sign off SOC2 compliance when you know that npm and maven packages can be introduced by any mistake on your team and contain an “Upload all files from HDD to a rogue server” script. I’d need to operate administrative files (customer records, contracts, accounting) on a separate machine from dev… App sandboxing is… the way it will go, for insurance reasons.

wila 4y ago
> I’d need to operate administrative files (customer records, contracts, accounting) on a separate machine from dev You're saying that like it is a bad thing? A developer probably shouldn't have access to all that live data anyways.
- eastbound 4y ago
  As a founder-developer of a company of 3, would you expect me to have 2 computers, for the security of customer data? It’s an interesting idea, I’m just asking.
  - skrtskrt 4y ago
    For such a small company I would probably expect that data like that would probably just live in a cloud service like GSuite that’s already SOC2 compliant, then if you’re running software integrations against that data, you’re spinning up isolated SOC2-compliant cloud servers to do so. Unfortunately unless you get ridiculously creative and put in a bunch of extra time instead of cloud service spend, SOC2 compliance is gonna be expensive
  - leaflets2 4y ago
    QubesOS, then you can have many more than two. 32 GB laptop memory is good to have.
  - wila 4y ago
    Oh I am well aware about the differences between "how it should be" and what is actually the case when you're a small developer. For this kind of issue one could use VM's where you encrypt the VM with the live customer data. Another option would be to use cloud. But yes.. there's also nothing wrong with having more than one machine to physically separate the systems and thus data. Bonus on that one is that you can shut it down if not needed and as such it won't be accessible over the network unless switched on. Personally -as a small developer myself- I use all of the above.
anankaie 4y ago
If this continues into the long-term without solution, I suspect paid package repos will start making an appearance, whereby only vetted versions of components are available. At least one big company already maintains internal clones of repos with registration of every version of every component used (I know this through personal experience) and I have no doubts the others are doing the same, especially if they are into cloud or government contracts.
- leaflets2 4y ago
  What about urgent security vulnerabilities in such components? Do these companies have people on-call who can security review urgent security fixes in the components? Or how does it work (say, Log4j and the fixes need to get reviewed urgently, and let's pretend the language wasn't Java but a language that fewer people could understand?)

wila 4y ago

> I’d need to operate administrative files (customer records, contracts, accounting) on a separate machine from dev You're saying that like it is a bad thing? A developer probably shouldn't have access to all that live data anyways.

eastbound 4y ago
As a founder-developer of a company of 3, would you expect me to have 2 computers, for the security of customer data? It’s an interesting idea, I’m just asking.
- skrtskrt 4y ago
  For such a small company I would probably expect that data like that would probably just live in a cloud service like GSuite that’s already SOC2 compliant, then if you’re running software integrations against that data, you’re spinning up isolated SOC2-compliant cloud servers to do so. Unfortunately unless you get ridiculously creative and put in a bunch of extra time instead of cloud service spend, SOC2 compliance is gonna be expensive
- leaflets2 4y ago
  QubesOS, then you can have many more than two. 32 GB laptop memory is good to have.
- wila 4y ago
  Oh I am well aware about the differences between "how it should be" and what is actually the case when you're a small developer. For this kind of issue one could use VM's where you encrypt the VM with the live customer data. Another option would be to use cloud. But yes.. there's also nothing wrong with having more than one machine to physically separate the systems and thus data. Bonus on that one is that you can shut it down if not needed and as such it won't be accessible over the network unless switched on. Personally -as a small developer myself- I use all of the above.

anankaie 4y ago

If this continues into the long-term without solution, I suspect paid package repos will start making an appearance, whereby only vetted versions of components are available. At least one big company already maintains internal clones of repos with registration of every version of every component used (I know this through personal experience) and I have no doubts the others are doing the same, especially if they are into cloud or government contracts.

leaflets2 4y ago
What about urgent security vulnerabilities in such components? Do these companies have people on-call who can security review urgent security fixes in the components? Or how does it work (say, Log4j and the fixes need to get reviewed urgently, and let's pretend the language wasn't Java but a language that fewer people could understand?)