3 ms·
What plans do you have for a third-party audit/review of your backend to verify the claims being made? Its one thing to use this service on the basis of encryp
by boffinAudio 2y ago
What plans do you have for a third-party audit/review of your backend to verify the claims being made?
Its one thing to use this service on the basis of encryption claims - its another thing to have to clean up the mess from a forgotten API key being leaked somewhere... is there, therefore, a third party involved in an audit of Jazz?
- theanzelm 2y agoFirst it's all open source so even without knowing that my paid service uses the same open source libraries, you can verify yourself that nothing leaves the client unencrypted. Of course we will also do public audit(s) with security companies to make sure our cryptographic protocols are sound and implemented correctly.
- boffinAudio 2y agoThanks for the info. Of course, "its all open source" is a fair answer, but its also a dangerous one, since it shifts culpability for verification to anyone who has the time/resources to audit the open source components that you're using. But, it also has to be stated, there is no guarantee that you're using only the open source components you've declared, which is why an impartial audit by a third party would be necessary before this project can be used to build products in some industries. Anyway, I see that you have other concerns, so no worries and thanks for the honest answer.
- theanzelm 2y agoJust making sure that you saw the point where we will do an impartial third party audit!
- boffinAudio 2y agoI did, and I hope you will promote that fact a bit more overtly, because its kind of important for some .. especially in Europe ..