5 ms·
> But then… a couple of months later, Google completely removed the option for us to scan our own code. Instead, to keep access to Google Drive, we would now ha
by davedx 2y ago
> But then… a couple of months later, Google completely removed the option for us to scan our own code. Instead, to keep access to Google Drive, we would now have to pay one of Google’s business partners to conduct the review.
What a racket. Smells downright anti-competitive The EU will have fun with this when it catches up.
- rammer 2y agoIt wasn't even that expensive. Ada security audit from tekta in Spain was under 4k. There's nothing like a racket here. The list of certification agencies goes from KPMG at top end to smaller companies.
- anakaine 2y ago4k is not expensive in enterprise terms, but in small bootstrapped startup terms it is absolutely expensive.
- imhoguy 2y agoAnd the issue is the other corporations may likely follow, so you have to stack hefty audit sum every year for multiple monopolistic cloud vendors because you made some cheap documents scanner app with convenient storage options for your user.
- davedx 2y agoThey're partners, not just agencies you independently get to choose, right? That's what I'm getting at with the racket part. You don't get to interop with one of the biggest cloud providers in the world unless you complete commercial audits with one of their partners. Given the kind of collusion Google's shown itself capable of [1] do you really think this is all fair? [1] https://en.wikipedia.org/wiki/High-Tech_Employee_Antitrust_Litigation https://en.wikipedia.org/wiki/High-Tech_Employee_Antitrust_L...
- aaronharnly 2y agoJust as a data point, we paid $750 for one of these engagements (scan + some discussion about use cases etc) to one of Google's preferred providers. There were multiple options for providers.
- petre 2y ago> Smells downright anti-competitive The EU will have fun with this when it catches up What? The EU wants to introduce certifications for all products and services, further kneecapping local innovation through regulation and costly certifications. https://digital-strategy.ec.europa.eu/en/policies/cybersecurity-act https://digital-strategy.ec.europa.eu/en/policies/cybersecur...
- davedx 2y agoSeems more like a harmonization effort than what Google is proposing here? Or maybe I'm reading it wrong. If I don't get one of these mandarin-approved certifications, will I no longer be able to do business? [The Google audits are a hard barrier to connecting to their cloud platform] It's perhaps a difference between prescriptive and descriptive.
- petre 2y agoI suspect interference from European industry groups coupled with EU bureaucrats' failure to understand technology and willingness to make software 'secure' by doing paperwork.
- mardifoufs 2y agoThe EU absolutely loves adding requirements for certifications, so no I don't think they would get involved here. In fact, it's something they are pushing for in general.
- davedx 2y agoCan you expand on what you mean? Which commercial certifications has the EU pushed?
- fragmede 2y ago> The EU will have fun with this when it catches up. I don't think you know how the EU works.
- bigfatkitten 2y agoI wonder which VP+ at Google is getting kickbacks from KPMG?