3 ms·

Because of MITM-ing TLS with their own certificates, they could also stop you from dumping tons of code into an LLM prompt by blocking all public LLMs (or even

Because of MITM-ing TLS with their own certificates, they could also stop you from dumping tons of code into an LLM prompt by blocking all public LLMs (or even all sites not on an allowlist). The reason it's silly is really that you can always take "secrets" with you, be it by taking photos with your phone ("lets ban phones") or memorizing or writing on paper. Security is useful when it prevents accidental, inadvertent leakage of information ("stop me from shooting myself in the foot"). Anything else, and the inconvenience will make people figure out ways around it. And the real reason people won't leak information is either ethics and morality, or legal liability.

MattPalmer1086 2y ago
You overestimate the intelligence of a lot of people. We have caught attempts at exfiltration over channels we can easily monitor. Is it perfect? No. Can reasonably intelligent people find a way around them? Sure. But we are still going to control that information flow where we can.
- necovek 2y ago
  So, as the OP claims, it is working for the 35% of the employees, right? And it likely inconveniences a full 100%. Does that sound like a smart trade-off?
  - MattPalmer1086 2y ago
    What is the alternative? I have actually worked in places that prevented all personal electronic devices in the building, had security guards and bag searches on every floor and no internet access on your desktop. You don't know what inconvenience looks like!
    - necovek 2y ago
      I am sure it can be even worse than what you describe. I, however, do not aspire to taste it. The question is not what "inconvenience looks like", but rather, what is "enough security with the least inconvenience?" The alternative is in the answer to that question: if your "measure" is likely to be "bypassed", it is worse than not having it in the first place (because bypassing usually puts sensitive data on even worse medium like flash devices, public cloud, external servers etc). If your security policy was simply "Do not keep sensitive work data on unencrypted storage" and had informed your employees they are legally liable to adhere to this, they would either choose to not use personal devices or understand the risks if they do. So like always, getting to that point requires "simply" being reasonable and smart ("common sense" which is, unfortunately, "not that common").

MattPalmer1086 2y ago

You overestimate the intelligence of a lot of people. We have caught attempts at exfiltration over channels we can easily monitor. Is it perfect? No. Can reasonably intelligent people find a way around them? Sure. But we are still going to control that information flow where we can.

necovek 2y ago
So, as the OP claims, it is working for the 35% of the employees, right? And it likely inconveniences a full 100%. Does that sound like a smart trade-off?
- MattPalmer1086 2y ago
  What is the alternative? I have actually worked in places that prevented all personal electronic devices in the building, had security guards and bag searches on every floor and no internet access on your desktop. You don't know what inconvenience looks like!
  - necovek 2y ago
    I am sure it can be even worse than what you describe. I, however, do not aspire to taste it. The question is not what "inconvenience looks like", but rather, what is "enough security with the least inconvenience?" The alternative is in the answer to that question: if your "measure" is likely to be "bypassed", it is worse than not having it in the first place (because bypassing usually puts sensitive data on even worse medium like flash devices, public cloud, external servers etc). If your security policy was simply "Do not keep sensitive work data on unencrypted storage" and had informed your employees they are legally liable to adhere to this, they would either choose to not use personal devices or understand the risks if they do. So like always, getting to that point requires "simply" being reasonable and smart ("common sense" which is, unfortunately, "not that common").