3 ms·
It's Signal's job to prioritize safety/privacy/security over all other concerns, and the job of an enterprise IT operation to manage risk. Underrated how differ
by tptacek 10mo ago
It's Signal's job to prioritize safety/privacy/security over all other concerns, and the job of an enterprise IT operation to manage risk. Underrated how different those jobs --- security and risk management --- are!
Most normal people probably wouldn't enjoy working in a shop where Signal owned the risk management function, and IT/dev had to fall in line. But for the work Signal does, their near-absolutist stance makes a lot of sense.
- pipo234 10mo agoThat's an interesting take, but it sounds like you're downplaying the actual risks of enterprise users running agents on their desktop(?). What would your say would be a prudent posture an IT manager should take to control risk to the organisation?
- tptacek 10mo agoAnybody who has ever run an internal pentest knows there's dozens of different ways to game-over an entire enterprise, and decisively resolving all of them in any organization running at scale is intractable. That's why it's called risk management, and not risk eradication.
- pipo234 10mo agoRisk management is not my day job, but I'm aware of a cottage industry of enterprise services and appliances to map out, prevent and mitigate risks. Pentest are part of those as are keeping up with trends and literature. So on the subject of something like Recall or Copilot what tools and policies does an it manager have at their disposal to prevent let's say unintentional data exfiltration or data poisoning? (Added later:) How do I make those less likely to happen?