Hacker News Reader

Comment by fortythirteen | Hacker News Reader

> This made clear that offering the tool as a cloud service is an issue in corporate environments. To mitigate this, the CLI now encrypts all source code on your machine, the service decrypts it only in memory to run the analyzer and then all sources are immediately deleted.

That wouldn't cover any of the corporate policies I've seen. It's a total no go for companies under government regulation like HIPAA.

Company lawyers will block devs from using your service. IMHO, you have to provide an enterprise version of your platform that can run on in house servers.

View on HN

Aka "we are using SSL and not persisting the code to disk once we have it". Not all that reassuring, other than maybe protecting them from someone stealing a hard drive...

If none of the data is visible server side why is this a service in the first place? Everything is a bunch of js running in-browser.

Just sell it like JetBrains. Sure home users will pirate it but with IDE's the money is made with companies and enterprise versions anyways.

This will satisfy tons of corporate reviews.

Businesses put code on Github and Bitbucket all the time.

And why are you putting HIPAA information in your code?!?

HIPAA isn't only about personal health information. Your application can never run on shared servers at any time.

(1) That's not true.

(2) Even if it were true, it would only pertain to running your application with PHI.

This is a development environment, not a production one. There should be no HIPPA issues developing and testing your code in public. If there is, then you're doing it wrong.

Your point about corporate policies is right on the mark though. Not many corporations are going to want their code sent to a 3rd party in any form, encrypted or otherwise.

Yeah that's not true. See AWS's HIPAA certified services for one example.

Agreed completely. A similar situation occurs with things like ransomware which technically count as a data breach since they requirement is loss of control of the underlying data (despite no data actually be transmitted out of the network).

Reply on news.ycombinator.com