> We need an online list of firms that request this
May be we need a general rating list for software vendors.
401 karma · joined December 17, 2021
May be we need a general rating list for software vendors.
I like the challenges I work on. I work with very smart people. The managers I know well are mostly good people.
But the company is growing fast, and there are new managers running loose every week, marking their territory and making signature changes. That's a bit exhausting.
Ideally, someone would hit the breaks, and come up with a solution where the company get whatever certifucations they need, without pushing me into "I'm hurt, so I'll hurt them back by being less productive" mode. I enjoy being productive.
This is a thing the unions would have exterminated in the past. Problem is, most developers are not in a union.
There is still the choice to "just say no".
Legally I work for a company in the EU which I own.
They are willing to pay for a decent laptop. That is not the issue. The issue is that I feel quite upset about this requirement. My motivation to discuss it here is to get an idea if I am out of touch with current reality (like some old guys some times are) - or if this is a form of cancer it's worth fighting against.
Agree!
No. This comes from the sales people. They want to provide a "SOC 2 Audited" certificate to their potential customers. They don't give a rats ass about actual security.
The upper management does care about security. But I don't think this particular requirement offer much of that.
I have been a developer for more than 3 decades, and I have never even heard about it before.
My host file system is encrypted. If I install the agent, it will complain about the VM's file system not being encrypted. If I double encrypt, compilation times will go up quite a bit. Besides, running the agent in a VM will just be theater. If the host machine is compromised, no security in the VM will mean anything. I could just as well run the agent on dedicated VM with antivirus and disk encryption and just forget about it. Theater is theater. The audience would be the same, and they would see the same Play. However, it would not be ethical. It wold also lower my local security, as it's not impossible for malware to escape from a VM to the host machine. (I have worked for a VM vendor. I know a thing or two about VM's).
I have reasonable good security on my devices. Complying faithfully with this requirement would lower my security. If I silo it in it's own LAN, on it's own hardware, it would lower my job satisfaction and my performance.
That part is clearly Security Theater. Having worked with real security for decades (consulting, training, building server monitoring and alerting tools, building commercial firewalls) I get quite provoked by fake security. For example, this "agent" checks for disk encryption. It does not check for password strength, or even if there is a password (you can use full disk encryption under Linux without any password). It also require anti-virus, which under Linux is more likely to do harm than any good.
What I don't understand is why they choose to do this to their engineering team. I don't know much about SOC 2, but from what I have read, the "concern" is mainly production related. Most of the engineers, including most of the really senior ones, never access production systems.
It took me less then a few minutes after I read the mail to come up with algorithms to implement this thing without compromising my security or privacy. VM. Using an old laptop and remove the wi-fi card. Get a new PC or laptop. Wire whatever I choose on a vlan that goes directly to a VPN server in another country.
However, I still don't like the idea of running an agent on my/a machine. It's a road I feel strongly against going down. But then, I came from a different time, when people still trusted each other and acted in good faith.
However, the reason I asked here is to get a feeling about how common this thing is. Is this normal? Am I the rat in the lab, or am I just late to the party?