Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Delve – Fake Compliance as a Service

deepdelver.substack.com

Post reply on HN
Print view View original

311–320 of 327 posts

Re: Delve – Fake Compliance as a Service

#311

Post by torginus »

jolux wrote: post #310
torginus wrote: post #262

Earlier quoted context omitted.

Not really, and I kinda envy you that you haven't really worked up close with compliance-related people. A lot of compliance is basically corruption - while in country A, you might fall out of a window if you don't buy from the right people at 10x prices, but in 'civilized' country B, you have to buy from vendor X (who has the necessary paperwork), at 10x prices, or you wont be able to sell the product - and there ar…

Sonarqube did not flag public fields as a security issue by default the last time I used it — however it has found several real vulnerabilities for me before.

It did by default for me, and there are a bunch of other poorly implemented analyses, such as it incorrectly flagging Dictionary keys in C# as mutable, or opinionated stuff like it disliking certain names and patterns, forcing me to make arbitrary changes that often cost performance, readability or API cleanliness.

Or insane stuff like it doing a blanket-ban on security related code in the app (but importing a third party lib that does the same is fine).

The analyses in general are low quality and you can see not a lot of effort or thought went into them.

They are not the product - compliance, and dashboards for boomers is.

I'm curious about what did it detect for you? In my experience it stops very obvious bad patterns like using string manipulation to submit SQL (which in certain circumstances might even be fine, even necessary), but it can't really trace non-obvious security issues (like tracing a value through the code, making sure its valid on every codepath), it just doesn't have the compiler machinery to do that.

Re: Delve – Fake Compliance as a Service

#312

Post by torginus »

BrandoElFollito wrote: post #298
littlestymaar wrote: post #234

Earlier quoted context omitted.

> 80% of Compliance has always been a performative box checking exercise. You're making the same mistake as most people do: it's 80% box checking but that doesn't make it performative, the box checking is here so that the dude who checked the box become legally responsible for what's happening if they haven't done what they said they did. If you didn't check that box you could always claim you didn't know you weren't…

There is no relation between checking a box and becoming legally responsible for the vast majority of certifications. The company may be legally in troble if the planets are aligned but that's all.

Compliance is crazy sucky - I remember there being a case when one of our vendors was harvesting data like crazy, and we went after them. It was grossly in violation of GDPR, like as bad as it could get.

When we reached out to them, they showed us a cert about how they were GDPR compliant, issued by a huge brand-name consulting firm.

In the paper they said they implemented certain standard-mandated cryptographic measures to 'anonymize' the data. Thing is, they implemented them wrong on purpose, so that they could actually identify users by inverting hashes with a rainbow table.

There was a lot of BS legal reasoning in there but the bigname firm signed off on it. Oh and at the bottom, it had a provision, that if the company were to be sued for breach of GDPR, the consluting firm would not be liable any way.

But this was good enough for tons of companies and govt agencies to just use that software.

So that's what compliance certs get you.

Re: Delve – Fake Compliance as a Service

#313

Post by BrandoElFollito »

torginus wrote: post #312
BrandoElFollito wrote: post #298

Earlier quoted context omitted.

There is no relation between checking a box and becoming legally responsible for the vast majority of certifications. The company may be legally in troble if the planets are aligned but that's all.

Compliance is crazy sucky - I remember there being a case when one of our vendors was harvesting data like crazy, and we went after them. It was grossly in violation of GDPR, like as bad as it could get. When we reached out to them, they showed us a cert about how they were GDPR compliant, issued by a huge brand-name consulting firm. In the paper they said they implemented certain standard-mandated cryptographic meas…

Yes, I know it first-hand.

At least in cybersecurity, there are no certifications that "certify" that you are secure. There are plenty of them that will assess your processes, their execution, etc., but the reality of the risk is next door. This is typically the case for ISO 27001, which has ISO 27002 (the ex British Standard from the 90s) that theoretically governs the controls you should have in place. But it simply does not work.

When you have a major leak, this is usually a company with half a page of certifications, but, hey, mistakes happen. The key problem that these mistakes come from is a fundamentally wrong approach to cybersecurity, but nobody cares.

Re: Delve – Fake Compliance as a Service

#314

Post by jolux »

torginus wrote: post #311
jolux wrote: post #310

Earlier quoted context omitted.

Sonarqube did not flag public fields as a security issue by default the last time I used it — however it has found several real vulnerabilities for me before.

It did by default for me, and there are a bunch of other poorly implemented analyses, such as it incorrectly flagging Dictionary keys in C# as mutable, or opinionated stuff like it disliking certain names and patterns, forcing me to make arbitrary changes that often cost performance, readability or API cleanliness. Or insane stuff like it doing a blanket-ban on security related code in the app (but importing a third…

It has found actual reproducible SQL injections for me as well as XXE vulns.

Re: Delve – Fake Compliance as a Service

#316

Post by nostrebored »

lowkey_ wrote: post #196
alanning wrote: post #162

For those looking for help with SOC2 compliance, I had a good experience with another YC company, Vanta. That was some years ago so not sure if anything has changed since then but I would recommend checking them out.

I had a pretty poor experience as a startup on Vanta. Maybe this is my own ignorance, but I told them when our contract was to renew that we do NOT want to renew. We were an early-stage startup soon to shut down and didn't need it. We never touched Vanta for 10 months before this, we never got SOC-2 (it was deprioritized). Not a single login in 10 months. Nevertheless, they said it was: too late to opt out, that it c…

It sounds like you signed a contract and weren’t happy with the terms. This is the point of a contract, though.

Re: Delve – Fake Compliance as a Service

#317

Post by pas »

BrandoElFollito wrote: post #313
torginus wrote: post #312

Earlier quoted context omitted.

Compliance is crazy sucky - I remember there being a case when one of our vendors was harvesting data like crazy, and we went after them. It was grossly in violation of GDPR, like as bad as it could get. When we reached out to them, they showed us a cert about how they were GDPR compliant, issued by a huge brand-name consulting firm. In the paper they said they implemented certain standard-mandated cryptographic meas…

Yes, I know it first-hand. At least in cybersecurity, there are no certifications that "certify" that you are secure. There are plenty of them that will assess your processes, their execution, etc., but the reality of the risk is next door. This is typically the case for ISO 27001, which has ISO 27002 (the ex British Standard from the 90s) that theoretically governs the controls you should have in place. But it simpl…

can you please explain what is the wrong approach and how it would be correct/good?

Re: Delve – Fake Compliance as a Service

#318

Post by pas »

itsankur wrote: post #225
zoklet-enjoyer wrote: post #212

Earlier quoted context omitted.

I always think of obsidian when I see their name and that's reflective

pretty sure he means blackstone or blackrock

Blackstone is the PE

blackrock is the asset manager

though I'm not saying it couldn't have been the latter

Re: Delve – Fake Compliance as a Service

#319

Post by bedatadriven »

egorfine wrote: post #246
bedatadriven wrote: post #84

Earlier quoted context omitted.

I don't want to work wherever you do your thing. Software as a service means you provide a service, and you should take your responsibility to protect your customer's data super seriously. Compliance frameworks are one useful tool among many to support this effort. It helps us identify gaps, identify risks, make improvements. It also give us a way to communicate what we do to our partners. The behavior described in t…

I think the thing we are confusing here is "compliance" vs the "highest possible standards". In theory these two terms mean the same thing. In practice compliance can be detrimental to the cause and values that you and I both share seemingly. > I am a founder, and my ambition includes meeting the highest possible standards for my customers. Same here. This is why I don't care about "compliance" - because I take the p…

Compliance with what requires KYC? Nothing in ISO-27001 requires you to collect any information about your customers. Unless there are laws that require you to. Knowing your vendors is another story.

Re: Delve – Fake Compliance as a Service

#320

Post by laidoffamazon »

amanhij wrote: post #302
laidoffamazon wrote: post #221

Earlier quoted context omitted.

I genuinely think this is because the elites like the MIT dropouts that started this company think the rest of us observers are stupid. They have a billboard with the copy "Compliance before you tell your parents you dropped out of MIT"

Yeah that's a wild billboard lmao. btw 99% of MIT people are no different then the rest they just worked hard or paid hefty amounts, I have lots of friends that went there. Nonetheless the 1% are geniuses. Also saying MIT dropouts instantly makes your story credible, it's a funny concept. I'm starting to feel like an MIT dropout these days.

>btw 99% of MIT people are no different then the rest they just worked hard or paid hefty amounts

I don't think that's true. I didn't get into any elite schools unlike almost all of them.

Post reply on HN