News for hackers. Stuff that matters.
Re:Working Group Last Call: QUIC protocol drafts by JoshTriplett on Wednesday June 10, 2020 @04:56PM (#23482016)
> I believe you continue to ignore the obligation of businesses to protect data.

On the contrary. I think it's critical for businesses to protect customer data. Many customer data breaches are "someone left the S3 bucket open" or "someone had the database on an unencrypted laptop in their car" or "someone broke into the production database using a security hole we failed to patch". How many customer data breaches are "one of our employees intentionally leaked the customer database"?

The sign of a good security policy is that your employees are actively trying to help you. The sign of a bad "security" policy is pervasive word-of-mouth knowledge on how to bypass that "security" policy to get work done. Which network is more likely to experience a breach?

(I should also clarify that there's a difference between "policies for the corporate network" and "policies for direct access to the production datacenter network", as one of many examples. Lock that down to the point that you can't easily access it, and nobody can do so without oversight.)

> if you think companies don't have a right or desire to monitor the systems

Companies have a right and a desire to run ads, and yet adblockers exist, and generally speaking the adblockers win for anyone who installs one.

Re:Working Group Last Call: QUIC protocol drafts by unethical_ban on Wednesday June 10, 2020 @05:47PM (#23482525)
>Companies have a right and a desire to run ads, and yet adblockers exist, and generally speaking the adblockers win for anyone who installs one.

I see this isn't going anywhere - you didn't acknowledge that if you work at Intel, you 100% have a web proxy on your campus despite saying otherwise, and now you're comparing adblocking by a private user on their computer on their time, and someone accessing the internet from their company's network on their company's time when and uploading arbitrary data across the Internet.

Again, you make some good points interlaced with bad ones: Yes, limit desktop access to corporate servers. Have strong IAM and auditing. But you think there is some right to have all the privacy in the world on their machine on their time. I fundamentally disagree.

And would you, or whoever is doing it, stop downvoting me? Despite our disagreements, this has been a substantive argument.

Re:Working Group Last Call: QUIC protocol drafts by JoshTriplett on Wednesday June 10, 2020 @08:06PM (#23483664)
I don't generally comment on my employer, and I especially don't post about their internal policies. But I think it's reasonable to post this much, insofar as it's also a question I'd also answer for anyone thinking of interviewing: no, there's no MITM proxy. (There is a proxy; it does not MITM.)

> And would you, or whoever is doing it, stop downvoting me?

1) You can't downvote people who reply to you. 2) Discussions about downvotes are off-topic. 3) Downvoting to express disagreement is explicitly allowed.