"That's not SOC 2 compliant"

(ampcode.com)

33 points | by tosh 1 hour ago

8 comments

  • aleda145 56 minutes ago
    This stance is a breath of fresh air. In my experience change management is the first thing to slap on when a bad release happens.

    I've worked at a large enterprise that have a "Change Advisory Board", that you need to convince when you want to bump the major version on your linter. It has the effect of velocity slowing down to a crawl. Changes have to large, since otherwise it wouldn't be approved by the CAB. A slow mess.

    At my current place we have to loudly declare "I CONFIRM COMPLIANCE" in every PR description. I'm not sure that anyone knows why, but it keeps the bureaucrats happy. Shrug

    • esikich 48 minutes ago
      My favorite thing about CABing things that shouldn't be CABd is that it then bunches up changes that all happen at the same time... after the CAB meeting. Now if something breaks, it could be any of the dozens of things that just got pushed in the 15 minutes after the meeting.
  • jpollock 1 hour ago
    I was in a high trust environment that didn't use dual auth on some things. They lost $250k to embezzlement.

    High trust is high trust until someone exploits it, and the likelihood of encountering an exploit (embezzlement, fraud, political speech, etc.) approaches 100 as the total number of staff hours increase.

  • abofh 1 hour ago
    Youre required to have a policy. That policy may be throwing bananas at the wall, but if it's documented and you follow it, you're compliant with policy.
    • whirlwin 46 minutes ago
      That's a good way to kill off motivated employees.

      "We don't know why we're doing it - it's just mandatory".

  • whirlwin 48 minutes ago
    Does there exist any tool to analyze PR feedback quality and usefulness?

    I've been trying to explain to compliance employees that if the majority of PR reviews anyway is just "LGTM - Just merge" (I don't care), what's the actual value of PRs? It's just facade.

    On a different note, we're looking into artifact attestations and admissions through Sigstore, which is solves many of the same challenges but through different means.

  • kazinator 48 minutes ago
    AICPA should have spent 5 seconds on a web search to find out that SoC means System on a Chip, and chosen something else.
  • NewJazz 1 hour ago
    Soc2 is pointless.

    But how do they review each other's work? Prs are indispensable for collaboration...

    • Tomte 56 minutes ago
      We‘ve had code reviews before GitHub existed. PRs are a tool. And just one tool among many.
      • matsemann 53 minutes ago
        They (companyin the article) don't, though, hence the question. Is there even one set of eyes on this code, given the amount of agents they use?
    • mparramon 58 minutes ago
      You can pair program.
  • jaylane 44 minutes ago
    there goes the neighborhood
  • rohansood15 57 minutes ago
    So an engineer who knows your codebase and tests can sneak in malicious code/backdoors because you're high trust.

    And I am guessing you'll extend that high trust to your agents/'orbs' next. And I am sure you'll find an auditor who'll go with it coz frankly most don't care.

    I am not surprised there are folks willing to do this, but I am surprised that you feel you must brag about it. And you ARE bragging when you title the post the way you did. Good luck.

    • matsemann 52 minutes ago
      Yeah, saying it's verified with tests is kinda moot when the code change can just modify the same tests or verifications that will be run on it.