What about the context.ai security team?

You can blame individuals, but security is a property of the system.

pxc 2 days ago | parent | next [-]

I doubt they had one. Context.ai got acquihired by OpenAI when it was still a very small company. I think they were winding down the original business, so it's unlikely that it grew after that.

▲

baxtr 2 days ago | parent | prev | next [-]

It’s a very fine line. How do you check if people adhere to policies and at the same time don’t monitor them permanently?

▲

Topfi 2 days ago | parent [-]

Endpoint Detection and Response?

Heck, not giving the person Admin privileges would have sufficed to prevent this. Or better hiring preventing people who install Roblox cheats on work devices...

There is no excuse and no fine line here. Even outside them boasting about SOC 2 Type II, this would be embarrassing for an SME not in the tech sector.

▲

baxtr 2 days ago | parent [-]

OP was talking about the security team. Not sure what you are proposing?

Do you want to let any applicant be screened by the security team?

▲

Topfi 2 days ago | parent | next [-]

Any security team that gives unrestricted admin privileges to random employees is not a security team. So doing the most basic parts of their job, that would be my proposal.

If specific to my hiring comment, was meant a bit facetious, though I will point out this line in their "compliance" report by "auditor" Delve:

> The organization carries out background and/or reference checks on all new employees and contractors prior to joining in accordance with relevant laws, regulations and ethics. Management utilizes a pre-hire checklist to ensure the hiring manager has assessed the qualification of candidates to confirm they can perform the necessary job requirements.

Maybe those pre-hire checklists should include a question like "Are you a massive idiot, who'd install a game on their work computer, then on top of that be the type of idiot who likes to cheat, then on top of that be the type of idiot to install cheats on your work computer?", maybe that'd prevent this in the future. Or again, just don't give everyone Admin privileges...

	▲	baxtr a day ago \| parent [-]
		I think one of us misunderstood how the event happened. In my understanding restricting local admin rights would not have change anything here. The Vercel employee signed up for Context.ai (a third-party tool) using their work account and granted it "Allow All" access to their environment. Maybe Admin-Managed Consent would have helped prevent context.ai access the environment but this is not configured locally on the employee's machine. It is a cloud-level setting managed within their identity provider's administrative portal.

▲

Topfi 2 days ago | parent | prev [-]

Just an addition to the prior comment: To be as generous as possible, I just pulled their audit report [0] and to answer your question, all I propose is that they stick to this (especially the part on minimum permissions, any extended permissions need to be reasonable and reasoned for, etc), which they did not. The fault lies threefold:

First of all with the team members as Context.ai, that either weren't experienced or did not care enough to know that the "all green" they got from Delve straight away couldn't have been accurate.

Secondly, with the people at Delve who, at least in this isolated case, seem to not have fulfilled their obligations and are suspected to have done so in a consistent, repeated and intentionally malicious manner.

Third, the people who, despite claiming to have done their due diligence, being experienced investors and professionals in the field whose own prior companies also had to undergo audits in the past, looked at Delve and were willing to overlook the misdeeds for financial gain.

[0] https://news.ycombinator.com/item?id=47848077

▲

ErroneousBosh 2 days ago | parent | prev [-]

The bootings will continue until the fuckups improve.