Post #3134779

2024-01-18 13:47 UTC

@thisismissem@hachyderm.io @WPalant@infosec.exchange this seems to omit the other side of the story. If I understand this correctly, vendor software was making undocumented calls to outside infrastructure and sharing potentially sensitive data. It should be in company's right to check the level of exposure to properly protect their and their customers' rights.

Replies (2)

@tempelorg@iosdev.space 2024-01-18 14:43

@RakowskiBartosz@hachyderm.io @thisismissem@hachyderm.io @WPalant@infosec.exchange Well, no. You can't demand the right to look into the internals of your partners - they have a right to privacy as well. You are instead "protected" by the law that requires the partner to protect your privacy interests, or by contracts. What that law is missing, however, is a way to universally verify that they do it correctly, e.g. by independent auditors. Which isn't often feasible, though. It's all a compromise, and it sucks.

Open ##3134780
@riley@toot.cat 2024-01-18 23:19

@RakowskiBartosz@hachyderm.io Surely you forgot to add a sarcasm tag. The vendor is almost certainly out of GDPR compliance. @thisismissem@hachyderm.io @WPalant@infosec.exchange

Open ##3134781