Last I checked major companies are still outsourcing essential engineering to save a buck.
A bit old, but how was this practice ever acceptable.
https://www.propublica.org/article/defense-department-pentag...
A multi trillion dollar company( Microsoft) too cheap to hire onshore for DoD contracts.
There's quite a history of US federal programs encouraging critical federal systems to operate within private infrastructure. This once required very strict scrutiny, joint DoD/DHS/GSA reviews, and was generally a long/expensive process that created the perception that a few providers had a gotten a hold over various agencies through these outsourced operations, which, combined with a fresh "interest" in federal efficiency, influenced a recent national defense budget authorization to formalize a slew of processes with a few minor tweaks as the law of the land, with a tweak or two to allow new cloud operators and service providers to authorize quickly and operate efficiently, particularly for low-risk classes.
Today, this means SASS providers must find an engineer with clearance (not just authorization to work in the USA). This cleared programmer documents and authors a whole host of (typically new) procedures, such as authenticating against a "federal enclave" authorization directory, delivering changes authored upstream to a government-controlled CI/CD system, and working with the SASS provider and the Government Services Agency (GSA) to ensure the backend operates when running within something that could be compared to a special AWS AZ. Things change upstream, and our operator prepares a 'significant change' request, which is, if important, gated by a liaison from the GSA. No one is responsible for scrutinizing implementation details of these 'significant change' requests, nor are their authors required to provide any information about themselves or the code's provenance. Given that hundreds of programmers may have written code included in said change (which is typically already deployed upstream), this is often efficient and generally fine.
Generally.
Step 2. Copy it into your repo. Who cares what the license says, how would the authors of that code ever see it being misused, because the place it is being misused requires a security clearance?
Step 3. Deliver the code as yours.
Truly, how will the people who authored something on GitHub ever know? Any circumstance you describe would require someone without clearance to know implementation details of some software. Which is to say, either the thing I describe happens all the time, or security clearances are overblown.
Digital Escorts
A problem is some people and teams are world class at a big company... But not everyone, everywhere. For a fun time, read about the rollout and internals of Azure.
They're quite famous for being lax in security - mostly because they're a massive corporation, but also because they're high profile
But keep in mind Google got hacked by the Chinese in 2009 or so.
But they weren’t and probably aren’t and won’t be. They just put forth an image as much as needed to sell.
Another possibility is advertising shadow profiles are able to correlate logged in accounts across YouTube and other properties.
We love to talk rubbish about finance bros but that industry has had independent auditing as part of its DNA for a century[1]
[1]: https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act
Also, if vulnerabilities are so easy to find, it should also be easy to detect them through a simple red team exercise.
In my career I've seen maybe two companies have pretty good protections. Both had government contracts so they had no choice. Otherwise there's no reason for companies to secure their stack. They make money easier without it.
The buildings are on fire because they're being built out of straw because it's cheaper. Only a government regulation to build out of brick is going to stop the fires.
Yes?
Can’t say I’ve seen this?
"as if"
The usage of shape here triggers me.
Trying to protect ourselves by putting restrictions on the technology would be like trying to hide from a tiger by wrapping a towel around our heads on the basis that if we can't see it then it can't see us. That trick only works on imaginary monsters, not real ones.
Defense is the only way.
You don't realize it, I imagine, but you're essentially advocating for the contemporary equivalent of requiring a license to print text on paper and distribute it.
Digital intelligence seems much less controllable. Near frontier weights are already out there, you don't necessarily need massive datacenters if you're not trying to serve commercially. Even if we we're somehow able to control what OTHER nations do through either treaties or threats of sanctions/force, working on this stuff is easily in range of many of the larger criminal orgs. Beyond all of that, there's always the chance that weights from authorized providers find their way "out the back door".
We've seen with crypto and darknet markets that even if you can fight this kind of stuff and catch bad actors, the most actual change you're going to effect is a temporary slowdown and the next guy who tries is going to be that much better. I don't doubt that regulation is going to be the initial route this goes, mostly due to the financial interests of the frontier companies and the desire to keep this build-out solvent for as long as possible rather than any true concern for actual safety and sanity. What's really going to need to happen though, in my very insignificant opinion of course, is we are going to have to change from the ground up how our digital infrastructure is built.
Maybe with the coming changes that is for the best too, our current systems are designed for people and I don't know the current numbers but it seems like agent traffic is already the bigger percentage. We may not be able to build our infrastructure on top of these large mountains of human designed legacy code. Maybe we need to be thinking about new kernels, new servers, new protocols and stacks.
We seem to be very quickly reaching a point where is something is not mathematically provable to be secure then it is not secure at all.