Comment by ianpenney | Hacker News Reader

Comment by ianpenney | Hacker News Reader

Parent Full thread

If you want to go fast, go alone. If you want to go far, go together. If you want to pass an IT audit, good fucking luck to you.

I have about 20 years of experience dealing with this ranging from mostly harmonious all the way to civil war.

100 employees and 130 different SaaS tools. Got buy in from senior management to reduce footprint to lower cost and increase security and compliance only to get pushback from every middle manager that would bring up these same reasons why THEIR team is special.

Ok Mr/Mrs Team lead… be careful what you wish for because TCO and full RP status is now on your head. And I know you don’t have the experience to assess the costs, risks and admin workload but you’ve managed to convince the CEO. Not my problem anymore. I’ll let the auditors know where to find you when it comes time.

At least I was smart enough to know to keep Miro, though. They’re reasonably good at managing data over the course of staff churn and the flexible licensing is nice.

Try convincing everyone that grammarly is a keystroke logger.

> Try convincing everyone that grammarly is a keystroke logger.

Funny how it's not the opposite viewpoint that is scrutinized. Prove how it's not a keystroke logger, then Grammarly can be deployed. Until then, it's assumed to be malicious. That's how people treat for example ChatGPT as well.

I'm not sure if there is official research on this, but the 'opposite viewpoint' sounds expensive and more prone to failing in practice. Software companies generally struggle to get results even with a willingness to use any tool or practice that might improve productivity. It will only get worse if they add paperwork.

And it isn't very risk-based. In most cases, the keylogger can be assumed to be entering via the OS, probably based on some NSA/GRU/Chinese MSS exploit being used for industrial espionage. Grammarly is a bit more niche.

It is a threat. One day it will be an acute one, perhaps. But the risks and opportunities favour recklessness.

Yet those same people happily use Office 365 without a second thought.

Microsoft is a serious corporation, i.e. a fat target for lawsuits. That makes them more trusted by default than random fly-by-night startups.

On top of that, any medium or large business using Microsoft tools will have a contract signed with them, one that covers SLA and data handling policies. In fact, this is pretty much the entire value proposition of Azure deployments of OpenAI models - from a corporate POV, OpenAI itself is a fly-by-night startup that can disappear any day, while leaking the company secrets your employees gave it all across the Internet. In contrast, Microsoft's ChatGPT (the very same models) comes with an SLA and data handling policies suitable for dealing with corporate secrets (with whole stack of audits and certifications behind them). That's why corporate will tell you to not use ChatGPT, but if you're lucky, they'll give you access to a copy of it on Azure.

Are there other popular tools you'd recommend/not recommend given cost/compliance concerns?

My advice here won't be one-size-fits all and there's far too much to cover against your company's mission to just give you a hot list of tools I like.

The biggest line of battle is going to be Google Workspace vs Office 365. I'm fine with them both, but not fine with giving them both to everyone. The problem is, if the majority of your company's documents and drive data is fractured over both MS and Google's clouds, it's going to be a nightmare to manage. Choose one and make them your identity provider and life partner. I understand the finance team probably needs a stand-alone Excel license, though.

The other very important part of standardization is hardware. This is something I had to get a bit ruthless about, because managing a fleet over an entirely remote trans-border workforce is expensive if you expect quick turnaround times on onboarding and an immediate replacement for that VIP who just cracked their screen.

I ended up setting up a rapid logistics operation using drop shipping.

Sales, marketing, etc get a 13" Macbook Air M1. Developers get a 16" M1 Pro because they justifiably need the performance.

No, we don't do custom orders. Not big enough to have spares of all kinds in stock (Apple supply chain lag was a real drag last year). Apple's MDM systems make those machines useless bricks to anyone outside the client's company. (If this sounds like something you need, reach out to me!)

I guess I'll just add that my biggest pet peeve with SaaS vendors is how they want you to pay for the super-duper-expensive package just to get SSO / SAML. That's ridiculous. It's not a cost center for you and it reduces both our risk. If I don't see at least "Sign in with Google" in your cheapest plan, I'm already pissed off as a customer and not going to be your change agent.

Thanks for your insights! Haven't had to think about these issues as an individual dev.

Reply on news.ycombinator.com