Hacker News Reader

Comment by davedx | Hacker News Reader

> But then… a couple of months later, Google completely removed the option for us to scan our own code. Instead, to keep access to Google Drive, we would now have to pay one of Google’s business partners to conduct the review.

What a racket. Smells downright anti-competitive The EU will have fun with this when it catches up.

View on HN

Just as a data point, we paid $750 for one of these engagements (scan + some discussion about use cases etc) to one of Google's preferred providers. There were multiple options for providers.

It wasn't even that expensive. Ada security audit from tekta in Spain was under 4k.

There's nothing like a racket here. The list of certification agencies goes from KPMG at top end to smaller companies.

4k is not expensive in enterprise terms, but in small bootstrapped startup terms it is absolutely expensive.

And the issue is the other corporations may likely follow, so you have to stack hefty audit sum every year for multiple monopolistic cloud vendors because you made some cheap documents scanner app with convenient storage options for your user.

They're partners, not just agencies you independently get to choose, right? That's what I'm getting at with the racket part.

You don't get to interop with one of the biggest cloud providers in the world unless you complete commercial audits with one of their partners.

Given the kind of collusion Google's shown itself capable of [1] do you really think this is all fair?

[1] https://en.wikipedia.org/wiki/High-Tech_Employee_Antitrust_L...

The EU absolutely loves adding requirements for certifications, so no I don't think they would get involved here. In fact, it's something they are pushing for in general.

Can you expand on what you mean? Which commercial certifications has the EU pushed?

> The EU will have fun with this when it catches up.

I don't think you know how the EU works.

I live here, I have a fairly good idea. The EU has quite aggressively pursued different big tech companies over the last few years. The fines have become quite material.

That's true, no one could miss that, but the EU is not noted for it's lack of bureaucracy.

I wonder which VP+ at Google is getting kickbacks from KPMG?

> Smells downright anti-competitive The EU will have fun with this when it catches up

What? The EU wants to introduce certifications for all products and services, further kneecapping local innovation through regulation and costly certifications.

https://digital-strategy.ec.europa.eu/en/policies/cybersecur...

Seems more like a harmonization effort than what Google is proposing here? Or maybe I'm reading it wrong.

If I don't get one of these mandarin-approved certifications, will I no longer be able to do business? [The Google audits are a hard barrier to connecting to their cloud platform]

It's perhaps a difference between prescriptive and descriptive.

I suspect interference from European industry groups coupled with EU bureaucrats' failure to understand technology and willingness to make software 'secure' by doing paperwork.

Reply on news.ycombinator.com