mirror of https://github.com/zulip/zulip.git
security: Remove discussion of how other SaaS providers work.
While from my anecdotal experience, it is accurate that at many SaaS providers, dozens or even hundreds of engineers have access to production infrastructure, the "essentially all" statement isn't true (not sure how that got added), and in any case, there aren't great public sources we can cite to educate folks who might think Silicon Valley startup practices are better than they actually are.
This commit is contained in:
parent
d05f731c1c
commit
0e2f360177
|
@ -131,10 +131,8 @@ the industry:
|
|||
- All access to user data (messages, streams, uploaded files, etc.) in the
|
||||
Zulip backend is through carefully-audited core libraries that validate
|
||||
that the user who is making the request has access to that data.
|
||||
- With many SaaS providers, essentially all engineers have direct shell
|
||||
access to production servers storing user data. Zulip Cloud is different:
|
||||
only a small handful of security-trained engineers have access to
|
||||
production servers or to sensitive customer data.
|
||||
- Only a small handful of people have access to production servers or
|
||||
to sensitive customer data.
|
||||
- Our error handling systems are have been designed from the beginning to
|
||||
avoid including user message content in error reports, even in cases where
|
||||
this makes debugging quite difficult (e.g. bugs in the message rendering
|
||||
|
|
Loading…
Reference in New Issue