MacOS monitoring the open source way
This is super interesting and ambitious and I&#x27;m always sort of envious when I look at big engineering orgs, like Dropbox and Slack, where everything has fine-grained instrumentation.<p>We do this kind of work for startups, and we have a small roster of companies where we&#x27;re on the hook for this kind of corpsec.<p>But then I think about what it&#x27;d be like to actually deploy and operationalize this stuff, and it gives me pause.<p>I have two big questions --- real questions, like, I have no pretense of having an answer and am speaking from ignorance --- about how this stuff works in practice.<p>The first is privacy. They&#x27;re deploying this across a fleet of company laptops. People do all sorts of stuff on their corp laptops. I don&#x27;t know enough about Dropbox&#x27;s company culture to know whether people ever use their machines for personal stuff, but I do know that occasional personal use is an SFBA startup norm. They&#x27;re collecting essentially a continuous bash history from every user in their fleet. How comfortable are engineers with that? I don&#x27;t have a strong opinion, but it gives me enough pause that I&#x27;d be a little afraid to ask a client to do it.<p>The second is: what do you do with all that information? I see how this addresses malware response, and I see how this would be useful as a forensic archive for general IR. But as a day-to-day tool, connection-by-connection, file-by-file granular data from a mostly technical team seems incredibly noisy. Most engineers look like attackers: they make out-of-process connections to random backend resources, copy things around, and run new code.<p>I acknowledge right away that my vantage point is small startups, not organizations running at the scale Dropbox is.