[nodesocket]

Anybody else surprised that their billing and identity system[1] is publically accessible (login required of course). Shouldn't this only be accessible within a trusted zone (office/VPN)?

[1] https://billing.37signals.com

[jpalomaki]

Not necessarily, Google is doing something similar: https://cloud.google.com/beyondcorp/

And of course there's many companies who use Github and various other online services for core activities.