5 ms·

From a security perspective, we ask: why are you developing applications that can't be ran by normal users? For the 1% of devs working on system level stuff we

by dsl 11y ago

From a security perspective, we ask: why are you developing applications that can't be ran by normal users? For the 1% of devs working on system level stuff we provide VMs or separate physical servers that aren't joined to the corporate domain and don't have sensitive information on them.

soft_dev_person 11y ago
As an example, VS needs UAC permission to integrate with a local IIS install, so there's a big group of .NET-based web developers that really need it with such a setup. But honestly, giving a developer non-admin privileges of their own (as in their work environment) computer is like giving a carpenter a rubber hammer to hammer nails. I find it insulting.
- sixbrx 11y ago
  At a lot of workplaces (like mine) it goes beyond that - developers aren't allowed to install software even under their own user account, where admin privs aren't needed. Consider the irony of that, when one of the approved pieces of software is a compiler. We can make our own programs, hello!?
Delmania 11y ago
> From a security perspective, we ask: why are you developing applications that can't be ran by normal users? Really? This question from a security engineer on Hacker News? I can tell you've never developed on Windows because (as pointed out) Visual Studio needs root level permissions to operate. The level of access a user needs to run my program has nothing to do with the level of access I need to build the program. They are completely disjoint.
- itomek 11y ago
  I'm sorry but you are incorrect. VS needs admin rights to install into Program Files, registry updates and GAC install, etc. Otherwise the apps a developer builds are run in in their own process and unless there are special circumstances, should not need admin privs; VS should never be run as admin apart from those special circumstances.
  - jasonjei 11y ago
    What about tools like Docker or VirtualBox? Every time those high-frequency release software are updated, you need to request sudo using the audit tool or request for IT to update? I can't even imagine writing a kernel hardware driver in a corporate setup if they at subjecting development environments to strict lockdown.

by dsl 11y ago

soft_dev_person 11y ago

As an example, VS needs UAC permission to integrate with a local IIS install, so there's a big group of .NET-based web developers that really need it with such a setup. But honestly, giving a developer non-admin privileges of their own (as in their work environment) computer is like giving a carpenter a rubber hammer to hammer nails. I find it insulting.

sixbrx 11y ago
At a lot of workplaces (like mine) it goes beyond that - developers aren't allowed to install software even under their own user account, where admin privs aren't needed. Consider the irony of that, when one of the approved pieces of software is a compiler. We can make our own programs, hello!?

Delmania 11y ago

> From a security perspective, we ask: why are you developing applications that can't be ran by normal users? Really? This question from a security engineer on Hacker News? I can tell you've never developed on Windows because (as pointed out) Visual Studio needs root level permissions to operate. The level of access a user needs to run my program has nothing to do with the level of access I need to build the program. They are completely disjoint.

itomek 11y ago
I'm sorry but you are incorrect. VS needs admin rights to install into Program Files, registry updates and GAC install, etc. Otherwise the apps a developer builds are run in in their own process and unless there are special circumstances, should not need admin privs; VS should never be run as admin apart from those special circumstances.
- jasonjei 11y ago
  What about tools like Docker or VirtualBox? Every time those high-frequency release software are updated, you need to request sudo using the audit tool or request for IT to update? I can't even imagine writing a kernel hardware driver in a corporate setup if they at subjecting development environments to strict lockdown.