3 ms·

I understand, but what happens is that people will unzip programs from their Downloads folder and just run them from there.

chipperyman573 9y ago
I think the argument is that nothing good can come from the store.
simonh 9y ago
I work in finance. Most web sites you could download an exe from are blocked, downloading exes is disabled and running installers is restricted to admin accounts by group policy. If you do get round all that and do it anyway and you're caught, theres a good chance you'll be fired. One issue is that some classes of users and locations (e.g. Trading floors) are restricted by law concerning the communications systems they can use for work because all communications regarding financial transactions has to be auditable. On the other hand most of the banks have their own internal software libraries you can install stuff from and you get a bunch of useful utilities by default such as Irfanview, notepad++, Greenshot or similar. Machines for devs are often less locked down.
- pjc50 9y ago
  Bloomberg chat, the Slack of LIBOR fixing.
  - keithpeter 9y ago
    With a handy built-in evidence trail complete with time stamps?
    - pjc50 9y ago
      Yes. http://uk.businessinsider.com/read-the-bloomberg-chats-that-got-a-former-rbs-libor-trader-paul-white-banned-for-life-2016-4 http://uk.businessinsider.com/read-the-bloomberg-chats-that-...
      - komali2 9y ago
        Glorious. Best part of the article is he switches to using the phone at the end, which was apparently recorded or transcripted as well anyway.
        keithpeter 9y ago
        Have a look at The Spider Network by David Enrich. Real eye opener. But a long way from MS Paint.
- jussij 9y ago
  > running installers is restricted to admin accounts by group policy. Hence the popularity of portable apps which don't use installers. The just unzip to any folder and run.
  - cbraz 9y ago
    Any company can install a reporting agent on their desktops and that will collect basic information like what .exe files have been executed. Once a portable app shows up in the reports you are simply fired by blatant disregard for the rules and procedures you agreed to when signing your contract. Finance is a heavily regulated environment and you can't get away with things that would be excusable in other places.
    - ShabbosGoy 9y ago
      > Once a portable app shows up in the reports you are simply fired by blatant disregard for the rules and procedures you agreed to when signing your contract. That seems to be a rather extreme clause; I doubt that a bank would care if a developer installed something that was not whitelisted. It would be a different story if the developer linked against code whose source was not easily attributable.
      - 5ilv3r 9y ago
        Why do you doubt that? Is it unreasonable? Students are subject to the same restrictions now.
sankalp_sans 9y ago
Oh, it's messy. In brief, if any of the said applications require Registry entry, it denies that through the permission model that these systems have installed. If it requires altering some files under some directory, it denies that as well. Some corporations even restrict such shady websites altogether using an exhaustive list of restricted domains and subdomains, often maintained by a third party, who do this list maintenance full-time for corporates like IBM, TCS, just to name a few. On top of it, almost all network and device activities are tracked, flash drive ports disabled, etc. to ensure "security". (Only a handful of underpaid device managers have access to Admin account. Forget the fact that this still doesn't prevent them from doing so at their discretion, or credentials sharing)
user5994461 9y ago
Which is a fireable offense. Thus the company is covered in case of disaster.
joosters 9y ago
If an organisation is locking down their computers, they hopefully have set permissions correctly to prevent users from running untrusted programs, no matter what the source.
syshum 9y ago
That is what AppLocker, Software Restriction Policy and similar things are for

chipperyman573 9y ago

I think the argument is that nothing good can come from the store.

simonh 9y ago

I work in finance. Most web sites you could download an exe from are blocked, downloading exes is disabled and running installers is restricted to admin accounts by group policy. If you do get round all that and do it anyway and you're caught, theres a good chance you'll be fired. One issue is that some classes of users and locations (e.g. Trading floors) are restricted by law concerning the communications systems they can use for work because all communications regarding financial transactions has to be auditable. On the other hand most of the banks have their own internal software libraries you can install stuff from and you get a bunch of useful utilities by default such as Irfanview, notepad++, Greenshot or similar. Machines for devs are often less locked down.

pjc50 9y ago
Bloomberg chat, the Slack of LIBOR fixing.
- keithpeter 9y ago
  With a handy built-in evidence trail complete with time stamps?
  - pjc50 9y ago
    Yes. http://uk.businessinsider.com/read-the-bloomberg-chats-that-got-a-former-rbs-libor-trader-paul-white-banned-for-life-2016-4 http://uk.businessinsider.com/read-the-bloomberg-chats-that-...
    - komali2 9y ago
      Glorious. Best part of the article is he switches to using the phone at the end, which was apparently recorded or transcripted as well anyway.
      - keithpeter 9y ago
        Have a look at The Spider Network by David Enrich. Real eye opener. But a long way from MS Paint.
jussij 9y ago
> running installers is restricted to admin accounts by group policy. Hence the popularity of portable apps which don't use installers. The just unzip to any folder and run.
- cbraz 9y ago
  Any company can install a reporting agent on their desktops and that will collect basic information like what .exe files have been executed. Once a portable app shows up in the reports you are simply fired by blatant disregard for the rules and procedures you agreed to when signing your contract. Finance is a heavily regulated environment and you can't get away with things that would be excusable in other places.
  - ShabbosGoy 9y ago
    > Once a portable app shows up in the reports you are simply fired by blatant disregard for the rules and procedures you agreed to when signing your contract. That seems to be a rather extreme clause; I doubt that a bank would care if a developer installed something that was not whitelisted. It would be a different story if the developer linked against code whose source was not easily attributable.
    - 5ilv3r 9y ago
      Why do you doubt that? Is it unreasonable? Students are subject to the same restrictions now.

sankalp_sans 9y ago

Oh, it's messy. In brief, if any of the said applications require Registry entry, it denies that through the permission model that these systems have installed. If it requires altering some files under some directory, it denies that as well. Some corporations even restrict such shady websites altogether using an exhaustive list of restricted domains and subdomains, often maintained by a third party, who do this list maintenance full-time for corporates like IBM, TCS, just to name a few. On top of it, almost all network and device activities are tracked, flash drive ports disabled, etc. to ensure "security". (Only a handful of underpaid device managers have access to Admin account. Forget the fact that this still doesn't prevent them from doing so at their discretion, or credentials sharing)

user5994461 9y ago

Which is a fireable offense. Thus the company is covered in case of disaster.

joosters 9y ago

If an organisation is locking down their computers, they hopefully have set permissions correctly to prevent users from running untrusted programs, no matter what the source.

syshum 9y ago

That is what AppLocker, Software Restriction Policy and similar things are for