4 ms·

What if I'm a guy who can't access the QA/staging version of his favorite pet open-source web project because they decided to host it at "[sitename].review"? I

by yebyen 8y ago

What if I'm a guy who can't access the QA/staging version of his favorite pet open-source web project because they decided to host it at "[sitename].review"? It doesn't technically prevent anyone from visiting the site, but my whole campus blocks every .review domain, so I have to tunnel out to another campus network (where they don't blindly follow all of ISAC's sometimes braindead suggestions) each and every time I want to verify that a change actually fixes the bug. Isn't this a perfectly legitimate use of `.review`? Do you block this one too?

AnIdiotOnTheNet 8y ago
By default? Yes. Sorry, it turns out you can't trust the internet. You're free to make a request for it to be unblocked.
- yebyen 8y ago
  I've been asking for months. They also have blocked an entire /24 with some perfectly safe documentation on it, our InfoSec department says it came from our threat vendor, and our threat vendor says it came from one of our custom lists. I got one thing unblocked successfully once, it took an entire week. Who are you protecting from what? It seems to me like "turns out you can't trust the internet" is the right idea, but what exactly do you hope to accomplish with this block? You're not trying to make it so that... your users will think they can trust the internet?
  - AnIdiotOnTheNet 8y ago
    Sounds like you're blaming me because your InfoSec department sucks and can't get such a request turned around quickly. > what exactly do you hope to accomplish with this block? It's just one of many layers of defense against phishing and malware links.
    - yebyen 8y ago
      No I'm not blaming you, I'm recognizing that InfoSec has more important fish to fry, than unblocking my pet projects that were a casualty of this garbage policy. Maybe it's appropriate for your company, but it is not appropriate for a college campus or other larger organization with many salaried employees. I understand not giving users rope to hang themselves with, but now I can only do this work at home. I don't like policies that cause tech workers to need to bring some of their work home with them. It's a personal project (with some work-related applications, but putting that aside) — that shouldn't mean I can only work on it at home. But because of the overhead of making these requests, the only effective way for me to work on this stuff is now at home. I don't like policies that result in people needing to bring more work home. I'd rather stay an hour late to get the thing some attention that it needs, and leave my computer in the desk drawer overnight. Policies like this sometimes make this impossible.
      - AnIdiotOnTheNet 8y ago
        > Maybe it's appropriate for your company, but it is not appropriate for a college campus or other larger organization with many salaried employees. Why do I care about what's appropriate for other orgs? My job is to deal with the needs of the one that pays my salary. > I don't like policies that cause tech workers to need to bring some of their work home with them. The policy has nothing to do with that. If you need it for work it will be unblocked in a timely fashion. If you need entire categories of things unblocked we can do that too, and just for your account. You don't find it a bit strange you're talking about how this policy would block access to a personal project, but that in so doing it somehow causes you to have to bring work home? Which is it? Is it something you work on for work or is it a personal project?
        yebyen 8y ago
        > Why do I care about what's appropriate for other orgs? You're here discussing your org, and I'm here discussing my org. Why are you posting on a public forum if you don't care about other people's problems ;) I'm not here to make it personally relevant for you and necessarily change your mind. > You don't find it a bit strange you're talking about how this policy would block access to a personal project, but that in so doing it somehow causes you to have to bring work home? Which is it? Is it something you work on for work or is it a personal project? It's a JavaScript app, and I'm a Rails developer without a lot of really strong JavaScript experience. I might need more JS experience for work. If I could take a class in this stuff, my work would probably pay for the tuition, and it would be tax-free. (But instead, I'm doing an Open Source project and as far as professional development goes, it's the same.) I don't find it strange at all, I work on personal projects all the time, and some of that happens at work. Sometimes I like to choose my personal projects so that they will benefit my performance at work. In the community of practice related to this project, if something pops up on my Slack, and it will take two minutes to deal with it, I'm not going to tell them to wait until after hours; I'm bringing my actual work home with me on a regular basis (without overtime), so it would be unfair for me to say that the inverse can never happen. Just to make it concrete, so you can see why it shouldn't bother my manager that I sometimes look at this project during working hours, the project is "Commits.to" - it's a time management / GTD tool for helping you be sure that you set a due date when something you said you'd do is important, and for holding you to getting done the things you said you were going to get done, by the due date or ASAP after. It's a beta project and the only people who are users are also developers. It is a community of practice. Again I don't expect you to care about this project, but if my work is overtly saying "you need to go home if you want to work on that" I'm going to start looking for a different job. But they're not doing that. They've said it obliquely instead. (And since it's a college campus, they've said it to every student too... some of whom might actually live on campus.) So as we're all very busy, and I don't need to work on this at work, I've just let it slide instead of marching into InfoSec with a list of demands. But the net effect is, sometimes when I want to do a quick thing for this personal project I'm working on, instead of spending the 5 minutes and getting it over with, I have to write it down and remember to bring it home instead. It's a net productivity loss, and I don't think that was anyone's intentional goal, but it was an effect of the (garbage, IMHO) policy.
- icebraining 8y ago
  I think you should block all IPs by default, since you can't trust the Internet. Better to whitelist every one.
  - AnIdiotOnTheNet 8y ago
    If it were simpler I'd be all for blocking most of the worlds IP addresses since we only do business in the continental US. Sadly, maintaining a list of IP blocks is more trouble than it is worth.

by yebyen 8y ago

AnIdiotOnTheNet 8y ago

By default? Yes. Sorry, it turns out you can't trust the internet. You're free to make a request for it to be unblocked.

yebyen 8y ago
I've been asking for months. They also have blocked an entire /24 with some perfectly safe documentation on it, our InfoSec department says it came from our threat vendor, and our threat vendor says it came from one of our custom lists. I got one thing unblocked successfully once, it took an entire week. Who are you protecting from what? It seems to me like "turns out you can't trust the internet" is the right idea, but what exactly do you hope to accomplish with this block? You're not trying to make it so that... your users will think they can trust the internet?
- AnIdiotOnTheNet 8y ago
  Sounds like you're blaming me because your InfoSec department sucks and can't get such a request turned around quickly. > what exactly do you hope to accomplish with this block? It's just one of many layers of defense against phishing and malware links.
  - yebyen 8y ago
    No I'm not blaming you, I'm recognizing that InfoSec has more important fish to fry, than unblocking my pet projects that were a casualty of this garbage policy. Maybe it's appropriate for your company, but it is not appropriate for a college campus or other larger organization with many salaried employees. I understand not giving users rope to hang themselves with, but now I can only do this work at home. I don't like policies that cause tech workers to need to bring some of their work home with them. It's a personal project (with some work-related applications, but putting that aside) — that shouldn't mean I can only work on it at home. But because of the overhead of making these requests, the only effective way for me to work on this stuff is now at home. I don't like policies that result in people needing to bring more work home. I'd rather stay an hour late to get the thing some attention that it needs, and leave my computer in the desk drawer overnight. Policies like this sometimes make this impossible.
    - AnIdiotOnTheNet 8y ago
      > Maybe it's appropriate for your company, but it is not appropriate for a college campus or other larger organization with many salaried employees. Why do I care about what's appropriate for other orgs? My job is to deal with the needs of the one that pays my salary. > I don't like policies that cause tech workers to need to bring some of their work home with them. The policy has nothing to do with that. If you need it for work it will be unblocked in a timely fashion. If you need entire categories of things unblocked we can do that too, and just for your account. You don't find it a bit strange you're talking about how this policy would block access to a personal project, but that in so doing it somehow causes you to have to bring work home? Which is it? Is it something you work on for work or is it a personal project?
      - yebyen 8y ago
        > Why do I care about what's appropriate for other orgs? You're here discussing your org, and I'm here discussing my org. Why are you posting on a public forum if you don't care about other people's problems ;) I'm not here to make it personally relevant for you and necessarily change your mind. > You don't find it a bit strange you're talking about how this policy would block access to a personal project, but that in so doing it somehow causes you to have to bring work home? Which is it? Is it something you work on for work or is it a personal project? It's a JavaScript app, and I'm a Rails developer without a lot of really strong JavaScript experience. I might need more JS experience for work. If I could take a class in this stuff, my work would probably pay for the tuition, and it would be tax-free. (But instead, I'm doing an Open Source project and as far as professional development goes, it's the same.) I don't find it strange at all, I work on personal projects all the time, and some of that happens at work. Sometimes I like to choose my personal projects so that they will benefit my performance at work. In the community of practice related to this project, if something pops up on my Slack, and it will take two minutes to deal with it, I'm not going to tell them to wait until after hours; I'm bringing my actual work home with me on a regular basis (without overtime), so it would be unfair for me to say that the inverse can never happen. Just to make it concrete, so you can see why it shouldn't bother my manager that I sometimes look at this project during working hours, the project is "Commits.to" - it's a time management / GTD tool for helping you be sure that you set a due date when something you said you'd do is important, and for holding you to getting done the things you said you were going to get done, by the due date or ASAP after. It's a beta project and the only people who are users are also developers. It is a community of practice. Again I don't expect you to care about this project, but if my work is overtly saying "you need to go home if you want to work on that" I'm going to start looking for a different job. But they're not doing that. They've said it obliquely instead. (And since it's a college campus, they've said it to every student too... some of whom might actually live on campus.) So as we're all very busy, and I don't need to work on this at work, I've just let it slide instead of marching into InfoSec with a list of demands. But the net effect is, sometimes when I want to do a quick thing for this personal project I'm working on, instead of spending the 5 minutes and getting it over with, I have to write it down and remember to bring it home instead. It's a net productivity loss, and I don't think that was anyone's intentional goal, but it was an effect of the (garbage, IMHO) policy.
icebraining 8y ago
I think you should block all IPs by default, since you can't trust the Internet. Better to whitelist every one.
- AnIdiotOnTheNet 8y ago
  If it were simpler I'd be all for blocking most of the worlds IP addresses since we only do business in the continental US. Sadly, maintaining a list of IP blocks is more trouble than it is worth.