4 ms·
Yes but it won't get it. And at the end if the day, people need to be able to get work done. The corporate world is full of stupid things that will never not c
by sametmax 7y ago
Yes but it won't get it. And at the end if the day, people need to be able to get work done.
The corporate world is full of stupid things that will never not change, or take years to change.
- gautamdivgi 7y agoWhere I work the solution was to use a proxy to pypi. Basically an internal pip repo (and docker, npm, maven, everything else...). All internal apps go through the internal repository that creates a local version of the package from pypi. That gives the security / compliance folks a way to block packages with security issues, etc. and at the same time provide the developers flexibility to get most of what is needed. In a large company this gives the compliance folks a central place to blacklist packages - along with a trail of what systems have downloaded the package to target for upgrades.
- sametmax 7y agoMany technical solutiins exist, but the problem is political or organisational.
- gautamdivgi 7y agoAgree. At this point it was more a case of executives saying they wanted internal dev teams to use and contribute to open source and supporting orgs to come up with solutions on how that can be possible with a 0-touch approach. That’s what tipped the balance.