3 ms·

Are all developers allowed to have local admin access of their computers? These are the same devs who install random things with curl|sudo bash right? Or write

Are all developers allowed to have local admin access of their computers? These are the same devs who install random things with curl|sudo bash right? Or write code that can only run as root in production? No thanks. These days of virtualenvs and similar, only incompetent devs insist on being root too. In fact, this will make an excellent interview question, thanks!

ccccc0 7y ago
I think if I got this answer during an interview, as a candidate, I would be pleased that your criteria reject me as an incompetent dev.
dangus 7y ago
When you're not allowed to install applications and tools to your own, that gets in the way of productivity and happiness at work. I've worked at companies where even being able to install something simple like Notepad++ or VSCode was turned into a major chore or made impossible thanks to the locked down environment. Locking down trivially important system preferences like your desktop background is another example of just plain annoying management that I've witnessed. Don't forget corporate network content blocking, and I don't mean the obviously not safe for work content, but companies acting as the productivity police e.g. blocking Twitter and YouTube just because they don't trust you enough to not slack off at work, and furthermore not trusting your supervisor to be competent enough to determine whether or not you've been productive enough lately.
- jjkaczor 7y ago
  ... You are aware that at a point in time, Notepad++ was compromised, right?... https://notepad-plus-plus.org/news/notepad-7.3.3-fix-cia-hacking-issue.html https://notepad-plus-plus.org/news/notepad-7.3.3-fix-cia-hac... As both developer and a systems administrator, I am constantly on both sides of the fence. I have seen developers who cannot even maintain their machines and download any random thing to streamline their job to the detriment of security. Yet, I have seen other organizations where it takes months to get something like VSCode installed (try keeping that up-to-date on an air-gapped machine, that isn't connected to the internet... or ... Node.js or... full Visual Studio...)
  - nemetroid 7y ago
    Notepad++ wasn't compromised, at least not in the incident referred to in that link. > It's not a vulnerability/security issue in Notepad++
    - jjkaczor 7y ago
      Ah yes - gotta love the HN pedantry - you are of course technically correct, however - a library used by Notepad++ was compromised for a period of time. Outcome from a security perspective was the same.
      - deathanatos 7y ago
        > a library used by Notepad++ was compromised for a period of time Nothing at the referenced URL corroborates how you are representing the referenced URL. According to the URL, the CIA was replacing one of Notepad++'s components w/ another in order to run code on the user's system and stay hidden. Nothing in that links indicates that that replacement is done through any breach in security in Notepad++ itself, and AFAICT, they're using it merely as a good hiding place. The Notepad++ announcement fixes no particular bugs, but merely signs the code. "It rather involved being on the other side of this airtight hatchway": https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... I'd also say that the CIA is probably not within the threat model of most companies. (If they had one.)
      - nemetroid 7y ago
        > Ah yes - gotta love the HN pedantry - you are of course technically correct, however - a library used by Notepad++ was compromised for a period of time. No, it wasn't either. The security "issue" was that a shared library loaded by Notepad++ could be replaced with a compromised one. At no point did either Notepad++ or the library authors distribute a compromised version of that library. Being able to replace shared libraries is not a security issue, it's the number one (or number two, depending on who you ask) reason for having shared libraries in the first place. It's like saying that if I compiled a custom version of glibc and installed it on a computer, the entirety of the GNU ecosystem was compromised.
__turbobrew__ 7y ago
That is a wide brush you are using. Once you start needing to prod the operating system internals or do any sort of devops work it is prudent to have root access.

ccccc0 7y ago

I think if I got this answer during an interview, as a candidate, I would be pleased that your criteria reject me as an incompetent dev.

dangus 7y ago

When you're not allowed to install applications and tools to your own, that gets in the way of productivity and happiness at work. I've worked at companies where even being able to install something simple like Notepad++ or VSCode was turned into a major chore or made impossible thanks to the locked down environment. Locking down trivially important system preferences like your desktop background is another example of just plain annoying management that I've witnessed. Don't forget corporate network content blocking, and I don't mean the obviously not safe for work content, but companies acting as the productivity police e.g. blocking Twitter and YouTube just because they don't trust you enough to not slack off at work, and furthermore not trusting your supervisor to be competent enough to determine whether or not you've been productive enough lately.

jjkaczor 7y ago
... You are aware that at a point in time, Notepad++ was compromised, right?... https://notepad-plus-plus.org/news/notepad-7.3.3-fix-cia-hacking-issue.html https://notepad-plus-plus.org/news/notepad-7.3.3-fix-cia-hac... As both developer and a systems administrator, I am constantly on both sides of the fence. I have seen developers who cannot even maintain their machines and download any random thing to streamline their job to the detriment of security. Yet, I have seen other organizations where it takes months to get something like VSCode installed (try keeping that up-to-date on an air-gapped machine, that isn't connected to the internet... or ... Node.js or... full Visual Studio...)
- nemetroid 7y ago
  Notepad++ wasn't compromised, at least not in the incident referred to in that link. > It's not a vulnerability/security issue in Notepad++
  - jjkaczor 7y ago
    Ah yes - gotta love the HN pedantry - you are of course technically correct, however - a library used by Notepad++ was compromised for a period of time. Outcome from a security perspective was the same.
    - deathanatos 7y ago
      > a library used by Notepad++ was compromised for a period of time Nothing at the referenced URL corroborates how you are representing the referenced URL. According to the URL, the CIA was replacing one of Notepad++'s components w/ another in order to run code on the user's system and stay hidden. Nothing in that links indicates that that replacement is done through any breach in security in Notepad++ itself, and AFAICT, they're using it merely as a good hiding place. The Notepad++ announcement fixes no particular bugs, but merely signs the code. "It rather involved being on the other side of this airtight hatchway": https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... I'd also say that the CIA is probably not within the threat model of most companies. (If they had one.)
    - nemetroid 7y ago
      > Ah yes - gotta love the HN pedantry - you are of course technically correct, however - a library used by Notepad++ was compromised for a period of time. No, it wasn't either. The security "issue" was that a shared library loaded by Notepad++ could be replaced with a compromised one. At no point did either Notepad++ or the library authors distribute a compromised version of that library. Being able to replace shared libraries is not a security issue, it's the number one (or number two, depending on who you ask) reason for having shared libraries in the first place. It's like saying that if I compiled a custom version of glibc and installed it on a computer, the entirety of the GNU ecosystem was compromised.

__turbobrew__ 7y ago

That is a wide brush you are using. Once you start needing to prod the operating system internals or do any sort of devops work it is prudent to have root access.