4 ms·

Internal prohibition. Using Emacs at all requires approval. The "product owner" is not an Emacs user, so building a custom distribution to include, say, Magit,

Internal prohibition. Using Emacs at all requires approval. The "product owner" is not an Emacs user, so building a custom distribution to include, say, Magit, is out of the question. I am stuck using commandline Git :(

ska 7y ago
this sounds a bit crazy.
- NateEag 7y ago
  It is unfortunately common. Any organization with high-value data has a responsibility to try not to be the next Equifax. Programmers, sysadmins, and DB admins are excellent targets for attackers. So, it's not actually so crazy to require that all tools be vetted by internal security teams, especially third-party extensions for Turing machines like Emacs. I love Emacs but its architecture is a nightmare for Blue Team, and the easiest stance is definitely "no installing packages", or just "thou shalt use this IDE and no other".
  - ska 7y ago
    I get that, but the right approach to securing high value data is to secure the data, not try and control every aspect of the environment it lives within; that's often more security theater. Note I'm not suggesting that the right approach is "wild west", rather that any vetting process that doesn't allow for well established and widely used tools to be adopted is probably too rigid.
    - NateEag 7y ago
      I didn't say the "right" stance was to ban extensions, just the "easiest". Since humans default to lazy, I thought that clearly explained why the phenomenon happens. Perhaps I should have been clearer that I don't think it's the ideal approach, even if I understand where it comes from.
  - Myrmornis 7y ago
    In my experience of US corporate culture it's also unfortunately common for employees at all levels to kowtow unnecessarily to "legal" without considering whether what "legal" are saying is sensible or not.
Myrmornis 7y ago
> so building a custom distribution to include, say, Magit, I mean, you don't need to really "build" anything, you just need to install the package: (add-to-list 'package-archives '("melpa" . "http://melpa.org/packages/") t) (package-initialize) M-x package-refresh-contents M-x package-install magit What would happen if you did that?

ska 7y ago

this sounds a bit crazy.

NateEag 7y ago
It is unfortunately common. Any organization with high-value data has a responsibility to try not to be the next Equifax. Programmers, sysadmins, and DB admins are excellent targets for attackers. So, it's not actually so crazy to require that all tools be vetted by internal security teams, especially third-party extensions for Turing machines like Emacs. I love Emacs but its architecture is a nightmare for Blue Team, and the easiest stance is definitely "no installing packages", or just "thou shalt use this IDE and no other".
- ska 7y ago
  I get that, but the right approach to securing high value data is to secure the data, not try and control every aspect of the environment it lives within; that's often more security theater. Note I'm not suggesting that the right approach is "wild west", rather that any vetting process that doesn't allow for well established and widely used tools to be adopted is probably too rigid.
  - NateEag 7y ago
    I didn't say the "right" stance was to ban extensions, just the "easiest". Since humans default to lazy, I thought that clearly explained why the phenomenon happens. Perhaps I should have been clearer that I don't think it's the ideal approach, even if I understand where it comes from.
- Myrmornis 7y ago
  In my experience of US corporate culture it's also unfortunately common for employees at all levels to kowtow unnecessarily to "legal" without considering whether what "legal" are saying is sensible or not.

Myrmornis 7y ago

> so building a custom distribution to include, say, Magit, I mean, you don't need to really "build" anything, you just need to install the package: (add-to-list 'package-archives '("melpa" . "http://melpa.org/packages/") t) (package-initialize) M-x package-refresh-contents M-x package-install magit What would happen if you did that?