3 ms·

I once worked for a fortune 500 that blocked all but a few unix sysadmins from executing shell commands on prod servers. So far, so good. The issue was that t

I once worked for a fortune 500 that blocked all but a few unix sysadmins from executing shell commands on prod servers. So far, so good. The issue was that the “sysadmins” knew almost nothing about how anything worked, so the procedure was that the devs would give them commands to type and they would just type them in to a terminal. Of course, if anything went wrong, or was ambiguous, the dev would need to check on it, and would end up standing next to the “sysadmin”’s desk and just telling them which characters to type. I once had to explain what a pipe character was... Anyway, the end result was that all of the devs had prod access, they just had a very slow interface to it.

pvtmert 6y ago
I'm system engineer in a decent company. I wish devs could access to prod systems so they have to get to cleanup their mess / get responsible for actions they do... They already have access to staging and preprod what they do is basically coming to me and saying 'it did run well on their macos machine' There are outliers, some few good people and some random people having no idea what they are doing. IMHO there should be random quiz/task/test each day you login. Something obvious but not trivial at the same time related with domain of the system. So you would get 24h access if you pass, get denied for 3 hours if fail. 3 questions in each session... At least people might learn something out of requirement...
henryfjordan 6y ago
> Anyway, the end result was that all of the devs had prod access, they just had a very slow interface to it. They also had a person who could see if the dev was stalking an ex-girlfriend or pilfering bank account info. Sounds perfect.
- alasdair_ 6y ago
  Normally, yes, but the people employed as unix admins literally didn't understand what most basic shell commands did, to the point that copying prod data to a remote server would have been completely trivial.
caiobegotti 6y ago
HSBC production support used to be pretty much exactly like that during rollouts (no idea if that has changed in the last 5 years).

pvtmert 6y ago

I'm system engineer in a decent company. I wish devs could access to prod systems so they have to get to cleanup their mess / get responsible for actions they do... They already have access to staging and preprod what they do is basically coming to me and saying 'it did run well on their macos machine' There are outliers, some few good people and some random people having no idea what they are doing. IMHO there should be random quiz/task/test each day you login. Something obvious but not trivial at the same time related with domain of the system. So you would get 24h access if you pass, get denied for 3 hours if fail. 3 questions in each session... At least people might learn something out of requirement...

henryfjordan 6y ago

> Anyway, the end result was that all of the devs had prod access, they just had a very slow interface to it. They also had a person who could see if the dev was stalking an ex-girlfriend or pilfering bank account info. Sounds perfect.

alasdair_ 6y ago
Normally, yes, but the people employed as unix admins literally didn't understand what most basic shell commands did, to the point that copying prod data to a remote server would have been completely trivial.

caiobegotti 6y ago

HSBC production support used to be pretty much exactly like that during rollouts (no idea if that has changed in the last 5 years).