4 ms·
> but I retain the power to copy and run random binaries. This is seen as bad practice and is on its way out. Many companies are implementing IT policies that
by vxNsr 5y ago
> but I retain the power to copy and run random binaries.
This is seen as bad practice and is on its way out. Many companies are implementing IT policies that prevent all binaries from running unless the source is a privileged location (e.g. program files) or it’s signed by Microsoft’s private key (and this is only because Teams for some idiotic reason is still installed in appdata against all best practices and MS own explicit guidance.)
- RMPR 5y ago> (and this is only because Teams for some idiotic reason is still installed in appdata against all best practices and MS own explicit guidance.) Maybe it's because the Teams Desktop client is a rebranding of Skype's[0]. I guess it's easier said than done in their case. 0: At least on Linux for whatever reason the temp folder of Teams is called Skype, when the system notifies you, it goes along the lines of "Skype is using your Microphone"
- whyoh 5y ago>Maybe it's because the Teams Desktop client is a rebranding of Skype's I think it's just because that's the default behavior for Electron apps and they're too lazy to change it. IIRC, VSCode had the same problem, but they fixed it eventually.
- foxhop 5y agoHonestly, it's not bad practice to run a binary, that's literally how computing works. Binaries all the way down, why bless one over another, you heard the situation, the host OS was not functional. Running random binaries in this case was likely more secure. I advocate for the human over the company every time. When only allowed signed binaries, reboot into owned OS. When locked out of the boot loader, bring a computer the size of a standard power adaptor. When locked out of WIFI Mac or ethernet ports, sling from a ephemeral hot spot tethered to cell access. Cat will bring a dead mouse. M$ is the mouse.
- em500 5y agoMoreover, companies seem to be increasingly disabling access to USB storage, and/or running everything on remote servers so the laptops are little more than expensive video terminals.
- hulitu 5y agoAFAIK you can always bring your own "keyboard driver" on USB. And i haven't seen this "running everything on remote servers" from some times. It is more like run everything from remote locations in browser.
- hulitu 5y agoAnd you still can run code in the browser.
- vxNsr 5y agoSure but the assumption being made by this policy is that it’s difficult to break the browser sandbox. This isn’t being implemented bec IT doesn’t like ppl running random binaries. It’s to prevent malware from gaining access to the system. There are still many common hacks that rely on executing binaries that have been downloaded, as long as the infiltration point doesn’t also have elevated access these types of hacks are prevented.