4 ms·

A number of my personal sites end up blocked by corporate firewalls. It’s slightly infuriating. Even my own company. I got in a literal fight with IT needing to

by donatj 5y ago

A number of my personal sites end up blocked by corporate firewalls. It’s slightly infuriating. Even my own company. I got in a literal fight with IT needing to justify the why in why I needed access to my own website. Like I can live without it, but it’s nothing but my blog where I rant about tech. The why should be why is it blocked to begin with. The default state should not be blocked.

Symbiote 5y ago
Even more ridiculous: several small sites run by my team, from our own public IP space, have been blocked by the corporate firewall. There has never been anything wrong with them, it's just braindead blocking software purchased by incompetent managers.
- ugjka 5y ago
  Yeah "We block 50% more than our competitors" "Good deal!"
- nonrandomstring 5y ago
  > just braindead blocking software purchased by incompetent managers. Having been that IT person early in my career, responsible for networks, firewalls and policies, what you say sounds cruel. But I could not agree more. Today there is a tragic de-skilling in ICT. When I speak to modern corporate or academic IT people I make the best faith assumptions. I assume they are like we were in the early 90s and speak to them accordingly with technical respect. Then I discover they cannot configure a mail or web server, cannot compile a program, or even use a package manager... they don't know how to read logs or change permissions on a directory.... the mind boggles. I've had senior IT people tell me that they're "not technical" and it turns out they've arrived on some "management track" from an arts-history background. I'm not knocking arts history, or being "elitist" I hope, but this raises serious concerns for me. What is going on in IT? Have cloud services, tick-box webmin interfaces and packaged solutions led to a brain drain? One could argue that modern IT people don't need "geeky computer skills" any more, because Google and Microsoft have solved everything. But that doesn't pan out, because when simple things go wrong they cannot fix them (which is their job). Right now I am dealing with an international university whose impeccable pedigree is bedrock in computing history - and their IT people cannot fix a simple email issue, to the extent the staff and students have to set up their own servers. The fact is, they just don't have control over it any longer. I think the entire senior ranks are just marking time till they can retire.
- exedore6 5y ago
  Regarding braindead blocking software and incompetent managers - all blocking software is braindead and what's worse, opaque (good luck finding out why a site is blocked, the devs don't care). Us incompetent managers often end up purchasing them do tick a check box required by the insurance company and/or the government, neither of which care that it's all snake oil.
raxxorraxor 5y ago
Default approach of a firewall. When it doubt, block it. But IT has really outdone itself and grew to something that could be the largest threat to an open internet. The same could happen to mail, where you can only use "certified provider" or you will just be filtered out. Spam and phishing are a problem, sure, but recent IT strategies are highly questionable in this regard.
- Root_Denied 5y ago
  Considering the landscape of spam, phishing, and malicious actors poking around what's your alternative solution to how firewall rules (and category lists generated and maintained by companies like Palo Alto) are currently applied? The IT side of things has limited tools (and budget) with which to control and secure the internal environment. IMO there's also a failure of government here to both ensure an open internet and to come down on people abusing the system. A related example might be the phone spam calls everyone in the US gets - it's an administrative, legal, and regulatory problem, not a technical one. My context may be a bit skewed though since I'm a sysadmin turned cybersecurity and I've seen the large numbers of people clicking on the absolute stupidest things. Given the "average" computer use that IT has to deal with I'm much more sympathetic to their plight.
- smhenderson 5y ago
  but recent IT strategies are highly questionable in this regard. I think it of as a result of high profile hacks. Either a company is hacked once and they go way overboard trying to ensure it doesn't happen again. Or, some high profile company gets hacked, some C*O's see it, overreact and decide they're not going to be next.
- Thiez 5y ago
  Incidentally this is also why you see a lot of stuff being communicated over https. The other ports are "suspicious".
unethical_ban 5y ago
Counterpoint: The sole purpose of a business network is to execute the requirements of the business. Any extraneous activity on the network is at least noise, and at most a direct threat to the business. The #1 way in which networks get infected is through phishing and employee downloads. On a corporate network, it can make total sense to block non-business sites by default. As someone who used to help manage the proxies at a bank, some of the arbitrary decisions annoyed me (like blocking gTLDs of all sorts by default) but at the end of the day, it was an inconvenience. There were mechanisms to request access if needed. To me, it starts to get more shady with behavioral analytics software on terminals that measure your known patterns of access and look for aberrations. It becomes intrusive and creepy in its move from "passive" filtering to active, personalized monitoring. --- All that is irrelevant here, because an ISP fucking with my TLS connection and throwing up warnings is awful.
- JoeAltmaier 5y ago
  BUt some manager's idea of what are business sites, and the staff's idea, can be very different. I don't mean entertainment; I mean suits making decisions about what engineering needs etc.
  - unethical_ban 5y ago
    Yes, it is a bureaucratic pain for IT to request access to download a tool for testing, etc. and in many places that may be overkill. Again, prior experience, we had brainstormed the idea of denying any executable downloads by frontline workers, while permitting it for IT, since frontline workers both were less likely to need to download random EXEs, and less likely to know how to spot phishing or grayware sites.
coding123 5y ago
And there's still devs that want the in-office life still..
- donatj 5y ago
  We've been working home for 2 years. They want us to run all traffic through the VPN that applies the same filtering. Please excuse me if I forget to turn it on.
  - gopher_space 5y ago
    Here’s some lag in your process because c-level can’t stop downloading ringtones.
  - nybble41 5y ago
    One would hope you still have separate personal device(s) which you can use without connecting through their VPN, in addition to the corporate-owned ones used for work. Or do they want you to run all your personal traffic through the VPN as well?
  - raxxorraxor 5y ago
    Personally I run the VPN in a VM on my private device and I would recommend to do that to everyone. You have a VPN without split tunneling within the VM, it is containerized from your other OS and separates work and leisure and you can use your normal WAN connection to access the internet at full speed. With how verbose and talkative applications today are it wouldn't be appropriate to route their traffic through the company line anyway. Of course that decreases the security that deactivating split tunneling offers to a degree, but I think we have to live with that. All this security is ineffective anyway if 99% of attacks come through the inbox. That will never be change and people need to be educated and have to trust IT that they don't blame the user since it can happen to everyone and nobody is on guard to 100%. With decent backups the damage can usually be completely mitigated without a lot of expensive security measures.
dylan604 5y ago
>I got in a literal fight with IT needing to justify the why in why I needed access to my own website. Legitimately asking, why do you need access to your private website on corporate resources during work? Access your private stuff on your BYOD.
- gopher_space 5y ago
  I’m not looking to work with people who need me to justify the info I gather or the tools I use. The problem isn’t what I want to do it’s having an intermediary in the process who only introduces drag.
  - dylan604 5y ago
    But if your tool is a non-licensed piece of software that then puts the company on the hook because you used it without people whose purview it is to know these things can cause problems. I 100% understand the frustration of working in a place where lawyers "introduce drag". Lawyer's job isn't to make your job harder/easier, but to protect the company from whatever. Sometimes whatever turns out to be the "well intended" employee. Part of the friction in these situations are very zealous people wanting to do things while they are so scoped in on their task that they are unawares of the larger consequences to the company no matter how well intentioned they may be. As I've become older, I can corrolate that friction with youth. That coefficient of friction becomes smaller with age/experience. It has nothing to do with levels of caring/apathy, but from experiencing the negative affect of "move fast, break things" and being willing to tap the breaks a little bit while changing altitude to see a bigger picture.
    - gopher_space 5y ago
      Oh definitely, and I wish I hadn't implied a value judgment. I've been happy at places with strict policies but easy admission, so I'm not opposed to the concept.
- kevincox 5y ago
  I occasionally link to my blog articles when I am trying to make a point. It is often better to reference my well-thought-out and composed arguments rather than typing them out again on-demand with less thought. Although that is not a very strong justification.
spogbiper 5y ago
Any exception to the firewall policy requires supporting documentation. IT may just be covering their own ass/literally doing their job properly when they ask for the justification.
- bragr 5y ago
  As a manager, I've noticed people tend to overthink the "business justification" field on forms and get themselves all worked up that they are being told no because they know what to put, but in reality all you normally need to do is string together a handful of words that vaguely makes sense to the person processing the request so they can check a box.
hanoz 5y ago
> a literal fight with IT How did that pan out?
Someone1234 5y ago
The word "model" as in "Data Model" or "Mathematical Model" is blocked at my work. Why? Because otherwise people might look up clothing models or something... This impacts multiple programming divisions and has not been lifted even after it was raised.
- DJHenk 5y ago
  The only reaction to something that dysfunctional and stupid is to go the other direction. Make lots of complaints about every normal English word you can think of by using it in a search and finding questionable results. Rule 34 says this should not be hard. Watch management crumble when the whole internet gets unusable because everything is blocked. Also: polish up your resume and start sending it out.

by donatj 5y ago

Symbiote 5y ago

Even more ridiculous: several small sites run by my team, from our own public IP space, have been blocked by the corporate firewall. There has never been anything wrong with them, it's just braindead blocking software purchased by incompetent managers.

ugjka 5y ago
Yeah "We block 50% more than our competitors" "Good deal!"
nonrandomstring 5y ago
> just braindead blocking software purchased by incompetent managers. Having been that IT person early in my career, responsible for networks, firewalls and policies, what you say sounds cruel. But I could not agree more. Today there is a tragic de-skilling in ICT. When I speak to modern corporate or academic IT people I make the best faith assumptions. I assume they are like we were in the early 90s and speak to them accordingly with technical respect. Then I discover they cannot configure a mail or web server, cannot compile a program, or even use a package manager... they don't know how to read logs or change permissions on a directory.... the mind boggles. I've had senior IT people tell me that they're "not technical" and it turns out they've arrived on some "management track" from an arts-history background. I'm not knocking arts history, or being "elitist" I hope, but this raises serious concerns for me. What is going on in IT? Have cloud services, tick-box webmin interfaces and packaged solutions led to a brain drain? One could argue that modern IT people don't need "geeky computer skills" any more, because Google and Microsoft have solved everything. But that doesn't pan out, because when simple things go wrong they cannot fix them (which is their job). Right now I am dealing with an international university whose impeccable pedigree is bedrock in computing history - and their IT people cannot fix a simple email issue, to the extent the staff and students have to set up their own servers. The fact is, they just don't have control over it any longer. I think the entire senior ranks are just marking time till they can retire.
exedore6 5y ago
Regarding braindead blocking software and incompetent managers - all blocking software is braindead and what's worse, opaque (good luck finding out why a site is blocked, the devs don't care). Us incompetent managers often end up purchasing them do tick a check box required by the insurance company and/or the government, neither of which care that it's all snake oil.

raxxorraxor 5y ago

Default approach of a firewall. When it doubt, block it. But IT has really outdone itself and grew to something that could be the largest threat to an open internet. The same could happen to mail, where you can only use "certified provider" or you will just be filtered out. Spam and phishing are a problem, sure, but recent IT strategies are highly questionable in this regard.

Root_Denied 5y ago
Considering the landscape of spam, phishing, and malicious actors poking around what's your alternative solution to how firewall rules (and category lists generated and maintained by companies like Palo Alto) are currently applied? The IT side of things has limited tools (and budget) with which to control and secure the internal environment. IMO there's also a failure of government here to both ensure an open internet and to come down on people abusing the system. A related example might be the phone spam calls everyone in the US gets - it's an administrative, legal, and regulatory problem, not a technical one. My context may be a bit skewed though since I'm a sysadmin turned cybersecurity and I've seen the large numbers of people clicking on the absolute stupidest things. Given the "average" computer use that IT has to deal with I'm much more sympathetic to their plight.
smhenderson 5y ago
but recent IT strategies are highly questionable in this regard. I think it of as a result of high profile hacks. Either a company is hacked once and they go way overboard trying to ensure it doesn't happen again. Or, some high profile company gets hacked, some C*O's see it, overreact and decide they're not going to be next.
Thiez 5y ago
Incidentally this is also why you see a lot of stuff being communicated over https. The other ports are "suspicious".

unethical_ban 5y ago

Counterpoint: The sole purpose of a business network is to execute the requirements of the business. Any extraneous activity on the network is at least noise, and at most a direct threat to the business. The #1 way in which networks get infected is through phishing and employee downloads. On a corporate network, it can make total sense to block non-business sites by default. As someone who used to help manage the proxies at a bank, some of the arbitrary decisions annoyed me (like blocking gTLDs of all sorts by default) but at the end of the day, it was an inconvenience. There were mechanisms to request access if needed. To me, it starts to get more shady with behavioral analytics software on terminals that measure your known patterns of access and look for aberrations. It becomes intrusive and creepy in its move from "passive" filtering to active, personalized monitoring. --- All that is irrelevant here, because an ISP fucking with my TLS connection and throwing up warnings is awful.

JoeAltmaier 5y ago
BUt some manager's idea of what are business sites, and the staff's idea, can be very different. I don't mean entertainment; I mean suits making decisions about what engineering needs etc.
- unethical_ban 5y ago
  Yes, it is a bureaucratic pain for IT to request access to download a tool for testing, etc. and in many places that may be overkill. Again, prior experience, we had brainstormed the idea of denying any executable downloads by frontline workers, while permitting it for IT, since frontline workers both were less likely to need to download random EXEs, and less likely to know how to spot phishing or grayware sites.

coding123 5y ago

And there's still devs that want the in-office life still..

donatj 5y ago
We've been working home for 2 years. They want us to run all traffic through the VPN that applies the same filtering. Please excuse me if I forget to turn it on.
- gopher_space 5y ago
  Here’s some lag in your process because c-level can’t stop downloading ringtones.
- nybble41 5y ago
  One would hope you still have separate personal device(s) which you can use without connecting through their VPN, in addition to the corporate-owned ones used for work. Or do they want you to run all your personal traffic through the VPN as well?
- raxxorraxor 5y ago
  Personally I run the VPN in a VM on my private device and I would recommend to do that to everyone. You have a VPN without split tunneling within the VM, it is containerized from your other OS and separates work and leisure and you can use your normal WAN connection to access the internet at full speed. With how verbose and talkative applications today are it wouldn't be appropriate to route their traffic through the company line anyway. Of course that decreases the security that deactivating split tunneling offers to a degree, but I think we have to live with that. All this security is ineffective anyway if 99% of attacks come through the inbox. That will never be change and people need to be educated and have to trust IT that they don't blame the user since it can happen to everyone and nobody is on guard to 100%. With decent backups the damage can usually be completely mitigated without a lot of expensive security measures.

dylan604 5y ago

>I got in a literal fight with IT needing to justify the why in why I needed access to my own website. Legitimately asking, why do you need access to your private website on corporate resources during work? Access your private stuff on your BYOD.

gopher_space 5y ago
I’m not looking to work with people who need me to justify the info I gather or the tools I use. The problem isn’t what I want to do it’s having an intermediary in the process who only introduces drag.
- dylan604 5y ago
  But if your tool is a non-licensed piece of software that then puts the company on the hook because you used it without people whose purview it is to know these things can cause problems. I 100% understand the frustration of working in a place where lawyers "introduce drag". Lawyer's job isn't to make your job harder/easier, but to protect the company from whatever. Sometimes whatever turns out to be the "well intended" employee. Part of the friction in these situations are very zealous people wanting to do things while they are so scoped in on their task that they are unawares of the larger consequences to the company no matter how well intentioned they may be. As I've become older, I can corrolate that friction with youth. That coefficient of friction becomes smaller with age/experience. It has nothing to do with levels of caring/apathy, but from experiencing the negative affect of "move fast, break things" and being willing to tap the breaks a little bit while changing altitude to see a bigger picture.
  - gopher_space 5y ago
    Oh definitely, and I wish I hadn't implied a value judgment. I've been happy at places with strict policies but easy admission, so I'm not opposed to the concept.
kevincox 5y ago
I occasionally link to my blog articles when I am trying to make a point. It is often better to reference my well-thought-out and composed arguments rather than typing them out again on-demand with less thought. Although that is not a very strong justification.

spogbiper 5y ago

Any exception to the firewall policy requires supporting documentation. IT may just be covering their own ass/literally doing their job properly when they ask for the justification.

bragr 5y ago
As a manager, I've noticed people tend to overthink the "business justification" field on forms and get themselves all worked up that they are being told no because they know what to put, but in reality all you normally need to do is string together a handful of words that vaguely makes sense to the person processing the request so they can check a box.

hanoz 5y ago

> a literal fight with IT How did that pan out?

Someone1234 5y ago

The word "model" as in "Data Model" or "Mathematical Model" is blocked at my work. Why? Because otherwise people might look up clothing models or something... This impacts multiple programming divisions and has not been lifted even after it was raised.

DJHenk 5y ago
The only reaction to something that dysfunctional and stupid is to go the other direction. Make lots of complaints about every normal English word you can think of by using it in a search and finding questionable results. Rule 34 says this should not be hard. Watch management crumble when the whole internet gets unusable because everything is blocked. Also: polish up your resume and start sending it out.