5 ms·

I feel like ranting - maybe this will generate a good discussion. Most of my experiences with IT have been fine. I worked at a Texas state agency once, though,

by gatlin 15y ago

I feel like ranting - maybe this will generate a good discussion. Most of my experiences with IT have been fine. I worked at a Texas state agency once, though, that caused me to dream about throwing IT workers out my office window. For starters, I was not allowed to use my own equipment. They rattled off some gibberish about security and support even though my mail client supports SMTP and I can read Office files just fine. Also, for an agency focused on security their insistence on using Windows XP was baffling. Secondly, I was told I could only use a certain browser because of another incoherent argument relying on "security." Interestingly, nothing was done to keep me from putting a pocket version of Firefox on a flash drive and connect to my own secure proxy. This is because the IT guys had no idea such wizardry was even possible. Thirdly, for some reason print jobs were routed out of the office to a data center in San Angelo and then routed back to the printer down the hall. Printing a single page was non-deterministic and painful, never mind my final reports. This was a result of some state mandate about consolidating IT. And then there was the time I tried to install Notepad++ to do some minor dev work (they hired a CS undergrad to do financial work so I thought I'd do more than estimate results). 2 weeks later I was approved to use a similar text editor on the grounds that I already have a task bar to manage multiple documents - a tab bar is completely unnecessary and Notepad++ requires further scrutiny. 3 weeks later I had a Perl interpreter. At my current job they forced me to let them change the root password on my issued machine to something they knew and I didn't. I get why you do this: because you cannot fully trust people and I dealt with sensitive data; fine. Afterward I re-installed my OS and set my root password back. I don't understand why they don't think these things through.

purephase 15y ago
1. Equipment deployed and supported by the organization most likely has additional applications for encryption, can be managed remotely and updated on a regular basis. It is far more secure, and costs less to the organization as a whole. 2. I doubt it was for security. Most likely they don't have the resources to support multiple browsers/versions for business applications and settled on a single one. It sounds like the "failure" to block USB devices is more for user convenience. Blocking USB devices, while much more secure, is extremely difficult to justify nowadays. 3. Sounds like a State issue, not an IT issue. It is probably as much of a pain in the ass to them as it is to you. 4. Such a minor issue probably sat in a queue as other higher priority items were being dealt with. Approving a text-editor for a single user does not usually end-up on the plate of the CIO for consideration. I'm not trying to defend all IT policies and practices. Some of them are less justifiable then others, and some are outright stupid, but a mantra I repeat over and over is that: "Given unlimited time and budget, anything is possible. Anything else is compromise." You are a "super-user". Recognize that you are not the majority in a large organization and limited resources are, by necessity, focused on the largest impact. Often, these priorities are not even determined by the IT organization and staff and left in the hands of committees, meetings and third-party vendors/consultants. It is not ideal. It is a pain in the ass. There is a lot of room for improvement. On both sides.
- gatlin 15y ago
  Oh, I know. That's why I was hoping I could just convince them to take my SS card or something in exchange for handing me the keys to my own machine. Needless to say, it didn't work. I did, however, make friends with the IT guy assigned to me who was hired the same day I was (same orientation). He sympathized :)
oz 15y ago
I was a sysadmin for a financial services firm, and then for a Big-4 accounting firm, so I may have some perspective: 1. "For starters, I was not allowed to use my own equipment. They rattled off some gibberish about security and support even though my mail client supports SMTP and I can read Office files just fine. Also, for an agency focused on security their insistence on using Windows XP was baffling." The first rule of System Administration [0] is to start every host in a known state. The reason for this is predictability - as the sysadmin, you know what to expect - certain software is installed, certain settings are configured, etc. You simply CANNOT manage systems at scale without this approach. Without it, testing, upgrades etc. are a shots in the dark. Another issue is ownership. Let's say you get company email on your personal BlackBerry. You're mugged, and the device is stolen. A competent administrator will immediately issue a WIPE command from the BlackBerry Enterprise Server, so that all data is erased. But wait! Those picture of your daughter's recital were on the phone. They're gone, and you're gonna be pissed. With a company-owned device, the expectations are different. A friend of mine once had to re-image the laptop of a senior executive. Turns out, the only pictures of her daughter's high-school graduation were on it. A year later, he's still having to feed her stories about ongoing efforts to retrieve the data... Regarding Windows XP, OS upgrades are not to be done lightly. It requires very extensive regression testing for all Line-of-Business apps. Believe me, there isn't an IT guy there who doesn't want the upgrade to Win 7, but after a time in this business, you learn to tread carefully, as information systems can break in all sorts of subtle ways and management doesn't want to hear it. 2. "Secondly, I was told I could only use a certain browser because of another incoherent argument relying on "security." Interestingly, nothing was done to keep me from putting a pocket version of Firefox on a flash drive and connect to my own secure proxy. This is because the IT guys had no idea such wizardry was even possible." Again, standards. When their enterprise web-based ERP system that's been tested in IE6 and works fine breaks when you're using Chrome 15.0.874.121 m, who's gonna get the call? Oh that's right. IT. Multiply that by a few hundred machines, and your network is unmanageable. There exists technology to control USB drives, but in most organizations, it won't fly - they're simply too convenient. Besides, how do you expect the VP of Sales to load his iPod? Definitely shame on your IT guys for not blocking outbound connections to your own proxy at the firewall. 3. "Thirdly, for some reason print jobs were routed out of the office to a data center in San Angelo and then routed back to the printer down the hall. Printing a single page was non-deterministic and painful, never mind my final reports. This was a result of some state mandate about consolidating IT." This sounds like the state's fault. They were probably sold a solution that promised centralized tracking / routing of print jobs, based on parameters such as job submitter, color vs monochrome, time of day, printer availability etc. Not IT's fault. 4. "And then there was the time I tried to install Notepad++ to do some minor dev work (they hired a CS undergrad to do financial work so I thought I'd do more than estimate results). 2 weeks later I was approved to use a similar text editor on the grounds that I already have a task bar to manage multiple documents - a tab bar is completely unnecessary and Notepad++ requires further scrutiny. 3 weeks later I had a Perl interpreter." I was a sysadmin, and I had to get written and signed approval from my Manager, the Security Manager and the CIO to install any non-standard application. Pleasant? No. Necessary? Yes - everything needs to documented; otherwise these things spiral out of control quickly. 5. "At my current job they forced me to let them change the root password on my issued machine to something they knew and I didn't. I get why you do this: because you cannot fully trust people and I dealt with sensitive data; fine. Afterward I re-installed my OS and set my root password back. I don't understand why they don't think these things through." Don't take this personally, but sysadmins hate people like you - you make unauthorized changes and make our lives difficult. Your IT guys sound incompetent though - why weren't BIOS passwords in place to prevent booting from CD? And since you say root password, sounds like you were in a UNIX / Linux shop. If you were in an AD environment, after reinstalling, you wouldn't have been able to join your computer to the domain without domain administrator credentials. I understand that the situation sucks, but there are good (at least for a particular meaning of good) reasons why it is so. There is room for improvement on both sides. Whew. Felt good to get all that off my chest. No hard feelings? [0] Tom Limoncelli - The Practice of System & Network Administration.
KyleBrandt 15y ago
It seems like a lot of your dislike of the IT department is a redirected dislike of these policies enforced by IT. In most law firms, government, and big finance you will likely encounter a lot of these sort of policies. Some of these policies make sense, even though the reasoning is not obvious. The policies are created because of constraints around laws and auditing and they can result in some nasty solutions. Other policies probably just don't make any sense, but that is just life. Making IT's life hard by trying to get around the policies likely doesn't really help anyone -- it is just being an ass. Assuming a policy doesn't make sense because you can't see the reason for it is arrogant - even if you are right 95% of the time. Same goes for assuming you could come up with a better solution without knowing the constraints the IT department faces. The solution for programmers that hate this sort of thing seems straight forward -- don't work in these sorts of businesses -- develop your chops so you can land a job in a hot startup (or a business that has that atmosphere) where you get the best gear and can do whatever you want. Or maybe start your own business or freelance. Until you get there, don't take out your frustrations on your coworkers by trying to bypass them -- that is just childish. For people in IT, they should be aware if they are not in a business that requires these sort of frustrating policies, they should not be trying to implement them unless they really have to. Those are the IT guys people have the right to dislike. They try to turn a small fun start up into some sort of draconian government institution because of some personal insecurities or they think that is just how it is done. In short, be aware of the sort of industry you working in, or might work in, and what to expect there.
- quanticle 15y ago
  Getting around the policies just to get around the policies makes you an ass, I agree. Getting around the policies to do your job, on the other hand, does not. I worked at a firm where I was asked by a VP to perform some testing on a VM. The VP wanted the test results by the end of the week. IT said that it would take at least three weeks to approve the specific VM software for my machine, even though there were other developers already using the software. End result? I ended up installing it and doing my job without IT's permission. I had made sure to get everything in writing from the executive, so I could show IT my reasoning if I was ever called out for it. I'm not proud of what I did, but I don't think I should have to ask permission in order to do my job.
knieveltech 15y ago
If any of my "users" where to pull any of the bullshit stunts you've listed here on my watch I guarantee you I'd have them fired within five business days if it meant I had to send spoofed mail from their address containing horse porn to the head of HR to pull it off. In a medium to large company, IT's job isn't to make you happy. This is typically impossible thanks to a combination of understaffing and budget issues. Their job isn't to debate you on software choices or provide coherent explanations of corporate IT policy. It isn't even keep you productive. It's to make sure the cube dwelling luddites (and if you aren't in IT you are one, regardless of how much you know about computers) don't break critical infrastructure. Spend 32 hours over a weekend quarantining and disinfecting an entire network because some dickhead decided he needed to bring in his malware-infected laptop to work and the standard company policy banning private equipment comes into focus pretty quickly.
- oz 15y ago
  You're being downvoted because of the 'spoofed email' line, but I understand where you're coming from. "Spend 32 hours over a weekend quarantining and disinfecting an entire network because some dickhead decided he needed to bring in his malware-infected laptop to work and the standard company policy banning private equipment comes into focus pretty quickly." Bet it was unpaid overtime too, wasn't it? Take one instance I've seen: group of guys decide that they want wireless access on their floor. One brings his home WiFi router, and plugs it right in. So now anyone walking by with cursory knowledge of WiFi hacking could get all our data. Just because they wanted Youtube on their BlackBerries.
- gatlin 15y ago
  > I'd have them fired within five business days if it meant I had to send spoofed mail from their address containing horse porn to the head of HR to pull it off At least you're creative when you put ethics in the back seat.

by gatlin 15y ago

purephase 15y ago

1. Equipment deployed and supported by the organization most likely has additional applications for encryption, can be managed remotely and updated on a regular basis. It is far more secure, and costs less to the organization as a whole. 2. I doubt it was for security. Most likely they don't have the resources to support multiple browsers/versions for business applications and settled on a single one. It sounds like the "failure" to block USB devices is more for user convenience. Blocking USB devices, while much more secure, is extremely difficult to justify nowadays. 3. Sounds like a State issue, not an IT issue. It is probably as much of a pain in the ass to them as it is to you. 4. Such a minor issue probably sat in a queue as other higher priority items were being dealt with. Approving a text-editor for a single user does not usually end-up on the plate of the CIO for consideration. I'm not trying to defend all IT policies and practices. Some of them are less justifiable then others, and some are outright stupid, but a mantra I repeat over and over is that: "Given unlimited time and budget, anything is possible. Anything else is compromise." You are a "super-user". Recognize that you are not the majority in a large organization and limited resources are, by necessity, focused on the largest impact. Often, these priorities are not even determined by the IT organization and staff and left in the hands of committees, meetings and third-party vendors/consultants. It is not ideal. It is a pain in the ass. There is a lot of room for improvement. On both sides.

gatlin 15y ago
Oh, I know. That's why I was hoping I could just convince them to take my SS card or something in exchange for handing me the keys to my own machine. Needless to say, it didn't work. I did, however, make friends with the IT guy assigned to me who was hired the same day I was (same orientation). He sympathized :)

oz 15y ago

I was a sysadmin for a financial services firm, and then for a Big-4 accounting firm, so I may have some perspective: 1. "For starters, I was not allowed to use my own equipment. They rattled off some gibberish about security and support even though my mail client supports SMTP and I can read Office files just fine. Also, for an agency focused on security their insistence on using Windows XP was baffling." The first rule of System Administration [0] is to start every host in a known state. The reason for this is predictability - as the sysadmin, you know what to expect - certain software is installed, certain settings are configured, etc. You simply CANNOT manage systems at scale without this approach. Without it, testing, upgrades etc. are a shots in the dark. Another issue is ownership. Let's say you get company email on your personal BlackBerry. You're mugged, and the device is stolen. A competent administrator will immediately issue a WIPE command from the BlackBerry Enterprise Server, so that all data is erased. But wait! Those picture of your daughter's recital were on the phone. They're gone, and you're gonna be pissed. With a company-owned device, the expectations are different. A friend of mine once had to re-image the laptop of a senior executive. Turns out, the only pictures of her daughter's high-school graduation were on it. A year later, he's still having to feed her stories about ongoing efforts to retrieve the data... Regarding Windows XP, OS upgrades are not to be done lightly. It requires very extensive regression testing for all Line-of-Business apps. Believe me, there isn't an IT guy there who doesn't want the upgrade to Win 7, but after a time in this business, you learn to tread carefully, as information systems can break in all sorts of subtle ways and management doesn't want to hear it. 2. "Secondly, I was told I could only use a certain browser because of another incoherent argument relying on "security." Interestingly, nothing was done to keep me from putting a pocket version of Firefox on a flash drive and connect to my own secure proxy. This is because the IT guys had no idea such wizardry was even possible." Again, standards. When their enterprise web-based ERP system that's been tested in IE6 and works fine breaks when you're using Chrome 15.0.874.121 m, who's gonna get the call? Oh that's right. IT. Multiply that by a few hundred machines, and your network is unmanageable. There exists technology to control USB drives, but in most organizations, it won't fly - they're simply too convenient. Besides, how do you expect the VP of Sales to load his iPod? Definitely shame on your IT guys for not blocking outbound connections to your own proxy at the firewall. 3. "Thirdly, for some reason print jobs were routed out of the office to a data center in San Angelo and then routed back to the printer down the hall. Printing a single page was non-deterministic and painful, never mind my final reports. This was a result of some state mandate about consolidating IT." This sounds like the state's fault. They were probably sold a solution that promised centralized tracking / routing of print jobs, based on parameters such as job submitter, color vs monochrome, time of day, printer availability etc. Not IT's fault. 4. "And then there was the time I tried to install Notepad++ to do some minor dev work (they hired a CS undergrad to do financial work so I thought I'd do more than estimate results). 2 weeks later I was approved to use a similar text editor on the grounds that I already have a task bar to manage multiple documents - a tab bar is completely unnecessary and Notepad++ requires further scrutiny. 3 weeks later I had a Perl interpreter." I was a sysadmin, and I had to get written and signed approval from my Manager, the Security Manager and the CIO to install any non-standard application. Pleasant? No. Necessary? Yes - everything needs to documented; otherwise these things spiral out of control quickly. 5. "At my current job they forced me to let them change the root password on my issued machine to something they knew and I didn't. I get why you do this: because you cannot fully trust people and I dealt with sensitive data; fine. Afterward I re-installed my OS and set my root password back. I don't understand why they don't think these things through." Don't take this personally, but sysadmins hate people like you - you make unauthorized changes and make our lives difficult. Your IT guys sound incompetent though - why weren't BIOS passwords in place to prevent booting from CD? And since you say root password, sounds like you were in a UNIX / Linux shop. If you were in an AD environment, after reinstalling, you wouldn't have been able to join your computer to the domain without domain administrator credentials. I understand that the situation sucks, but there are good (at least for a particular meaning of good) reasons why it is so. There is room for improvement on both sides. Whew. Felt good to get all that off my chest. No hard feelings? [0] Tom Limoncelli - The Practice of System & Network Administration.

KyleBrandt 15y ago

It seems like a lot of your dislike of the IT department is a redirected dislike of these policies enforced by IT. In most law firms, government, and big finance you will likely encounter a lot of these sort of policies. Some of these policies make sense, even though the reasoning is not obvious. The policies are created because of constraints around laws and auditing and they can result in some nasty solutions. Other policies probably just don't make any sense, but that is just life. Making IT's life hard by trying to get around the policies likely doesn't really help anyone -- it is just being an ass. Assuming a policy doesn't make sense because you can't see the reason for it is arrogant - even if you are right 95% of the time. Same goes for assuming you could come up with a better solution without knowing the constraints the IT department faces. The solution for programmers that hate this sort of thing seems straight forward -- don't work in these sorts of businesses -- develop your chops so you can land a job in a hot startup (or a business that has that atmosphere) where you get the best gear and can do whatever you want. Or maybe start your own business or freelance. Until you get there, don't take out your frustrations on your coworkers by trying to bypass them -- that is just childish. For people in IT, they should be aware if they are not in a business that requires these sort of frustrating policies, they should not be trying to implement them unless they really have to. Those are the IT guys people have the right to dislike. They try to turn a small fun start up into some sort of draconian government institution because of some personal insecurities or they think that is just how it is done. In short, be aware of the sort of industry you working in, or might work in, and what to expect there.

quanticle 15y ago
Getting around the policies just to get around the policies makes you an ass, I agree. Getting around the policies to do your job, on the other hand, does not. I worked at a firm where I was asked by a VP to perform some testing on a VM. The VP wanted the test results by the end of the week. IT said that it would take at least three weeks to approve the specific VM software for my machine, even though there were other developers already using the software. End result? I ended up installing it and doing my job without IT's permission. I had made sure to get everything in writing from the executive, so I could show IT my reasoning if I was ever called out for it. I'm not proud of what I did, but I don't think I should have to ask permission in order to do my job.

knieveltech 15y ago

If any of my "users" where to pull any of the bullshit stunts you've listed here on my watch I guarantee you I'd have them fired within five business days if it meant I had to send spoofed mail from their address containing horse porn to the head of HR to pull it off. In a medium to large company, IT's job isn't to make you happy. This is typically impossible thanks to a combination of understaffing and budget issues. Their job isn't to debate you on software choices or provide coherent explanations of corporate IT policy. It isn't even keep you productive. It's to make sure the cube dwelling luddites (and if you aren't in IT you are one, regardless of how much you know about computers) don't break critical infrastructure. Spend 32 hours over a weekend quarantining and disinfecting an entire network because some dickhead decided he needed to bring in his malware-infected laptop to work and the standard company policy banning private equipment comes into focus pretty quickly.

oz 15y ago
You're being downvoted because of the 'spoofed email' line, but I understand where you're coming from. "Spend 32 hours over a weekend quarantining and disinfecting an entire network because some dickhead decided he needed to bring in his malware-infected laptop to work and the standard company policy banning private equipment comes into focus pretty quickly." Bet it was unpaid overtime too, wasn't it? Take one instance I've seen: group of guys decide that they want wireless access on their floor. One brings his home WiFi router, and plugs it right in. So now anyone walking by with cursory knowledge of WiFi hacking could get all our data. Just because they wanted Youtube on their BlackBerries.
gatlin 15y ago
> I'd have them fired within five business days if it meant I had to send spoofed mail from their address containing horse porn to the head of HR to pull it off At least you're creative when you put ethics in the back seat.