7 ms·
We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?
by hyperman1 4y ago
We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?
- BizarroLand 4y agoI would have taken that as my queue to start finding another job. Not that I can't puzzle everything out from scratch every single time I need to do anything, but why should I reinvent the wheel when off-the-shelf is both faster and higher quality?
- thedougd 4y agoThese types of policies and mismanagement drives out the best talent and leaves the organization filled with coasters who love any excuse to not do their job.
- nightpool 4y ago(cue, as in "a signal (such as a word, phrase, or bit of stage business) to a performer to begin a specific speech or action", e.g. "That last line is your cue to exit the stage". See https://www.merriam-webster.com/dictionary/cue https://www.merriam-webster.com/dictionary/cue)
- BizarroLand 4y agoRats. I should have known it was the wrong version when my brain made me slow down to spell it out. Thanks for the correction!
- nightpool 4y agohaha, no worries. glad it helped!
- arethuza 4y agoAbout 2003/2004 I was working onsite at a customer that blocked access to Google - that was fun.
- jiggawatts 4y agoAs recently as 2015 I was working at a customer site where the web proxies were so misconfigured that Google was effectively blocked. The main page would load about a third of the time after maybe ten or twenty seconds. This was a huge org with 15K users, including dozens of developers and hundreds of general IT staff. Turns out that a one-checkbox-tick fix was all it took to make that go away. The woman in charge of the web proxies panicked, thinking that this change had "broken something", reverted the change, and then refused to change it back. Fun times.
- raxxorraxor 4y agoRE: RE: stackoverflow access CC: Management With such a strategy for learning everyone would end up in IT security. Regards, hyperman1
- incomingpain 4y agoAs a security guy, we are taught the CIA triad early and it's easy to forget. The A stands for availability and if you don't make things available, you're failing at your own job.
- zasdffaa 4y agoCI = ??
- easton 4y agoConfidentiality, Integrity
- zweifuss 4y agoI didn't know either, so I looked it up: The three initials stand for the three most important IT protection goals, often referred to as the "pillars of data security": Confidentiality, Integrity, Availability. There are other IT protection goals, including authenticity, privacy, reliability, and (non)repudiation.
- microjim 4y ago>authenticity, privacy, reliability, and (non)repudiation. These fall under integrity, confidentiality, availability, and integrity respectively! The CIA triad is pretty comprehensive!
- doubled112 4y agoI think CIA covers everything in the list, right? Authenticity and non-repudiation falls under integrity. Privacy falls under confidentiality. Reliability in context is another word for availability.
- microjim 4y agoWell, that depends. You certainly want to ensure the availability of the information under your remit isn't compromised by a threat actor, but reducing your attack surface by, say, shutting down external internet access is certainly a valid mitigation in some circumstances.
- zasdffaa 4y agoLittle experience with javadocs, so how do they fall?
- n4r9 4y agoAlso no experience with javadocs or Java, but in my experience Stackoverflow is a huge productivity boost for a junior dev. For example I wonder if javadocs shows you how to convert an InputStream to a string, as per this question: https://stackoverflow.com/questions/309424/how-do-i-read-convert-an-inputstream-into-a-string-in-java https://stackoverflow.com/questions/309424/how-do-i-read-con...
- karatinversion 4y agoI’ve used javadocs plenty, and really like them, but they are organised by package and class, so figuring out how to do something when you don’t know what package to use is very painful. Say you want to know how to delete a file at a given path. I’ve been around the block a few times, so I’ll know that it’ll probably be an operation on java.nio.file.Path, so I can find the Java doc for that, hit “Uses”, and search for “remove” (nothing) and “delete” (ah-hah, there it is). If you don’t have a starting point like that from prior experience or stackoverflow, you’re stuck clicking around the package lists, hoping to land on something useful
- richbell 4y agoJavaDocs are like the owner's manual included in a car: useful for many things, but if you need to figure out what route to take to get from point A to point B it probably won't help you.
- duckydude20 4y agoi am a junior developer and now i am rely heavily on them. esp, multi-threading stuff. but in most cases i know what i am looking for. the particular interface or at least i have some idea. this in true for most jdk framework. others java docs indirectly. ctrl + q. but i do sometimes go back and search uses/example of some implementation i found via docs. eg. selector and channels... but rn, i am liking reading docs first.
- reisse 4y agoWe once had an idea about integrating libtorrent for distributing binaries. Turned out libtorrent website was banned by corporate firewall due to "piracy". Decided the idea was not worth it to fight with infosec guys.
- easton 4y agoIf anyone is stuck somewhere like this, Stack Overflow has dumps regularly updated on archive.org -- https://archive.org/download/stackexchange/ https://archive.org/download/stackexchange/ Dash (or its Windows equivalent, name escapes me) can be used to view and search these dumps (as well as dumps from GitHub, language docs, etc) offline: https://kapeli.com/dash https://kapeli.com/dash
- ravio64 4y agoWindows equilevant is zeal, which dash is a mac version of :)
- Karawebnetwork 4y agoAnother alternative to Zeal is DevDocs with its offline mode. https://devdocs.io/offline https://devdocs.io/offline
- lgvld 4y agoAmazing website/tool, thank you! ;-)
- youainti 4y agozeal also has a linux version
- bluedino 4y agoArchive.org is also blocked in a lot of these places.
- P5fRxh5kUvp2th 4y agoI was recently told by an old-timer at my current company that at one point security tried to remove Visual Studio from developers machines because it had reported security incidents. The problem with security people is that they think security is the most important thing.
- denton-scratch 4y agoWell, for them, it is and should be the most important thing. The problem bites when management shares that view.
- happimess 4y agoThe most secure option is to bury everyone's computer in concrete.
- unethical_ban 4y agoThe problem with devs is they think all security admins are reductionist. <3 A good security admin will work within the bounds of compliance to make the business work. And any good blocks will be apparent to the user. Trust me, security doesn't enjoy pissing people off, we just accept that it happens sometimes.
- P5fRxh5kUvp2th 4y agolast week a former co-worker called me laughing. He was on the phone with the CISO who was explaining it's impossible to give him access to SPLUNK because of the network segmentation. While he's ON THE PHONE, he received an email from the IT group with credentials to access splunk. And to be clear, I left specifically because of their security stance. I was once told they couldn't automate pulling data from production because of the same reason as mentioned above, the network segmentation wouldn't allow it. So no, developers aren't just whining because they can't directly access PAN. Security people always think their concerns should trump everything else. I would almost be willing to bet 70% of the mind-numbingly stupid decisions made across the industry had some security justification behind it. If human beings took the same approach to safety that Security people do to security, they'd insist the wheels on your vehicle should only be able to turn straight and right. That the vehicle should _actively_ prevent you from turning your wheels left because left turns are more dangerous than right turns and they can show that you can _always_ get to your destination with just right turns.
- deathanatos 4y agoA previous employer of my blocked the XTerm escape sequence reference. Like, okay, may your terminal output be plain and boring, I guess. Also, the link to "request an exception" lead to a 404 and the IT team responsible for the blocking didn't respond to email.
- bluedino 4y agoThere are a number of sites categorized as 'file sharing or download' that we can't get to, here. Ugh. Bad idea when your userbase runs on free software. Oddly enough, I can get on imgur https://imgur.com/CUncIEP https://imgur.com/CUncIEP