8 ms·

It requires two things. Firstly, an IT team which works with users rather than against users. That might be as simple as adding all the "core" apps to MDM to e

• closeparen 4y ago
  >Realistically, how often do you need to install brand-new non-standard software? If it is a regular occurrence then you need a process by which you can request it and the IT team can assess how they manage it. Brew is a pretty regular part of my workflow, although that's more often restoring the environment after an IT-mandated OS upgrade than net-new software. Also there's a couple of thousand third-party dependencies in the monorepo, seeing ~100 changes per month. I'm grateful that engineering workflow is managed by engineering platform teams... corporate IT is a totally different beast, and it'd be pretty dysfunctional if they micromanaged this stuff..
  • calvinmorrison 4y ago
    I was asked what software I needed and dumped the output of /usr/bin when they pressed me for an exact list. It was bizarre
    • ParetoOptimal 4y ago
      I hope you sorted by .bash_history otherwise they'll be busy verifying hello, bc, and mount when you need vim most.
• dmix 4y ago
  > you're not allowed to install bonzibuddy.exe from Limewire. Would a "recommended"/typical MDM rule set mean you can't install "unidentified developer" licenses on Macbooks? The usually checkbox every mac user normally enables in security settings?
  • wpm 4y ago
    Former Mac admin here. I never locked Gatekeeper down that strict, but I did enforce the setting where if you just double clicked some nonsense, it would it let you open it. You had to right click and then open from the context menu and blow through the warning. Ultimately I depended on our endpoint protection software and Jamf inventory to keep things clean. Jamf I could setup to alert me on known malware/bad shit, or in this case, specific versions of apps so I knew who I needed to reach out to, and then endpoint protection for everything else. Good enough for our HIPAA auditors.
• dj_mc_merlin 4y ago
  > Firstly, an IT team which works with users rather than against users. > Realistically, how often do you need to install brand-new non-standard software? There is some cognitive dissonance happening here.
  • vladvasiliu 4y ago
    Not necessarily. I think the two lines actually work together. If the IT team works with the users rather than against them, the friction of adding new software is "low". It is, of course, strictly higher than if the user can just install whatever whenever. But, GP posits, this increase (from "none" to "low") is further mitigated by the fact that, in practice, this friction-generating need does not arise often.
    • dj_mc_merlin 4y ago
      I understand, it was a snarky way to point out that the IT person is perhaps out of touch with developers. It might be he works in a more tightly regulated industry (which should be pointed out when giving advice anyway). I don't think I've gone more than one week in my professional live without installing some sort of new executable on my dev machine. How do you test out software/libraries before you use them in a project? Do you make the decision ex nihilo and then ask IT to install them for you? That would be insane. How do you test out new toolchains? What if you need a random tool for processing a file format you're working with that isn't approved yet? Without root, what do you do when your Linux gets messed up? Ping IT and.. wait? Just stare out the window?
      • pas 4y ago
        Ideally a security researcher takes a look at it, then it gets whitelisted. Sure, to simply try it the best way might be to set up a new machine not connected to the corporate network/domain. If it's an open source library it might be easier, but still the questions are the same: is it secure, is the added maintenance worth it, does it have a community maintaining it, what is its security track record... it might be as easy to answer this as "nobody got fired for using OpenSSL/Oracle/IBM" or "no single committer libs ever" There's no universal right/wrong answer. > What if you need a random tool for processing a file format you're working with that isn't approved yet? you don't. this is how companies grow to these enormous headcounts. there are specialists for everything, everybody has their own cubicle, and there is a huge support:corebiz ratio. also, in practice, there are usually hybrid ways. eg. you can install whatever, but it silently disappears overnight. is that better? who knows.
• bboygravity 4y ago
  > Realistically, how often do you need to install brand-new non-standard software? Almost every day. Sometimes multiple times a day in case of a new project / new embedded hardware (toolchain) / new devkit to "quickly test" / tight deadlines, etc. > If it is a regular occurrence then you need a process by which you can request it and the IT team can assess how they manage it. There isn't. It has been attempted to get such a process multiple times over the past years. With and without escalation to higher ups all the way up to the CEO. The IT team promises they'll speed things up, but a software approval for 1 app still takes at least 3 months. Now what? I'll tell you now what: employees and contractors alike just start using their own fully unlocked (perhaps badly updated) machines out of desperation and transfer files to and from locked-down company machines using email or onedrive or whatever other means possible. Maybe better companies exist?
  • octodog 4y ago
    I work at a bank and I can tell you that nobody is emailing or sharing files to their personal devices. Doing so would have you fired on the spot. At my workplace apps are whitelisted and it's honestly not a big deal. Very rarely do I find myself in a situation where I can't access the tools that I need.
    • adrian_b 4y ago
      Working at a bank and working as a design engineer or low-level programmer have extremely different requirements for a work computer. My experience, after working in many big and small companies in several countries and multiple continents matches perfectly what the above poster has said, i.e. at least for any kind of design or testing work that involves external hardware, the only way to get anything important done is to circumvent any restrictive IT policies, which are always made by people who might have worked in a bank, so they have no idea about how a computer is used for designing or testing hardware or software for embedded computers. Most of the work that I have ever done could not be done on company-managed computers, so I usually had to do it on my own computer and transfer then the results to the company computer, which was used only for communication inside the company, through e-mail/Teams/internal file servers etc., and for writing reports or other documents.
• ar_lan 4y ago
  Nix would be a good solution to this. Have a corporate cache for all installed software with approved versions that folks can pin their environments to. Ticketing still needs to be in place, but it can also be a managed repository that can be audited/reviewed by IT team as well - tickets could be as simple as a Pull request.
  • pixl97 4y ago
    Working with large financial clients I've seen that most companies have systems somewhat like this already. Reviewed software is internally available for download off an intranet site, and some kind of request system exists if you need a newer version and you'll get an update on when it's available.
• gpm 4y ago
  > Yes, it sucks that you're not allowed to install bonzibuddy.exe from Limewire. Nothing says empathy for your users like making caricatures out of them.
  • pixl97 4y ago
    I can have empathy on users for them wanting to treat the development system they are on for 1/3rd of their daily lives like a personal machine. What I cannot actually allow is them treating their development machine like a personal machine.
• gregmac 4y ago
  > it requires a development team to realise that just because they're good at programming computers it doesn't mean they're good at administering them. Yes, it sucks that you're not allowed to install bonzibuddy.exe from Limewire What exactly is IT doing when a dev requests to install randomtool.exe? Why is it a developer is incapable of that same thing? > Realistically, how often do you need to install brand-new non-standard software? Well, does my own software count? I mean, I've run an executable that didn't exist 5 second ago more times than I could possibly count. I've also built installers for said software, and then executed and installed it on my machine. Is that ok? If so, why (if I also can't download and run something from github)? If it's not ok... how I supposed to do my job?
  • octodog 4y ago
    Pretty weird question. Are you writing malicious executables and then running them at work?
    • hawski 4y ago
      With this logic we don't need IT policies, because I just don't run malicious executables. Thanks to that I can run a graphical session with root.
    • gregmac 4y ago
      What the GP is talking about is not letting developers install stuff on their PC. I assume this is also "run unknown exe" because.. well I can't see any reason local root could hurt the network in a way my user account couldn't. Unless maybe the PC is shared, there's no difference of install (local root) compared to run as normal non-user, as far as attack surface on the network. So this comes back to: do you block "potentially malicious" executables or not? How do you tell if a new never-before-seen executable needs to be blocked, without either just blocking every unknown executable ("dev can't get anything done") or opening a giant loophole ("anything in x directory is safe")? Let me write it a different way: An exe with an unrecognized name and unrecognized sha256 suddenly appears on my computer. Maybe I just compiled it from source I wrote, or maybe it is a random thing I downloaded and unzipped. How does a decision get made on whether my system will run that or not?
• jlarocco 4y ago
  I agree with you, but on Windows it's difficult. If you are not an administrator on the computer that you are using, you should run Visual Studio as an administrator while you are using the profiler. (Right-click the Visual Studio application icon, and then click Run as administrator. https://learn.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2015/profiling/beginners-guide-to-performance-profiling?view=vs-2015&redirectedfrom=MSDN https://learn.microsoft.com/en-us/previous-versions/visualst...
  • alkonaut 4y ago
    If you are a developer using VS, your org most likely has to make an exception for VS for this very reason. Then you realize that Visual Studio has a menu where you can launch a command prompt which will inherit the privileges the IDE was started with...
• pif 4y ago
  No way! Not with Microsoft, at least! As a researcher, I used to work on Linux and I never ever even imagined I could ask for administrator privileges. In the industry, it's Microsoft all around. And it shows. And R&D software managers sign administrator privilege requests without batting an eyelid because they know that otherwise they are paying us for nothing.
• dathinab 4y ago
  > Secondly, it requires a development team to realise that just because they're good at programming computers it doesn't mean they're good at administering them. That's a so annoying thing, I understand enough about admin stuff to understand that I have huge knowledge gaps but I'm seeing people all the time assuming they can securely administrate docents of servers while having less knowledge then I just because they made things somehow run (but then I also have seen more then just one or two really bad admins). The worst case was someone who through because they have a doctor title in numerical math that and a (small) bit of programming/admin experience that they know what is needed to securely administrate a "private cloud" (cloud isn't quite the right term here,but good enough). As expected it lead to the company being hacked due to some major security gaps in less then 2 years.
  • pixl97 4y ago
    Working in the industry for a while now I've come to the realization that developers in the vast majority of situations are not security engineers, and should not and cannot be trusted to ensure both the software they write and the systems they run are secure in any manner. Security itself is a set of processes and policies where different teams monitor and ensure compliance with said policies. If security policies get in the way of the software compiling/working developers will disable security (and sometimes for short periods of time this is needed for testing to figure out why something has gone wrong). But it becomes easy and commonplace for developers to turn off the security because it gets in the way of productivity. And that's the problem with security, you don't generally get punished for violating it immediately by an attacker. It can be months or even years before someone downloads your source code and posts it online. You may not notice for months that your database was breached and everyone that you don't want has a list of your customers.
• deleted 4y ago
  [deleted]
• alkonaut 4y ago
  > how often do you need to install brand-new non-standard software? That depends on the definition of non-standard I guess. If I want to quickly throw together a proof of concept product I might need to grab node/npm/postgres/ for example. Waiting even a half day for approval is too much in that scenario I think. So it's problematic in some situations to have an approval process. But in a typical month I'd say it's around once or twice that I need to run new software. Some times I feel that we should just take the opposite approach. Don't trust employee machines! In my work I just commit code to a repo that isn't on a company machine anyway (github/azure devops etc). I don't use documents/network shares/databases/vpns whatever that is on a company network. I could work on my personal machine and no one would notice. The threat model for a laptop connected to a private github repo is what? a) that a compromised machine can be used in a supply chain attack, and b) that a compromised machine could be used to read secrets/IP from the private repo. That's it. I wonder whether that threat, for normal "low risk" development work is worth the hassle of even bothering with locked down machines? In some situations I have resorted to running tools inside a VM on my dev machine, where I can play god if I need to. But really this isn't any different from the above. There is a machine where you can do anything, and which hasn't got access to anything sensitive.
  • nickcox 4y ago
    > depends on the definition of non-standard I guess. Depends on the definition of 'software' also. Strictly speaking, every npm package is someone else's code running on your machine. Often with quite wide ranging permissions. If you need approval from IT to add a package or increment a version then your development process is going to be slow for sure.
• Hakashiro 4y ago
  As a restaurant owner, would you prevent an expert cook employee from using their favourite brand of knives? Or even knives they bring from home? Probably not. What if your insurance only covered certain brands and explicitly excluded the ones your cook used? That would probably make the cook less happy and less effective. Yes, happiness is important. Your employees perform their best when they use their favourite tools. This can either be Vim, their own ergonomic keyboard or even Linux instead of Windows. Every restriction you add increases friction and decreases output. No, it's not about installing Bonzi Buddy, it's about giving your people the best tools (the tools they like) to perform their best. Sometimes this incurs risks like unpatched vulnerabilities, like any software, but to go and paint this as some sort of entitled attitude developers have is plain ridiculous, honestly.
• ParetoOptimal 4y ago
  > Yes, it sucks that you're not allowed to install bonzibuddy.exe from Limewire. Agreed. > But your needs aren't more important than protecting the integrity of the network and company. Uh... no. Never put the needs of a company over your personal needs. (bonzibuddy.exe isn't a need)