4 ms·

> Realistically, how often do you need to install brand-new non-standard software? Almost every day. Sometimes multiple times a day in case of a new project /

> Realistically, how often do you need to install brand-new non-standard software? Almost every day. Sometimes multiple times a day in case of a new project / new embedded hardware (toolchain) / new devkit to "quickly test" / tight deadlines, etc. > If it is a regular occurrence then you need a process by which you can request it and the IT team can assess how they manage it. There isn't. It has been attempted to get such a process multiple times over the past years. With and without escalation to higher ups all the way up to the CEO. The IT team promises they'll speed things up, but a software approval for 1 app still takes at least 3 months. Now what? I'll tell you now what: employees and contractors alike just start using their own fully unlocked (perhaps badly updated) machines out of desperation and transfer files to and from locked-down company machines using email or onedrive or whatever other means possible. Maybe better companies exist?

octodog 4y ago
I work at a bank and I can tell you that nobody is emailing or sharing files to their personal devices. Doing so would have you fired on the spot. At my workplace apps are whitelisted and it's honestly not a big deal. Very rarely do I find myself in a situation where I can't access the tools that I need.
- adrian_b 4y ago
  Working at a bank and working as a design engineer or low-level programmer have extremely different requirements for a work computer. My experience, after working in many big and small companies in several countries and multiple continents matches perfectly what the above poster has said, i.e. at least for any kind of design or testing work that involves external hardware, the only way to get anything important done is to circumvent any restrictive IT policies, which are always made by people who might have worked in a bank, so they have no idea about how a computer is used for designing or testing hardware or software for embedded computers. Most of the work that I have ever done could not be done on company-managed computers, so I usually had to do it on my own computer and transfer then the results to the company computer, which was used only for communication inside the company, through e-mail/Teams/internal file servers etc., and for writing reports or other documents.
- _trampeltier 4y ago
  I work in a factory in industry automation and we also never ever use with personal devices. That said, it is possible for some few guys in the the tech to get an local admin account to install software, or even just to change IP-addresses. For ex. often VPNs (external people can connect to a machine) don't work and so we had several times the case a machine did stand still because of it. Then of course we not just make a link with a phone. We make a mail to the CEO and he take care of it with the IT.
fhd2 4y ago
Sounds like you have slightly unusual needs - I install NPM packages and the like all the time (which I haven't seen any company attempt to oversee yet), but very few binaries. Sounds like you need binaries the way I need these packages, so it sounds odd that the company wouldn't come up with some solution - dedicated VM, special exceptions, whatever.
- heisenbit 4y ago
  Some of the NPM packages contain binaries.
- fock 4y ago
  so what exactly is the difference between binaries and scripts executing arbitrary system calls?
  - fhd2 4y ago
    For the purpose of our discussion: None whatsoever. That's my point. Corporate IT mandates what they know/think about, quite often unfortunately without any understanding of the specific needs of employees (like parent). I found it to be a better strategy to start from a prioritised list of risks and tackling the high priority items in an actually meaningful way. But I can see how that doesn't work at companies with >300 employees - at one point security just pushes for whatever they can get, disconnected from the true needs and relevant risks at the company.
- herbstein 4y ago
  My company has a policy that all software needs to be explicitly approved. That includes any software library, extension, or package from a package manager. Is it followed? Not in the slightest! Something I recently ran into: the Rust version manager 'rustup' is approved but neither the compiler nor the package manager have been approved. That's despite our core product having used Rust libraries through the C ABI for years. Madness!
jve 4y ago
> The IT team promises they'll speed things up, but a software approval for 1 app still takes at least 3 months. Now what? Ouch. I wonder if those apps are one-off for particular task or you just find so many useful apps every day. Anyway, Windows now features Sandbox mode - a great place to install untrusted apps as the sandbox is discarded on close. https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://learn.microsoft.com/en-us/windows/security/threat-pr...
padjo 4y ago
Rather than cheat the system to get the project done you probably need to let the project be late and then explain that it was late because IT dragged their feet on app approval. That will make it pretty clear to the powers that be that this needs to be fixed.
- sbuk 4y ago
  To be fair to IT teams, it normally SOC that drag their heels on software approvals.
- nisegami 4y ago
  Correct. The only way to actually bring about change is to make sure the ones with the power to change things feel the pain associated with their decisions.
- Throw10987 4y ago
  I feel this could be dangerous advice to follow.
  - _trampeltier 4y ago
    No, it's the only way things get better. First if you cheat the system and something does happen, it's your and just your fault. Why take the risk. If the company has rules, it's also the companys job to make your work possible with these rules.
    - duggan 4y ago
      I'd like to believe this works, but my experience in Big(ish) Corp is that you get the blame. If you think you're in a position to change it and you're motivated to do so, go for it, otherwise my experience is that you're better off finding somewhere else to work.
      - pixl97 4y ago
        CYA via email and other documented functions, but you are correct in the sense you're better off finding somewhere else to work. I've seen too many companies set up systems that you cannot be in compliance with but there is no punishment for non-compliance unless they are looking to get rid of you.
dathinab 4y ago
> Almost every day. Sometimes multiple times a day in case of a new project / new embedded hardware (toolchain) / new devkit to "quickly test" / tight deadlines, etc. The approach normally doesn't count project local tools which don't install like normal applications. E.g. some frameworks you install into your project instead of having user or system wide installations (e.g. with npm for web-dev stuff). I know that for embedding computing a lot of tools which are normally ad-hoc project installations are instead system wide "normally installed programs". But that isn't the case for most software development fields. In many other fields that new tool-chain you want to try out is just a dependency you add to your projects dependency management tool. And keeping it up to date is done in the same way you keep your other dependencies up to date (e.g. a scheduled CI job checking for updates). Rootless OCI (docker) containers can help with that. But embedding also often touches on driver aspects so it might not be an option. Anyway if you ignore embedding programming, parts of system programming (e.g. linux kernel), some legacy software and some cases of important C/C++ tools needing too many permissions nearly all other programming jobs should be viable on a locked down system as long as you have the right not too big set of tools preinstalled and access to rootless containers (independent of weather they run in a VM or not). EDIT: formulations, for clearity
- voxic11 4y ago
  vscode has a portable version that can be installed as a project local tool. So would vscode installed in such a way also be an exception to this approach?
  - dathinab 4y ago
    It's less about if it's install-able in a project and more if it's project specific, so IDEs should if possible not be included. Furthermore if possible stand alone tooling which tend to not be very version sensitive can be nice to not include: E.g. git, npm, rustup, pip and similar are preferable system installations. Furthermore frameworks and similar tend to go through the package manager and whatever update handling you have for it. But a drop in IDE likely would not.
- aflukasz 4y ago
m_mueller 4y ago
azure AD has a privilege escalation mechanism to local admin. you enter e.g. the jira ticket reference for documentation and the system gives you an 8h window to enable localadmin on your machine with the particular AD user. we use it to give e.g. architects who often try new software to do what you describe in an efficient manner.

octodog 4y ago

I work at a bank and I can tell you that nobody is emailing or sharing files to their personal devices. Doing so would have you fired on the spot. At my workplace apps are whitelisted and it's honestly not a big deal. Very rarely do I find myself in a situation where I can't access the tools that I need.

adrian_b 4y ago
Working at a bank and working as a design engineer or low-level programmer have extremely different requirements for a work computer. My experience, after working in many big and small companies in several countries and multiple continents matches perfectly what the above poster has said, i.e. at least for any kind of design or testing work that involves external hardware, the only way to get anything important done is to circumvent any restrictive IT policies, which are always made by people who might have worked in a bank, so they have no idea about how a computer is used for designing or testing hardware or software for embedded computers. Most of the work that I have ever done could not be done on company-managed computers, so I usually had to do it on my own computer and transfer then the results to the company computer, which was used only for communication inside the company, through e-mail/Teams/internal file servers etc., and for writing reports or other documents.
_trampeltier 4y ago
I work in a factory in industry automation and we also never ever use with personal devices. That said, it is possible for some few guys in the the tech to get an local admin account to install software, or even just to change IP-addresses. For ex. often VPNs (external people can connect to a machine) don't work and so we had several times the case a machine did stand still because of it. Then of course we not just make a link with a phone. We make a mail to the CEO and he take care of it with the IT.

fhd2 4y ago

Sounds like you have slightly unusual needs - I install NPM packages and the like all the time (which I haven't seen any company attempt to oversee yet), but very few binaries. Sounds like you need binaries the way I need these packages, so it sounds odd that the company wouldn't come up with some solution - dedicated VM, special exceptions, whatever.

heisenbit 4y ago
Some of the NPM packages contain binaries.
fock 4y ago
so what exactly is the difference between binaries and scripts executing arbitrary system calls?
- fhd2 4y ago
  For the purpose of our discussion: None whatsoever. That's my point. Corporate IT mandates what they know/think about, quite often unfortunately without any understanding of the specific needs of employees (like parent). I found it to be a better strategy to start from a prioritised list of risks and tackling the high priority items in an actually meaningful way. But I can see how that doesn't work at companies with >300 employees - at one point security just pushes for whatever they can get, disconnected from the true needs and relevant risks at the company.
herbstein 4y ago
My company has a policy that all software needs to be explicitly approved. That includes any software library, extension, or package from a package manager. Is it followed? Not in the slightest! Something I recently ran into: the Rust version manager 'rustup' is approved but neither the compiler nor the package manager have been approved. That's despite our core product having used Rust libraries through the C ABI for years. Madness!

jve 4y ago

> The IT team promises they'll speed things up, but a software approval for 1 app still takes at least 3 months. Now what? Ouch. I wonder if those apps are one-off for particular task or you just find so many useful apps every day. Anyway, Windows now features Sandbox mode - a great place to install untrusted apps as the sandbox is discarded on close. https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://learn.microsoft.com/en-us/windows/security/threat-pr...

padjo 4y ago

Rather than cheat the system to get the project done you probably need to let the project be late and then explain that it was late because IT dragged their feet on app approval. That will make it pretty clear to the powers that be that this needs to be fixed.

sbuk 4y ago
To be fair to IT teams, it normally SOC that drag their heels on software approvals.
nisegami 4y ago
Correct. The only way to actually bring about change is to make sure the ones with the power to change things feel the pain associated with their decisions.
Throw10987 4y ago
I feel this could be dangerous advice to follow.
- _trampeltier 4y ago
  No, it's the only way things get better. First if you cheat the system and something does happen, it's your and just your fault. Why take the risk. If the company has rules, it's also the companys job to make your work possible with these rules.
  - duggan 4y ago
    I'd like to believe this works, but my experience in Big(ish) Corp is that you get the blame. If you think you're in a position to change it and you're motivated to do so, go for it, otherwise my experience is that you're better off finding somewhere else to work.
    - pixl97 4y ago
      CYA via email and other documented functions, but you are correct in the sense you're better off finding somewhere else to work. I've seen too many companies set up systems that you cannot be in compliance with but there is no punishment for non-compliance unless they are looking to get rid of you.

dathinab 4y ago

> Almost every day. Sometimes multiple times a day in case of a new project / new embedded hardware (toolchain) / new devkit to "quickly test" / tight deadlines, etc. The approach normally doesn't count project local tools which don't install like normal applications. E.g. some frameworks you install into your project instead of having user or system wide installations (e.g. with npm for web-dev stuff). I know that for embedding computing a lot of tools which are normally ad-hoc project installations are instead system wide "normally installed programs". But that isn't the case for most software development fields. In many other fields that new tool-chain you want to try out is just a dependency you add to your projects dependency management tool. And keeping it up to date is done in the same way you keep your other dependencies up to date (e.g. a scheduled CI job checking for updates). Rootless OCI (docker) containers can help with that. But embedding also often touches on driver aspects so it might not be an option. Anyway if you ignore embedding programming, parts of system programming (e.g. linux kernel), some legacy software and some cases of important C/C++ tools needing too many permissions nearly all other programming jobs should be viable on a locked down system as long as you have the right not too big set of tools preinstalled and access to rootless containers (independent of weather they run in a VM or not). EDIT: formulations, for clearity

voxic11 4y ago
vscode has a portable version that can be installed as a project local tool. So would vscode installed in such a way also be an exception to this approach?
- dathinab 4y ago
  It's less about if it's install-able in a project and more if it's project specific, so IDEs should if possible not be included. Furthermore if possible stand alone tooling which tend to not be very version sensitive can be nice to not include: E.g. git, npm, rustup, pip and similar are preferable system installations. Furthermore frameworks and similar tend to go through the package manager and whatever update handling you have for it. But a drop in IDE likely would not.
aflukasz 4y ago

m_mueller 4y ago

azure AD has a privilege escalation mechanism to local admin. you enter e.g. the jira ticket reference for documentation and the system gives you an 8h window to enable localadmin on your machine with the particular AD user. we use it to give e.g. architects who often try new software to do what you describe in an efficient manner.