3 ms·

I understand, it was a snarky way to point out that the IT person is perhaps out of touch with developers. It might be he works in a more tightly regulated indu

I understand, it was a snarky way to point out that the IT person is perhaps out of touch with developers. It might be he works in a more tightly regulated industry (which should be pointed out when giving advice anyway). I don't think I've gone more than one week in my professional live without installing some sort of new executable on my dev machine. How do you test out software/libraries before you use them in a project? Do you make the decision ex nihilo and then ask IT to install them for you? That would be insane. How do you test out new toolchains? What if you need a random tool for processing a file format you're working with that isn't approved yet? Without root, what do you do when your Linux gets messed up? Ping IT and.. wait? Just stare out the window?

pas 4y ago
Ideally a security researcher takes a look at it, then it gets whitelisted. Sure, to simply try it the best way might be to set up a new machine not connected to the corporate network/domain. If it's an open source library it might be easier, but still the questions are the same: is it secure, is the added maintenance worth it, does it have a community maintaining it, what is its security track record... it might be as easy to answer this as "nobody got fired for using OpenSSL/Oracle/IBM" or "no single committer libs ever" There's no universal right/wrong answer. > What if you need a random tool for processing a file format you're working with that isn't approved yet? you don't. this is how companies grow to these enormous headcounts. there are specialists for everything, everybody has their own cubicle, and there is a huge support:corebiz ratio. also, in practice, there are usually hybrid ways. eg. you can install whatever, but it silently disappears overnight. is that better? who knows.
- dj_mc_merlin 4y ago
  Thanks for the answer. That sounds horrible^Hy unproductive, although I suppose some cost must be paid for mass collaboration. Also out of interest, is the answer to this: > what do you do when your Linux gets messed up? indeed just "wait for IT to fix it"? What do you do until then, have lunch?
  - pixl97 4y ago
    When you get struck by a watering hole attack and drag malware inside the corporate network that proceeds to start encrypting everything not only for your own system, but your coworkers around you and an entire team of developers is sitting around twiddling their thumbs while all the systems are restored, that's when we realize playing fast and loose with stuff off the internet can have far reaching effects. Having something go wrong on your personal system can be an 'oops', having something go wrong in any number of regulated industries can be a 'news generating event'.
    - dj_mc_merlin 4y ago
      > having something go wrong in any number of regulated industries can be a 'news generating event'. I did say that if you work in a tightly regulated industry, obviously stuff is different. This should be pointed out though! You can't give advice for the medical or financial sector to someone with a 15-person startup that builds low-stake products. It's just not going to be the right advice, as you well know security is a tradeoff. I guarantee that disabling root on dev computers is a huge productivity hit -- you need to be sure of the pros/cons of making that decision.
  - pas 4y ago
    Why would your Linux get messed up? > That sounds horrible^Hy unproductive A friend of mine works for BlackRock, they simply work on remote Windows virtual desktops. He is not complaining about speed/efficiency. A different friend works for ALDI (like Walmart just smaller), he got an issued MacBook (Pro?). When he connected an external USB hard drive the next day (or sooner?) he got an email about it because some automated scanner thing found something suspicious on it. So at these sizes software development is already inefficient. But mostly because of the complexity. (You know ... https://www.youtube.com/watch?v=y8OnoxKotPQ&t=95s https://www.youtube.com/watch?v=y8OnoxKotPQ&t=95s )

pas 4y ago

Ideally a security researcher takes a look at it, then it gets whitelisted. Sure, to simply try it the best way might be to set up a new machine not connected to the corporate network/domain. If it's an open source library it might be easier, but still the questions are the same: is it secure, is the added maintenance worth it, does it have a community maintaining it, what is its security track record... it might be as easy to answer this as "nobody got fired for using OpenSSL/Oracle/IBM" or "no single committer libs ever" There's no universal right/wrong answer. > What if you need a random tool for processing a file format you're working with that isn't approved yet? you don't. this is how companies grow to these enormous headcounts. there are specialists for everything, everybody has their own cubicle, and there is a huge support:corebiz ratio. also, in practice, there are usually hybrid ways. eg. you can install whatever, but it silently disappears overnight. is that better? who knows.

dj_mc_merlin 4y ago
Thanks for the answer. That sounds horrible^Hy unproductive, although I suppose some cost must be paid for mass collaboration. Also out of interest, is the answer to this: > what do you do when your Linux gets messed up? indeed just "wait for IT to fix it"? What do you do until then, have lunch?
- pixl97 4y ago
  When you get struck by a watering hole attack and drag malware inside the corporate network that proceeds to start encrypting everything not only for your own system, but your coworkers around you and an entire team of developers is sitting around twiddling their thumbs while all the systems are restored, that's when we realize playing fast and loose with stuff off the internet can have far reaching effects. Having something go wrong on your personal system can be an 'oops', having something go wrong in any number of regulated industries can be a 'news generating event'.
  - dj_mc_merlin 4y ago
    > having something go wrong in any number of regulated industries can be a 'news generating event'. I did say that if you work in a tightly regulated industry, obviously stuff is different. This should be pointed out though! You can't give advice for the medical or financial sector to someone with a 15-person startup that builds low-stake products. It's just not going to be the right advice, as you well know security is a tradeoff. I guarantee that disabling root on dev computers is a huge productivity hit -- you need to be sure of the pros/cons of making that decision.
- pas 4y ago
  Why would your Linux get messed up? > That sounds horrible^Hy unproductive A friend of mine works for BlackRock, they simply work on remote Windows virtual desktops. He is not complaining about speed/efficiency. A different friend works for ALDI (like Walmart just smaller), he got an issued MacBook (Pro?). When he connected an external USB hard drive the next day (or sooner?) he got an email about it because some automated scanner thing found something suspicious on it. So at these sizes software development is already inefficient. But mostly because of the complexity. (You know ... https://www.youtube.com/watch?v=y8OnoxKotPQ&t=95s https://www.youtube.com/watch?v=y8OnoxKotPQ&t=95s )