3 ms·
Sounds like you have slightly unusual needs - I install NPM packages and the like all the time (which I haven't seen any company attempt to oversee yet), but ve
by fhd2 4y ago
Sounds like you have slightly unusual needs - I install NPM packages and the like all the time (which I haven't seen any company attempt to oversee yet), but very few binaries. Sounds like you need binaries the way I need these packages, so it sounds odd that the company wouldn't come up with some solution - dedicated VM, special exceptions, whatever.
- heisenbit 4y agoSome of the NPM packages contain binaries.
- fock 4y agoso what exactly is the difference between binaries and scripts executing arbitrary system calls?
- fhd2 4y agoFor the purpose of our discussion: None whatsoever. That's my point. Corporate IT mandates what they know/think about, quite often unfortunately without any understanding of the specific needs of employees (like parent). I found it to be a better strategy to start from a prioritised list of risks and tackling the high priority items in an actually meaningful way. But I can see how that doesn't work at companies with >300 employees - at one point security just pushes for whatever they can get, disconnected from the true needs and relevant risks at the company.
- herbstein 4y agoMy company has a policy that all software needs to be explicitly approved. That includes any software library, extension, or package from a package manager. Is it followed? Not in the slightest! Something I recently ran into: the Rust version manager 'rustup' is approved but neither the compiler nor the package manager have been approved. That's despite our core product having used Rust libraries through the C ABI for years. Madness!