> What exactly is IT doing when a dev requests to install randomtool.exe? Selecting/paying for secure repositories from legitimate well maintained sources. Pa

> What exactly is IT doing when a dev requests to install randomtool.exe? Selecting/paying for secure repositories from legitimate well maintained sources. Packaging the software and deploying it through some means, so all users who need the software can get the software. Regular patching of software across many users who may only be intermittently connected to the internet. Lots of busywork updating configurations as new teams are formed, teams dissolve, people come, people leave, new patches come out, new software comes out, have to move to a new OS with old software. Company policy or circumstances might require some tweaks. Generally though as to your question, there’s no reason you can’t do what the IT department does. The IT department can also have such a setup and then have a dev sandbox environment you can pull random code into. The larger point of what they’re doing is building a software supply chain, and once you actually have every piece of software you’re using in a secure repository, you can do BIG things like blocking all applications that aren’t whitelisted in prod which essentially shuts down entire classes of security threats against a company, and maybe that’s what a company wants. Maybe a company shouldn’t be trying to maintain a centralized repository and that’s a dumb idea…