5 ms·

I hate this full-system (anti-)malware crap as much as the next guy. But this: > - I will occasionally get emails from IT asking why I have a random applicat

I hate this full-system (anti-)malware crap as much as the next guy. But this: > - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary" The issue is that policies have to be fairly general and can't just count on all employees actually knowing what they're doing. And sometimes people actually do shady things, even if it's not intentional. And if IT is understanding, then I think it's OK. The other day, there was a story on the HN front page [0] about some innocuous looking app that got bought and converted to some kind of shady proxy. If I was responsible for my company's staff machines, I sure as hell wouldn't want that kind of crap running on them. What's to say that your random app won't be siphoning up ~\Documents\top_secret.doc? [0] https://news.ycombinator.com/item?id=37052508 https://news.ycombinator.com/item?id=37052508

pc86 3y ago
I actually agree with you, I just brought it up as part of the massive cultural differences between "you managed to download this thing on this very locked down system two years ago, fill out this form to tell us what it is" and "go download steam and here's a steam code for a game, we're playing at 3pm if you want to."
smeagull 3y ago
> policies have to be fairly general They don't actually. This is why roles exist.
- vladvasiliu 3y ago
  They won't have a "smeagull" role, and a "john" role, etc. If you're a dev in a dev shop, the "dev role" could cover a sizeable number of people. In my company's case, they do have roles. The "accountant" role has like 60 people. They're all doing mostly the same thing, so it wouldn't make sense to have 60 accountant1..60 roles.
  - smeagull 3y ago
    Roles are cross functional. You can have ApplicationUser, AllowedDebug, Network1User, PythonDeveloper, Database1Developer, etc. etc.
1123581321 3y ago
Yes but couldn’t they research the app? If IT understands software, they can ask less often.
- vladvasiliu 3y ago
  They're likely understaffed. They're also going to want to know why you're using it. My colleagues have had a case of someone downloading some program which was doing something that was already provided. Turned out "ours" was missing some features, so they've changed that. It can also work as a deterrent. If you know you're going to have to fill out a form, maybe you won't download random stuff unless you actually need it.
  - 1123581321 3y ago
    I understand understaffed although I think that's when siloes should be broken down so technically apt people across the company can reduce the workload (like by advising on a list of safe software that shouldn't be questioned.) I don't appreciate the deterrent culture because it's hard to get to point A to point B without some exploration if the company isn't used to trying to improve how work is done, or improve its thinking. The opportunity cost of preventing bright people from exploring is enormous. I understand, though, that compliance and uniformity are high priorities in some industries. (My experience with this kind of IT comes from aerospace and finance.)
    - vladvasiliu 3y ago
      Oh, I absolutely agree with this. But I think many companies have a hard time with this. The issue being that, of course, this exploration may end up badly. See all the supply chain issues which have made it to the HN front page. So some guardrails should absolutely be in place. I don't know how practical that would be, but I keep thinking we (IT people and adjacent) should possibly have two computers. An "untrusted" one, on which we'd be free to tinker, test new things, etc. No issue with nuking it if anything goes wrong. No access to "important" data or networks. And another, "trusted" one, from which you'd do your admin work, deploy to prod, etc.
jimmaswell 3y ago
Anyone with "software engineer", "developer", or "programmer" in their job title should be given full benefit of the doubt by default and only bothered if the program is proven malware. It's our job to know what we're doing, so we should have admin too. I feel like Ron Swanson in Home Depot every time I have to ask IT to do something.
- burnte 3y ago
  "Anyone with "software engineer", "developer", or "programmer" in their job title should be given full benefit of the doubt" No one gets the benefit of the doubt, and certainly not programmers. You get more leeway with what we'll allow, but not free reign. Most programmers aren't HN level.
  - neerd 3y ago
    > Most programmers aren't HN level Oh boy, the self importance here is hilarious
    - the_only_law 3y ago
      It’s one of the defining cultural cornerstones here.
    - burnte 3y ago
      I'm not a programmer at all, my yearly code output these days can be expressed in double digit hours, and very small ones. I assure you, I do not think of myself as a programmer much less a top tier one.
  - danaris 3y ago
    Ah, yes; because there's a programming skill test we all had to pass to be allowed to post here...
    - graypegg 3y ago
      Yeah, I get it, it’s easy to poke at that phrasing. There’s also a reading of that response where they mean “HN level” like “as confident as the replied-to comment author”. Could even be a bit sarcastic.

pc86 3y ago

I actually agree with you, I just brought it up as part of the massive cultural differences between "you managed to download this thing on this very locked down system two years ago, fill out this form to tell us what it is" and "go download steam and here's a steam code for a game, we're playing at 3pm if you want to."

smeagull 3y ago

> policies have to be fairly general They don't actually. This is why roles exist.

vladvasiliu 3y ago
They won't have a "smeagull" role, and a "john" role, etc. If you're a dev in a dev shop, the "dev role" could cover a sizeable number of people. In my company's case, they do have roles. The "accountant" role has like 60 people. They're all doing mostly the same thing, so it wouldn't make sense to have 60 accountant1..60 roles.
- smeagull 3y ago
  Roles are cross functional. You can have ApplicationUser, AllowedDebug, Network1User, PythonDeveloper, Database1Developer, etc. etc.

1123581321 3y ago

Yes but couldn’t they research the app? If IT understands software, they can ask less often.

vladvasiliu 3y ago
They're likely understaffed. They're also going to want to know why you're using it. My colleagues have had a case of someone downloading some program which was doing something that was already provided. Turned out "ours" was missing some features, so they've changed that. It can also work as a deterrent. If you know you're going to have to fill out a form, maybe you won't download random stuff unless you actually need it.
- 1123581321 3y ago
  I understand understaffed although I think that's when siloes should be broken down so technically apt people across the company can reduce the workload (like by advising on a list of safe software that shouldn't be questioned.) I don't appreciate the deterrent culture because it's hard to get to point A to point B without some exploration if the company isn't used to trying to improve how work is done, or improve its thinking. The opportunity cost of preventing bright people from exploring is enormous. I understand, though, that compliance and uniformity are high priorities in some industries. (My experience with this kind of IT comes from aerospace and finance.)
  - vladvasiliu 3y ago
    Oh, I absolutely agree with this. But I think many companies have a hard time with this. The issue being that, of course, this exploration may end up badly. See all the supply chain issues which have made it to the HN front page. So some guardrails should absolutely be in place. I don't know how practical that would be, but I keep thinking we (IT people and adjacent) should possibly have two computers. An "untrusted" one, on which we'd be free to tinker, test new things, etc. No issue with nuking it if anything goes wrong. No access to "important" data or networks. And another, "trusted" one, from which you'd do your admin work, deploy to prod, etc.

jimmaswell 3y ago

Anyone with "software engineer", "developer", or "programmer" in their job title should be given full benefit of the doubt by default and only bothered if the program is proven malware. It's our job to know what we're doing, so we should have admin too. I feel like Ron Swanson in Home Depot every time I have to ask IT to do something.

burnte 3y ago
"Anyone with "software engineer", "developer", or "programmer" in their job title should be given full benefit of the doubt" No one gets the benefit of the doubt, and certainly not programmers. You get more leeway with what we'll allow, but not free reign. Most programmers aren't HN level.
- neerd 3y ago
  > Most programmers aren't HN level Oh boy, the self importance here is hilarious
  - the_only_law 3y ago
    It’s one of the defining cultural cornerstones here.
  - burnte 3y ago
    I'm not a programmer at all, my yearly code output these days can be expressed in double digit hours, and very small ones. I assure you, I do not think of myself as a programmer much less a top tier one.
- danaris 3y ago
  Ah, yes; because there's a programming skill test we all had to pass to be allowed to post here...
  - graypegg 3y ago
    Yeah, I get it, it’s easy to poke at that phrasing. There’s also a reading of that response where they mean “HN level” like “as confident as the replied-to comment author”. Could even be a bit sarcastic.