3 ms·

> It's our job to know what we're doing, so we should have admin too. Nope. Engineers and programmers are the most-likely source of "I know what I'm doing so

> It's our job to know what we're doing, so we should have admin too. Nope. Engineers and programmers are the most-likely source of "I know what I'm doing so I can run it this way" and you end up with things like NFS running on systems that haven't been bounced in over 300 days and can't be updated because someone used sudo to break yum. No one gets admin unless they explicitly need it. Period. Because while you may actually know what you're doing, most programmers haven't the slightest inkling about safe computing practices, based on experience.

irrational 3y ago
Well, I’m glad I don’t work for you. I work for a Fortune 100 company with nearly 100,000 employees and we all have admin/root access to our company provided hardware. I’ve worked here for decades and have never heard anything through the IT grapevine of issues arising from this.
- thefurdrake 3y ago
  I, too, work for a fortune 500. They're actually in the top 100. No idea how many employees, though. Every instance I've encountered with an engineer having root/admin permissions has been a shitshow. I just now encountered an instance of engineers bypassing policy by modifying sudoers to give a lower priv'd generic/shared account passwordless sudo to shit like /usr/bin/make. The other project I was on, I had to fight with engineers about why having a firewall on your appliance doesn't negate the need to address code execution exploits behind the firewall. These aren't security-savy individuals and they shouldn't ever be given administrative access to anything. I'm glad you don't work for me, too; I can't stand leadership positions. I work in security and all I see are engineers fucking up daily, so I'm pretty jaded/biased at this point.
  - irrational 3y ago
    I don’t even work for a tech company. Everyone from assistants to designers to managers have admin access on their work machines.

irrational 3y ago

Well, I’m glad I don’t work for you. I work for a Fortune 100 company with nearly 100,000 employees and we all have admin/root access to our company provided hardware. I’ve worked here for decades and have never heard anything through the IT grapevine of issues arising from this.

thefurdrake 3y ago
I, too, work for a fortune 500. They're actually in the top 100. No idea how many employees, though. Every instance I've encountered with an engineer having root/admin permissions has been a shitshow. I just now encountered an instance of engineers bypassing policy by modifying sudoers to give a lower priv'd generic/shared account passwordless sudo to shit like /usr/bin/make. The other project I was on, I had to fight with engineers about why having a firewall on your appliance doesn't negate the need to address code execution exploits behind the firewall. These aren't security-savy individuals and they shouldn't ever be given administrative access to anything. I'm glad you don't work for me, too; I can't stand leadership positions. I work in security and all I see are engineers fucking up daily, so I'm pretty jaded/biased at this point.
- irrational 3y ago
  I don’t even work for a tech company. Everyone from assistants to designers to managers have admin access on their work machines.