2 ms·
This is why I hate when I go to a new gig and someone just assigns me a bunch of rights, "because it's easier". No, don't do that. Not only are you exposing you
by cratermoon 3y ago
This is why I hate when I go to a new gig and someone just assigns me a bunch of rights, "because it's easier". No, don't do that. Not only are you exposing your company to breaches, you're giving me responsibilities I don't want. I could make a mistake and screw something important up, or something could get hacked and people might think it was me, because I have privileges to do it.
- makeitdouble 3y agoTBF given the amount of rights needed to be managed for each employee for all their accounts accross the services, it feels like the natural progression of things. Basically, we're experiencing the Windows XP security popup equivalent but at a service level, where at every step of a task you're asked to identify to something else and the back and forth to get the proper credentials with the proper rights can take days. Support teams calling it fucks and throwing half the accounts and permission bucket at any newcomer is just humane.
- quickthrower2 3y agoIt is probably a good idea to seperate production and other environments. Most of devs work is done in non prod environments so you can throw a lot of dev/test permission at them. Support should be able to support through app permissions only. Devops/oncall will need automated escalation requests for emergencies. A single “XP popup” that gets audited. Elephant in the room is CI. I have no answer. I think CI needs a rethink. CI has a lot of power if hacked.
- cratermoon 3y agoYeah, RBAC and ACLs kind of suck at enterprise levels. Organizing roles and privileges hierarchically helps to somewhat manage the complexity, but hierarchies have their own issues.