4 ms·
> The constraint that ruined everything: It has to work on enterprise networks. > You know what enterprise networks love? HTTP. HTTPS. Port 443. That’s it. Tha
by egorfine 10mo ago
> The constraint that ruined everything: It has to work on enterprise networks.
> You know what enterprise networks love? HTTP. HTTPS. Port 443. That’s it. That’s the list.
That's not enough.
Corporate networks also love to MITM their own workstations and reinterpret http traffic. So, no WebSockets and no Server-Side Events either, because their corporate firewall is a piece of software no one in the world wants and everyone in the world hates, including its own developers. Thus it only supports a subset of HTTP/1.1 and sometimes it likes to change the content while keeping Content-Length intact.
And you have to work around that, because IT dept of the corporation will never lift restrictions.
I wish I was kidding.
- rcarmo 10mo agoThey even break server-sent events (which is still my default for most interactive apps)
- deleted 10mo ago[deleted]
- j45 10mo agoThere are other ways to make server-sent events work. I try to remember many environments once likely supported Flash.
- ris 10mo agoCorporate IT needs to die.
- embedding-shape 10mo agoI think the general idea/flow of things is "numbers go up, until $bubble explodes, and we built up smaller things from the ground up, making numbers go up, bloating go up, until $bubble explodes..." and then repeat that forever. Seems to be the end result of capitalism. If you wanna kill corporate IT, you have to kill capitalism first.
- gspr 10mo agoI don't believe that. I don't necessarily love capitalism (though I can't say I see very many realistic better alternatives either), but if HN is full of people who could do corporate IT better (read: sanely), then the conclusion is just that corporate IT is run by morons. Maybe that's because the corporate owners like morons, but nothing about capitalism inherently makes it so.
- layer8 10mo agoApparently capitalism doesn’t pay enough for corporate IT admin jobs.
- deleted 10mo ago[deleted]
- dylan604 10mo ago> corporate IT is run by morons playing devil's advocate for a second, but corpIT is also working with morons as employees. most draconian rules used by corpIT have a basis in at least one real world example. whether that example happened directly by one of the morons they manage or passed along from corpIT lore, people have done some dumb ass things on corp networks.
- mananaysiempre 10mo agoYes, and the problem in that picture is the belief (whichever level of the management hierarchy it comes from) that you can introduce technical impediments against every instance of stupidity one by one until morons are no longer able to stupid. Morons will always find a way to stupid, and most organizations push the impediments well past the point of diminishing returns.
- KPGv2 10mo ago> the problem in that picture is the belief (whichever level of the management hierarchy it comes from) that you can introduce technical impediments against every instance of stupidity one by one until morons are no longer able to stupid I would say the problem in the picture is your belief that corporate IT is introducing technical impediments against every instance of stupidity. I bet there's loads of stupidity they don't introduce technical impediments against. It would just not meet the cost-benefit analysis to spend thousands of tech man-hours introducing a new impediment that didn't cost the company much if any money.
- j45 10mo agoIt's not corporate IT's fault, it's usually corporate leaderships fault who often cosplay leading technology and not understanding it. Wherever Tech is a first class citizen and seat at the corporate table, it can be different.
- michaelt 10mo agoBelieve me, the average Fortune 500 CEO does not know or care what “SSL MITM” is, or whether passwords should contain symbols and be changed monthly, or what the difference is between ‘VPN’ and ‘Zero Trust’. They delegate that stuff. To the corporate IT department.
- esseph 10mo agoBut they also say "Here, this is Sarah your auditor. Answer these questions and resolve the findings." - every year It's all CyberSecurity insurance compliance that in many cases deviates from security best practices.
- RankingMember 10mo agoThis is 100% it- the auditor is confirming the system is configured to a set of requirements, and those requirements are rarely in lockstep with actual best practices.
- cogman10 10mo agoThis is where the problems come from. Auditors are definitely what ultimately causes IT departments to make dumb decisions. For example, we got dinged on an audit because instead of using RSA4096, we used ed25519. I kid you not, their main complaint was there wasn't enough bits which meant it wasn't secure. Auditors are snake oil salesman.
- pmontra 10mo agoSometimes they have checkboxes to tick in some compliance document and they must run the software that let them tick those checkboxes, no exceptions, because those compliances allow the company to be on the market. Regulatory captures, etc.
- convolvatron 10mo agowhere else are you going to find customers that are so sticky it will take years for them to select another solution regardless of how crappy you are. that will staff teams to work around your failures. who, when faced with obvious evidence of the dysfunction of your product, will roundly blame themselves for not holding it properly. gaslight their own users. pay obscene amounts for support when all you provide is a voice mailbox that never gets emptied. will happily accept your estimate about the number of seats they need. when holding a retro about your failure will happily proclaim that there wasn't anything _they_ could have done, so case closed.
- egorfine 10mo agoOh yes you can absolutely profit off that but you have to be dead inside a little bit. And produce a piece of software no one in the world wants and everyone in the world hates. Yourself included.
- gruez 10mo ago>And you have to work around that, because IT dept of the corporation will never lift restrictions. Because otherwise people do dumb stuff like pasting proprietary designs or PII into deepseek
- kbelder 10mo agoOh, they'll do that anyway, once they find the workaround (Oh... you can paste a credit card if you put periods instead of dashes! Oh... I have to save the file and do it from my phone! Oh... I'll upload it as a .txt file and change the extension on the server!) It's purely illusory security, that doesn't protect anything but does levy a constant performance tax on nearly every task.
- unethical_ban 10mo agoWhat's the term for the ideology that "laws are silly because people sometimes break them"?
- pigeonhole123 10mo agoIt's called black and white thinking
- jeltz 10mo agoPosting stuff into Deepseek is banned. The corporate firewall is like putting a camera in your home because you may break the law. But, yeah, arguing against cameras in homes because people find dead angles where they can hide may not be the strongest argument.
- unethical_ban 10mo agoDisclaimer: I work in corporate cybersecurity. I know that some guardrails and restrictions in a corporate setting can backfire. I know that onerous processes to get approval for needed software access can drive people to break the rules or engage in shadow IT. As a member of a firewall team, I did it myself! We couldn't get access to Python packages or PHP for a local webserver we had available to us from a grandfather clause. My team hated our "approved" Sharepoint service request system. So a few of us built a small web app with Bottle (single file web server microframework, no dependencies) and Bootstrap CSS and SQLite backend. Everyone who interacted with our team loved it. Had we more support from corporate it might have been a lot easier. Good cybersecurity needs to work with IT to facilitate peoples' legitimate use cases, not stand in the way all the time just because it's easier that way. But saying "corporate IT controls are all useless" is just as foolish to me. It is reasonable and moral for a business to put controls and visibility on what data is moving between endpoints, and to block unsanctioned behavior.
- streptomycin 10mo agoBack when I had a job at a big old corporation, a significant part of my value to the company was that I knew how to bypass their shitty MITM thing that broke tons of stuff, including our own software that we wrote. So I could solve a lot of problems people had that otherwise seemed intractable because IT was not allowed to disable it, and they didn't even understand the myriad ways it was breaking things.
- michaelt 10mo ago> And you have to work around that, because IT dept of the corporation will never lift restrictions. Unless the corporation is 100% in-office, I’d wager they do in fact make exceptions - otherwise they wouldn’t have a working videoconferencing system. The challenge is getting corporate insiders to like your product enough to get it through the exception process (a total hassle) when the firewall’s restrictions mean you can’t deliver a decent demo.
- darthwalsh 10mo agoI think our corporate VPN doesn't send zoom video traffic through the VPN. As you enabled the VPN, you didn't see any dropped frames. Split tunnelling means the UDP packets just go through the normal internet.
- j45 10mo agoAt the same time, enterprise is where the revenue is.
- isoprophlex 10mo agoAgainst all odds, you're right, that's where somehow revenue is being generated. IT idiocy notwithstanding.
- j45 10mo agoOften, enterprises create moats and then profit from them. It's not usually IT idiocy, that usually comes from higher up cosplaying their inner tech visionaries.
- Aurornis 10mo ago> So, no WebSockets The corporate firewall debate came up when we considered websockets at a previous company. Everyone has parroted the same information for so long that it was just assumed that websockets and corporate firewalls were going to cause us huge problems. We went with websockets anyway and it was fine. Almost no traffic to the no-websockets fallback path, and the traffic that did arrive appeared to be from users with intermittent internet connections (cellular providers, foreign countries with poor internet). I'm 100% sure there are still corporate firewalls out there blocking or breaking websocket connections, but it's not nearly the same problem in 2025 as it was in 2015. If your product absolute must, no exceptions, work perfectly in every possible corporate environment then a fallback is necessary if you use websockets. I don't think it's a hard rule that websockets must be avoided due to corporate firewalls any more, though.
- kevlened 10mo agoI've had to switch from SSE to WebSockets to navigate a corporate network (the entire SSE would have to close before the user received any of the response). Then we ran into a network where WebSockets were blocked, so we switched to streaming http. No trouble with streaming http using a standard content-type yet.
- isoprophlex 10mo agoRequest URL has a query parameter with more than 64 characters? Fuck you. Request lives for longer than 15 sec? Fuck you. Request POSTs some JSON? Maybe fuck you just a little bit, when we find certain strings in the payload. We won't tell you which though.
- thescriptkiddie 10mo ago> it likes to change the content while keeping Content-Length intact thanks, i had repressed that memory
- egorfine 10mo agoPlease suffer.