Comment by pc86 | Hacker News Reader

Comment by pc86 | Hacker News Reader

Parent Full thread

Person who is productive while listening to death metal checking in.

I have two jobs currently - one is regular 40h/wk salaried day job, another is part-time, nights and weekends, hourly pay. I only need to work 15-18 hours a week at the part-time one to exceed my full-time pay, but the part-time one is:

  - Windows
  - internet routed through a hardware appliance that I'm sure logs every bit and packet
  - forced to run an invasive full-system virus/malware scan on start-up and at 5AM every morning (takes 4-4.5 hours) forcing me to leave the thing runnings for days or weeks at a time and preventing any early morning work
  - random things that were fine for years suddenly blocked, e.g. spotify/youtube
  - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary"
  - Once had trouble working during an active malware scan so did non-sensitive but time critical work on a personal machine and got an email the next day why I was clocked in when the computer was off

Compare to my full-time job

  - Not windows
  - VPN is off by default and IT makes a conscious effort to move things *off* of VPN instead of the opposite
  - No tracking of any sort
  - We literally play Steam games for work events sometimes so it has Steam installed

Now clearly there are some big culture differences between the two as well, but needless to say it's rare the side gig beats my full-time paycheck, precisely because it's such a horrible work environment.

I hate this full-system (anti-)malware crap as much as the next guy. But this:

> - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary"

The issue is that policies have to be fairly general and can't just count on all employees actually knowing what they're doing. And sometimes people actually do shady things, even if it's not intentional. And if IT is understanding, then I think it's OK.

The other day, there was a story on the HN front page [0] about some innocuous looking app that got bought and converted to some kind of shady proxy. If I was responsible for my company's staff machines, I sure as hell wouldn't want that kind of crap running on them.

What's to say that your random app won't be siphoning up ~\Documents\top_secret.doc?

[0] https://news.ycombinator.com/item?id=37052508

Anyone with "software engineer", "developer", or "programmer" in their job title should be given full benefit of the doubt by default and only bothered if the program is proven malware. It's our job to know what we're doing, so we should have admin too. I feel like Ron Swanson in Home Depot every time I have to ask IT to do something.

As someone who’s been responsible for dealing with the consequences of “programmer” output, I’d say that they definitely should not be given the benefit of the doubt. While it may be hard to believe, the average “programmer” knows nothing about IT or networking or hardware, and you’d be lucky if they know where the power button is.

Generally “programmer” type folks are only power users in the context of software, possibly even only the software they wrote or tooling they chose.

> It's our job to know what we're doing, so we should have admin too.

Nope.

Engineers and programmers are the most-likely source of "I know what I'm doing so I can run it this way" and you end up with things like NFS running on systems that haven't been bounced in over 300 days and can't be updated because someone used sudo to break yum.

No one gets admin unless they explicitly need it. Period. Because while you may actually know what you're doing, most programmers haven't the slightest inkling about safe computing practices, based on experience.

Well, I’m glad I don’t work for you. I work for a Fortune 100 company with nearly 100,000 employees and we all have admin/root access to our company provided hardware. I’ve worked here for decades and have never heard anything through the IT grapevine of issues arising from this.

I, too, work for a fortune 500. They're actually in the top 100. No idea how many employees, though.

Every instance I've encountered with an engineer having root/admin permissions has been a shitshow.

I just now encountered an instance of engineers bypassing policy by modifying sudoers to give a lower priv'd generic/shared account passwordless sudo to shit like /usr/bin/make.

The other project I was on, I had to fight with engineers about why having a firewall on your appliance doesn't negate the need to address code execution exploits behind the firewall. These aren't security-savy individuals and they shouldn't ever be given administrative access to anything.

I'm glad you don't work for me, too; I can't stand leadership positions. I work in security and all I see are engineers fucking up daily, so I'm pretty jaded/biased at this point.

I don’t even work for a tech company. Everyone from assistants to designers to managers have admin access on their work machines.

"Anyone with "software engineer", "developer", or "programmer" in their job title should be given full benefit of the doubt"

No one gets the benefit of the doubt, and certainly not programmers. You get more leeway with what we'll allow, but not free reign. Most programmers aren't HN level.

> Most programmers aren't HN level

Oh boy, the self importance here is hilarious

It’s one of the defining cultural cornerstones here.

I'm not a programmer at all, my yearly code output these days can be expressed in double digit hours, and very small ones. I assure you, I do not think of myself as a programmer much less a top tier one.

Ah, yes; because there's a programming skill test we all had to pass to be allowed to post here...

Yeah, I get it, it’s easy to poke at that phrasing.

There’s also a reading of that response where they mean “HN level” like “as confident as the replied-to comment author”. Could even be a bit sarcastic.

I wasn't being sarcastic, but with me it was a good guess. :D

No, but there is a curiosity test, you have to find the place; and then once you're here you have to understand things in order to find value and come back.

If a non-technical user notices something odd (fan running fast, slow boot, lots of network traffic) they’ll go straight to IT.

Someone with the attitude of “it’s my job [to not mess up]” will mess up subtly, try to fix the problem, and not mention it to IT.

As annoying as IT can be, one of those options is a lot better for operational security.

Will normal users really do that? I feel like a normal user's computer could be on fire and as long as it booted they'd continue on as usual.

I actually agree with you, I just brought it up as part of the massive cultural differences between "you managed to download this thing on this very locked down system two years ago, fill out this form to tell us what it is" and "go download steam and here's a steam code for a game, we're playing at 3pm if you want to."

Yes but couldn’t they research the app? If IT understands software, they can ask less often.

They're likely understaffed. They're also going to want to know why you're using it. My colleagues have had a case of someone downloading some program which was doing something that was already provided. Turned out "ours" was missing some features, so they've changed that.

It can also work as a deterrent. If you know you're going to have to fill out a form, maybe you won't download random stuff unless you actually need it.

I understand understaffed although I think that's when siloes should be broken down so technically apt people across the company can reduce the workload (like by advising on a list of safe software that shouldn't be questioned.)

I don't appreciate the deterrent culture because it's hard to get to point A to point B without some exploration if the company isn't used to trying to improve how work is done, or improve its thinking. The opportunity cost of preventing bright people from exploring is enormous. I understand, though, that compliance and uniformity are high priorities in some industries. (My experience with this kind of IT comes from aerospace and finance.)

Oh, I absolutely agree with this. But I think many companies have a hard time with this.

The issue being that, of course, this exploration may end up badly. See all the supply chain issues which have made it to the HN front page. So some guardrails should absolutely be in place.

I don't know how practical that would be, but I keep thinking we (IT people and adjacent) should possibly have two computers. An "untrusted" one, on which we'd be free to tinker, test new things, etc. No issue with nuking it if anything goes wrong. No access to "important" data or networks. And another, "trusted" one, from which you'd do your admin work, deploy to prod, etc.

I would love to see the two computer approach be more widespread. I think "one computer per desk" is a major mental hangup. Computers cost a fraction of what they used to compared to salaries and we still insist on a 1:1 ratio.

> policies have to be fairly general

They don't actually. This is why roles exist.

They won't have a "smeagull" role, and a "john" role, etc. If you're a dev in a dev shop, the "dev role" could cover a sizeable number of people.

In my company's case, they do have roles. The "accountant" role has like 60 people. They're all doing mostly the same thing, so it wouldn't make sense to have 60 accountant1..60 roles.

Roles are cross functional. You can have ApplicationUser, AllowedDebug, Network1User, PythonDeveloper, Database1Developer, etc. etc.

> forced to run an invasive full-system virus/malware scan on start-up and at 5AM every morning (takes 4-4.5 hours) forcing me to leave the thing runnings for days or weeks at a time and preventing any early morning work

Maybe its just me, but hasn't Microsoft antrivirus thingy gotten really _really_ heavy recently?

Back in the days you would barely notice it, but nowadays it will take over 1-2 cores and make sure the damn fan is always spinning.

What's not clear to me is why MS implemented the "protected folders" feature so half-assedly as to be useless?

To me, the important thing to protect on a computer are the user's files. Instead of regularly scanning everything and comparing to known bad signatures and grinding the machine to a halt, why not limit what the apps can do?

If it's hard to prevent users from downloading totally_not_shady_app.exe, just make sure that it can't access anything anyway. That may still allow it to mine bitcoin, but at least it won't leak sensitive data. Or better yet: most users aren't devs. Just don't execute anything from the users' home folder. This probably won't help with all the attacks on Office by macros and whatnot, but it'd be a start.

This already exists and is called Windows S mode.

I wish it was more popular, but as soon as it was announced blogs like verge and Engadget started a crusade against it and more or less killed it off

Wasn't that much more limited than what I was arguing for? IIRC, it could only run apps from the MS Store, but it could run any app from the store.

Its inter silo-warfare, the microsoft antivirus regularly detects and reports the operating system spyware?

IMO, the combination of anti-virus and updater got really heavy. But when the updater isn't running, I never noticed the anti-virus.

That's interesting.

I know not everyone is in position to pick and choose between jobs, but frequently you can improve your "it situation" a lot if you raise it during recruitment.

I recently started working for a (large) company that gave me a Linux laptop(I wfh 100%), 99% of their staff uses windows. It uses cisco vpn and a simple script to block all traffic if the vpn is off (once vpn is on, local traffic is allowed). The machine runs a rhel based distro, all public repos are disabled and "the it" maintains only approved packages. Interestingly, I can use sudo, but I have to write justification for every use. There is full disk encryption, but I'm no aware of any "activity monitoring" other than outgoing internet traffic.

Prior to this, the company I worked for gave me a windows laptop. I had Admin rights on it too.

During my recent search for new work I spoke with a company that seemed a great fit. Until they told me they log hours worked by tracking keyboard/mouse/recording screen use. "for client accounting reasons". To my objection that if a client agrees certain job is worth 4h to them, who cares if I do it in 1h they said they have to use this model. I declined to work with them and I got a different offer. I'd hate to have a job where I'm incentivised to work slower not faster.

Reply on news.ycombinator.com