Hacker News Reader

Comment by gadders | Hacker News Reader

Working in a financial institution, I was surprised they could do all this. Our work laptops are so locked down (sometimes maybe too locked down) that we'd never be able to download a random .exe

I think Binance needs to start having IT Security like a bank as well.

View on HN

It does boggle my mind as well. I’ve only ever worked in high security industries as a developer, and I’ve never had admin access unless I was on hardware deployment. Limited user accounts, Firewall blocks, Active Directory audits, and full file system and network log audits are the name of the game where I have been. Anything external gets flagged quickly by automation and anything severe gets an immediate phone call. Falling for a pen tester phishing more than once, getting your laptop stolen, and so on can get you on the poor performer list. It just seems obvious for critical domains.

Usually it starts with a locked down laptop, then request after request, you get more rights, even admin on the laptop because otherwise you can't do anything as a software developer.

Most banks give you a crippled version of Admin rights via a 3rd party tool. If you need more than that, tough/you're doing it wrong.

Banks, at least in the U.S., are highly regulated and this would be very abnormal and subject to regulatory non-compliance, especially when the bank crosses into “big bank” territory. This stuff is regularly audited internally and externally.

You can dev without admin.

No, it depends on the role.

Our (state) agency uses separate computer accounts for regular use and admin use. The admin account has neither network nor email access in order to prevent using the admin account on a regular basis. With state government agencies continually attacked with ransomware, we aren't as bondage and discipline as banks (which I have done before) or DOE (which was very severely extremely locked down and I was not connected to classified stuffs).

I have not needed admin credentials for regular development purposes since VB6 (which I was using until 2013). VB6 and ActiveX dlls required read/write access to the registry all the time.

Even if you do need admin for a developer laptop, that has no bearing on the PAW you use to authorize deployments and otherwise interact with production systems. Assuming your employer is even a quarter competent (i.e., not Binance).

> I think Binance needs to start having IT Security like a bank as well.

I don't disagree but note that apparently a bank in France, Credit Mutuel (and it's Fortuneo online arm), just got robbed of hundreds of millions of EUR: hackers who have beforehand created accounts on Kraken (a cryptocurrencies exchange) and who then wired millions to different accounts, bought cryptocurrencies, and withdraw the crypto.

But the hack was really stealing hundreds of millions from the bank.

So not even banks are safe now.

Banks were never "safe" from fraud or theft, even before cryptocurrency existed. The key point was that customer accounts were segregated, and any customer losses were fully insured.

ah but that is boring, disruptive and too sysadminny. Its like the 90s. Cool companies have macbooks with full local admin. Devs need full access.

Cryptocurrency is like finding out why financial regulations exist speedrun

Reply on news.ycombinator.com