Hacker News Reader

I've only had 1 employer (a DB company) so I can't speak to industry norms, but I've never had restrictions on things I could do or download on my computer. Hard for me to imagine working at a place where I need permission to download a tool or library when writing software. Seems like a huge burden.

Libraries have licensing requirements that your company needs to comply with. Being able to download and use them without any oversight is an recipe for violating them.

or... read the license and make sure you can comply with it. And if you don't know, or are unsure, ask for help.

it's absurd to me that you'd need to put every library through compliance even if it has very straight forward OSS licenses.

In my experience, it’s impossible to assemble a group of 1000 programmers who are consistently able to read a license and reason correctly about whether the firm can follow it.

Do you really think everyone hired as a coder has enough intellectual property knowledge to understand all the complexities of all the various open source licenses in every potential usage?

Nope. That's why I said if you're unsure or don't know, ask.

My last large employer handled licensing and defects via periodic scans and background removals/uninstall.

There was specific software everyone could install with a service request, non-standard software could also be requested, temporary rights to usual stuff could be requested as could permanent access to those rights.

Why not make the uninstalls/removal upfront? Why do it in the background?

I'm guessing because it's faster and there's less liability/risk.

It was just annoying for me, but I could see it being a significant impediment for some people in some situations.

Agree 100%, if I were not able to download the applications and tools that make me productive, I would be looking for a new job at a less employee hostile work place.

I've worked at places like this (where you don't have admin access). Generally they don't mind you installing stuff that's legit or makes you more productive.

They just don't want you granting admin permissions to an email that you inadvertently clicked a strange links on, or some virus laden craking tools, you shouldn't be running.

It's understandable, but super annoying. Yeah, it'll probably question my long term view of the company.

> It's understandable, but super annoying

Security and convenience are opposing forces. Security and reliability not so much.

My plea to all of us is get used to it. People's piece of mind (at the least) depends on us doing our job, and as this story is an example of us failing.

The age of programmers winging it should be long gone. We are professionals with responsibilities. Our jobs are not for our pleasure or satisfaction (even when they are fun and satisfying)

I know the tools I need. Enterprise IT doesn't.

That is not true.

Mēh. Perhaps. But then Enterprise IT is not doing its job.

You should not bring your own tools to do this sort of job. We need to be professionals, not enthusiastic amateurs.

We work with "Enterprise IT" not against them.

The problem is Enterprise IT works against us. Always has and always will. It's a losing game for them but they keep playing.

No wonder our industry is in such a bad way

The problem is you install some random tool because you need it for a task, forget about it a few months later and then fail to keep it up to date and suddenly it exposes your device to vulnerabilities.

It’s not hostile for an employer to want to protect themselves from employee mistakes and there are ways to do this without invading an employees privacy.

> forget about it a few months later and then fail to keep it up to date and suddenly it exposes your device to vulnerabilities.

Or you do keep it up to date and suddenly it exposes your device to new vulnerabilities.

Would you feel the same if you were developing something intrinsically attractive to state-backed hackers like nuclear power plant control software? At some point you have to take into account hackers with the means to bribe/blackmail the developers of the "applications and tools that make you productive".

While it is a burden, the point is that software needs to be audited before it is installed and that is an even bigger burden on the company. If it isn't essential to the business, it simply isn't going to be considered, At least that is the way in many of the non-IT companies I have worked for which handle massive amounts of data on other people. In this regard, Twitter's attitude is distressing. We may think of them as an IT company, but their actual business involves handling massive amounts of data on other people. While confidentiality of that information may not be the biggest concern, since much of it is intended to be published, the authenticity of that information is.

Software generally doesn’t need to be audited by a grad in a corporate IT department who knows next to nothing about software. We have official repos for that, why Jack-of-all-trades IT oafs think they can do a better job than distros who literally package software for a living is beyond me.

It depends on the industry. However, in a good world you would have an internal repo with all the software users need to do their job and users would just download from that.

Never mind security. Maintaining a coherent approach to development strategies where anybody can "download ...[any] tool or library [they want] when writing software" is a terrifying idea. DO they let you use any computing language you want? Any OS?

Our industry is on a very bad way

All of the jobs I've worked have not had any technical restrictions on what software engineers could install on their work laptops.

Most (but not all) had some sort of asset management tool and/or antivirus as standard on computers, but nearly all provided exceptions to having that functional/installed.

I, and I expect many developers, likely select companies with IT policies that avoid potentially harming individual productivity.

If you work in financial services (banks, brokerages, hedge funds, exchanges), heath insurance, or the defense industry… your device will be locked down.

I worked at a highly regulated financial company and they gave me root in prod and permission to install anything I wanted (on any machine I wanted). However, it was clear that EVERYTHING was being tracked, including SSL MITM attacks and the most invasive OS-level logging you can imagine, for compliance reasons.

Abuse of that trust was a fireable offense and someone did get fired for it.

I did an internship at a bank. They locked down developers laptops to the point of being unusable.

Except all the developers just got permission to install virtual box, and ran another OS inside virtual box that they could and did do whatever they wanted to.

This didn't improve security past not locking down devices, it substantially hurt it, but it was also the only way anything got done.

Sadly this is often due to regulations and industry expectations.

I work in finance and we get all these audits and questionnaires from regulators, insurers, intermediaries, clients, etc. and many of them are straight out of the 90s.

For example, when we replaced the VPN with a zero trust system, we got a ton of pushback. It didn't matter that the ZT implementation provided stronger guarantees than the VPN ever did as well as doing everything the VPN did. What mattered is that it wasn't called a VPN and they were expecting me to write "Cisco VPN" or similar.

Unfortunately, developers having admin access on their machines triggers so many red flags in these processes. Doesn't matter if you install a load of auditing and remote attestation stuff, admin access is instant ticket to bureaucratic hell.

I worked in health insurance for a stint and wasn't completely locked down. I was able to install brew and some libraries, BUT received a call from security to review what/why I was doing it and ultimately there were no problems.

> The idea that Twitter would allow anything to be installed is kind of shocking to be honest.

For what it’s worth, AWS has the same somewhat lax policies about installing software on company laptops.

That’s not a diss to AWS security mind you, I’m sure it’s top of the line.

Meta security also allows any software to be installed. But they also keep a track of laptop state through the osquery daemon that's always running.

GP was talking like this alone was gross negligence, implying that this is different from the rest of the industry. That doesn't seem to be the case.

We do this as a 60 person company.

MSFT also allows arbitrary installation of software and development systems. They do force updates, scanning, and other common security best practices.

On the machines people use for Livesite support ("Secure Access Workstations") it's a different story. Those bad-boys are locked down from the supply chain through day-to-day use.

>That’s not a diss to AWS security mind you, I’m sure it’s top of the line.

Top of the line security looks like door locks with daily changing codes and number pads with lcds on them that scramble the order of the digits. It looks like regular searches of your effects as you leave the building, badged and guarded entrances that operate like airlocks, security that roams the building and leaves your manager a nasty note if the wrong documents are left in the open on your desk along with a computer and network that actually won’t let you install software. This was my first job and it felt normal.

Defense industry?

Indeed

There is a place for that level of security, but twitter is not it.

Good risk management means knowing when to accept a risk. Twitter was too lax, but the opposite millitary approach would also be the wrong choice for something like twitter.

Oh, absolutely, know your threat model.

But top of the line security anywhere is not "meh, install whatever you want on the company laptop". And any company handing private communication and responsible for making social network decisions does need fairly good security to protect against compromised employees and compromised company hardware. That looks like solid policies for installing software, centralized management of hardware, and written policies that are well thought out, audited, and followed.

Finance, medicine, defense, ecommerce, etc. all have industry or government regulations for these kinds of security polices and compliance, it seems like social media companies are the wild west and clear signs of problems and abuse have come up repeatedly.

No, they probably don't need to go through your bags with random checks to see if you're exfiltrating classified materials or warn you about wearing your company badge visibly when you go out to lunch to avoid spies.

> That’s not a diss to AWS security mind you, I’m sure it’s top of the line.

You are sure. Whew!

Terrified am I

I worked with 100s of companies from small to giant conglomerates over my time in advertising and 90% have what HN would consider bad security.

Security engineers have a tendency to see a hole and tell you to fill it, independent of the threat model that is required to exploit it. Security is a business decision.

That being said, Twitter's stance on insider risk was a little too lax for my taste: my colleagues at a big tech were often asked by governments for their work passwords at country borders if the border patrols noticed they worked for the company, and had no choice but to comply. Preventing insider access to systems mitigates this risk to your employees.

90%? That seems awfully optimistic.

The 2 different FAANG level tech companies I’ve worked at both allowed me (as a developer) to install what I want on my laptop (despite being MDM controlled). I don’t think that fact alone is an indictment of Twitter’s security.

It is And an indictment of FAANG's.

Why do we think that FAANGs set the standard?

> Why do we think that FAANGs set the standard?

Who else would set the standard of security at large internet services? Judgement by a jury of their peers seems fair.

Most big tech companies allow you to install anything on your laptop as long as you use common sense.

And if they're smart, the systems are setup to reduce the "blast radius" from an infected/compromised machine.

Locking down the system and then assuming everything is fine is a recipe for disaster.

> My current and previous companies will not let me install what I want on my laptop.

I've worked for companies all along that spectrum.

I've found that the locked-down companies tend to be heavily bureaucratic in other ways as well, and in general make my life as a developer less satisfying. I gravitate towards the more liberal companies.

>The fact that Mudge couldn't lock things down after Jan 6 or that there wasn't adequate logging etc is also extremely shocking.

Remember when Twitter got real big because of the Arab Spring? Free Speech is good? How is “Twitter” supposed to know what to “lock down” and what to allow for good?

Ban the things your datacenter's country of operation says are illegal, and ignore the rest

This is referring to locking down employee access to modify data in production