Hacker News Reader

Comment by fhd2 | Hacker News Reader

Sounds like you have slightly unusual needs - I install NPM packages and the like all the time (which I haven't seen any company attempt to oversee yet), but very few binaries. Sounds like you need binaries the way I need these packages, so it sounds odd that the company wouldn't come up with some solution - dedicated VM, special exceptions, whatever.

View on HN

My company has a policy that all software needs to be explicitly approved. That includes any software library, extension, or package from a package manager. Is it followed? Not in the slightest! Something I recently ran into: the Rust version manager 'rustup' is approved but neither the compiler nor the package manager have been approved. That's despite our core product having used Rust libraries through the C ABI for years. Madness!

so what exactly is the difference between binaries and scripts executing arbitrary system calls?

For the purpose of our discussion: None whatsoever. That's my point. Corporate IT mandates what they know/think about, quite often unfortunately without any understanding of the specific needs of employees (like parent).

I found it to be a better strategy to start from a prioritised list of risks and tackling the high priority items in an actually meaningful way. But I can see how that doesn't work at companies with >300 employees - at one point security just pushes for whatever they can get, disconnected from the true needs and relevant risks at the company.

Some of the NPM packages contain binaries.

Reply on news.ycombinator.com