Hacker News Reader

Person who is productive while listening to death metal checking in.

I have two jobs currently - one is regular 40h/wk salaried day job, another is part-time, nights and weekends, hourly pay. I only need to work 15-18 hours a week at the part-time one to exceed my full-time pay, but the part-time one is:

  - Windows
  - internet routed through a hardware appliance that I'm sure logs every bit and packet
  - forced to run an invasive full-system virus/malware scan on start-up and at 5AM every morning (takes 4-4.5 hours) forcing me to leave the thing runnings for days or weeks at a time and preventing any early morning work
  - random things that were fine for years suddenly blocked, e.g. spotify/youtube
  - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary"
  - Once had trouble working during an active malware scan so did non-sensitive but time critical work on a personal machine and got an email the next day why I was clocked in when the computer was off

Compare to my full-time job

  - Not windows
  - VPN is off by default and IT makes a conscious effort to move things *off* of VPN instead of the opposite
  - No tracking of any sort
  - We literally play Steam games for work events sometimes so it has Steam installed

Now clearly there are some big culture differences between the two as well, but needless to say it's rare the side gig beats my full-time paycheck, precisely because it's such a horrible work environment.

I hate this full-system (anti-)malware crap as much as the next guy. But this:

> - I will occasionally get emails from IT asking why I have a random application installed, what it does, and why it's "operationally necessary"

The issue is that policies have to be fairly general and can't just count on all employees actually knowing what they're doing. And sometimes people actually do shady things, even if it's not intentional. And if IT is understanding, then I think it's OK.

The other day, there was a story on the HN front page [0] about some innocuous looking app that got bought and converted to some kind of shady proxy. If I was responsible for my company's staff machines, I sure as hell wouldn't want that kind of crap running on them.

What's to say that your random app won't be siphoning up ~\Documents\top_secret.doc?

[0] https://news.ycombinator.com/item?id=37052508

I actually agree with you, I just brought it up as part of the massive cultural differences between "you managed to download this thing on this very locked down system two years ago, fill out this form to tell us what it is" and "go download steam and here's a steam code for a game, we're playing at 3pm if you want to."

> policies have to be fairly general

They don't actually. This is why roles exist.

They won't have a "smeagull" role, and a "john" role, etc. If you're a dev in a dev shop, the "dev role" could cover a sizeable number of people.

In my company's case, they do have roles. The "accountant" role has like 60 people. They're all doing mostly the same thing, so it wouldn't make sense to have 60 accountant1..60 roles.

Roles are cross functional. You can have ApplicationUser, AllowedDebug, Network1User, PythonDeveloper, Database1Developer, etc. etc.

Yes but couldn’t they research the app? If IT understands software, they can ask less often.

They're likely understaffed. They're also going to want to know why you're using it. My colleagues have had a case of someone downloading some program which was doing something that was already provided. Turned out "ours" was missing some features, so they've changed that.

It can also work as a deterrent. If you know you're going to have to fill out a form, maybe you won't download random stuff unless you actually need it.

I understand understaffed although I think that's when siloes should be broken down so technically apt people across the company can reduce the workload (like by advising on a list of safe software that shouldn't be questioned.)

I don't appreciate the deterrent culture because it's hard to get to point A to point B without some exploration if the company isn't used to trying to improve how work is done, or improve its thinking. The opportunity cost of preventing bright people from exploring is enormous. I understand, though, that compliance and uniformity are high priorities in some industries. (My experience with this kind of IT comes from aerospace and finance.)

Oh, I absolutely agree with this. But I think many companies have a hard time with this.

The issue being that, of course, this exploration may end up badly. See all the supply chain issues which have made it to the HN front page. So some guardrails should absolutely be in place.

I don't know how practical that would be, but I keep thinking we (IT people and adjacent) should possibly have two computers. An "untrusted" one, on which we'd be free to tinker, test new things, etc. No issue with nuking it if anything goes wrong. No access to "important" data or networks. And another, "trusted" one, from which you'd do your admin work, deploy to prod, etc.

I would love to see the two computer approach be more widespread. I think "one computer per desk" is a major mental hangup. Computers cost a fraction of what they used to compared to salaries and we still insist on a 1:1 ratio.

Anyone with "software engineer", "developer", or "programmer" in their job title should be given full benefit of the doubt by default and only bothered if the program is proven malware. It's our job to know what we're doing, so we should have admin too. I feel like Ron Swanson in Home Depot every time I have to ask IT to do something.

"Anyone with "software engineer", "developer", or "programmer" in their job title should be given full benefit of the doubt"

No one gets the benefit of the doubt, and certainly not programmers. You get more leeway with what we'll allow, but not free reign. Most programmers aren't HN level.

> Most programmers aren't HN level

Oh boy, the self importance here is hilarious

It’s one of the defining cultural cornerstones here.

I'm not a programmer at all, my yearly code output these days can be expressed in double digit hours, and very small ones. I assure you, I do not think of myself as a programmer much less a top tier one.

Ah, yes; because there's a programming skill test we all had to pass to be allowed to post here...

Yeah, I get it, it’s easy to poke at that phrasing.

There’s also a reading of that response where they mean “HN level” like “as confident as the replied-to comment author”. Could even be a bit sarcastic.

I wasn't being sarcastic, but with me it was a good guess. :D

No, but there is a curiosity test, you have to find the place; and then once you're here you have to understand things in order to find value and come back.

If a non-technical user notices something odd (fan running fast, slow boot, lots of network traffic) they’ll go straight to IT.

Someone with the attitude of “it’s my job [to not mess up]” will mess up subtly, try to fix the problem, and not mention it to IT.

As annoying as IT can be, one of those options is a lot better for operational security.

Will normal users really do that? I feel like a normal user's computer could be on fire and as long as it booted they'd continue on as usual.

As someone who’s been responsible for dealing with the consequences of “programmer” output, I’d say that they definitely should not be given the benefit of the doubt. While it may be hard to believe, the average “programmer” knows nothing about IT or networking or hardware, and you’d be lucky if they know where the power button is.

Generally “programmer” type folks are only power users in the context of software, possibly even only the software they wrote or tooling they chose.

> It's our job to know what we're doing, so we should have admin too.

Nope.

Engineers and programmers are the most-likely source of "I know what I'm doing so I can run it this way" and you end up with things like NFS running on systems that haven't been bounced in over 300 days and can't be updated because someone used sudo to break yum.

No one gets admin unless they explicitly need it. Period. Because while you may actually know what you're doing, most programmers haven't the slightest inkling about safe computing practices, based on experience.

Well, I’m glad I don’t work for you. I work for a Fortune 100 company with nearly 100,000 employees and we all have admin/root access to our company provided hardware. I’ve worked here for decades and have never heard anything through the IT grapevine of issues arising from this.

I, too, work for a fortune 500. They're actually in the top 100. No idea how many employees, though.

Every instance I've encountered with an engineer having root/admin permissions has been a shitshow.

I just now encountered an instance of engineers bypassing policy by modifying sudoers to give a lower priv'd generic/shared account passwordless sudo to shit like /usr/bin/make.

The other project I was on, I had to fight with engineers about why having a firewall on your appliance doesn't negate the need to address code execution exploits behind the firewall. These aren't security-savy individuals and they shouldn't ever be given administrative access to anything.

I'm glad you don't work for me, too; I can't stand leadership positions. I work in security and all I see are engineers fucking up daily, so I'm pretty jaded/biased at this point.

I don’t even work for a tech company. Everyone from assistants to designers to managers have admin access on their work machines.

> forced to run an invasive full-system virus/malware scan on start-up and at 5AM every morning (takes 4-4.5 hours) forcing me to leave the thing runnings for days or weeks at a time and preventing any early morning work

Maybe its just me, but hasn't Microsoft antrivirus thingy gotten really _really_ heavy recently?

Back in the days you would barely notice it, but nowadays it will take over 1-2 cores and make sure the damn fan is always spinning.

What's not clear to me is why MS implemented the "protected folders" feature so half-assedly as to be useless?

To me, the important thing to protect on a computer are the user's files. Instead of regularly scanning everything and comparing to known bad signatures and grinding the machine to a halt, why not limit what the apps can do?

If it's hard to prevent users from downloading totally_not_shady_app.exe, just make sure that it can't access anything anyway. That may still allow it to mine bitcoin, but at least it won't leak sensitive data. Or better yet: most users aren't devs. Just don't execute anything from the users' home folder. This probably won't help with all the attacks on Office by macros and whatnot, but it'd be a start.

This already exists and is called Windows S mode.

I wish it was more popular, but as soon as it was announced blogs like verge and Engadget started a crusade against it and more or less killed it off

Wasn't that much more limited than what I was arguing for? IIRC, it could only run apps from the MS Store, but it could run any app from the store.

IMO, the combination of anti-virus and updater got really heavy. But when the updater isn't running, I never noticed the anti-virus.

Its inter silo-warfare, the microsoft antivirus regularly detects and reports the operating system spyware?

That's interesting.

I know not everyone is in position to pick and choose between jobs, but frequently you can improve your "it situation" a lot if you raise it during recruitment.

I recently started working for a (large) company that gave me a Linux laptop(I wfh 100%), 99% of their staff uses windows. It uses cisco vpn and a simple script to block all traffic if the vpn is off (once vpn is on, local traffic is allowed). The machine runs a rhel based distro, all public repos are disabled and "the it" maintains only approved packages. Interestingly, I can use sudo, but I have to write justification for every use. There is full disk encryption, but I'm no aware of any "activity monitoring" other than outgoing internet traffic.

Prior to this, the company I worked for gave me a windows laptop. I had Admin rights on it too.

During my recent search for new work I spoke with a company that seemed a great fit. Until they told me they log hours worked by tracking keyboard/mouse/recording screen use. "for client accounting reasons". To my objection that if a client agrees certain job is worth 4h to them, who cares if I do it in 1h they said they have to use this model. I declined to work with them and I got a different offer. I'd hate to have a job where I'm incentivised to work slower not faster.

>Even though we have access to deep digital forensics on our employee's virtual desktops

Yeah you say that and I believe you just like I believed Sergey, Larry and don't be evil.

Don't collect it at all. Collecting anything private is like having to handle toxic waste. Just don't. You can't control it, you can't guarantee security and you don't know what could happen if you're bought out etc etc. You just can't possibly trust all possible future managers about which you know nothing.

Just say no.

>Whatever you do on the virtual/cloud work desktop is considered entirely property of our company. Your incidental Spotify, Youtube and 4chan visits are included in this scope.

"Not only are you fired, the 400gb of futa hentai you downloaded is our property"

Ok, for these employees, do you also consume audio and video? My biggest concern is that WFH bringing company hardware home is inviting employers the opportunity to monitor employee home-life, recording private conversations, for example. It might be one thing to have that sort of monitoring go on at the work place, but WFH own their office, and pay for it too.

Incidentally, I feel the same way about kids bringing laptops home from school.

> Ok, for these employees, do you also consume audio and video?

Clearly GP's firm doesn't run a webcam and microphone capture on the thin client. They could potentially monitor audio/video I/O from the cloud workstation that the thin client logs into.

If you're concerned about this isn't the simple answer just to shut down at the end of the day?

While I'm sure there are exceptions, thinking about the IT departments I've worked with in the past and how cost-conscious they were, the last thing any of them would want to do is waste the time and money to record non-work related employee conversations at their home.

Well, what's to say that the PC is actually off? Many "enterprise" laptops nowadays can't have their battery pulled out easily.

My HP laptop needs to have the back panel removed. If I do that, it'll trip the intrusion sensor and wipe the TPM. IT can know about this and ask you why you're taking apart the laptop. If it's windows, and you don't have the BitLocker key, you won't even be able to turn it back on.

Put it in a drawer. This isn’t rocket science.

Then close it and wrap it in a couple layers of towels or something, stick it in your refrigerator under the leftover pizza, and/or block its access to wifi through your home router config. Physical controls trump whatever secret monitoring you fear it's doing.

Spoken like a true over-engineer.

>Put it in a drawer. This isn’t rocket science. Yup

Who says family life only starts "at the end of the day"?

And who says that it would be the IT department that would want this capability, instead of, say the employee's manager?

I've taped the webcam on my work laptop. If my employer wants me to use a webcam as part of my job, I'll ask them to buy me one with a physical shutter. Thankfully no one gives half a shit about webcams at our workplace.

I bought a little physical shutter that sticks onto mine.

I think I've seen people report their MacBook displays getting shattered because of those shutters so I've opted for tape instead.

Where do you place the tape to cover the mic? No? Why are you only partially paranoid?

A couple of reasons. First of all, I kinda need the microphone for work whereas I don't need a webcam. I also live alone, so it's not like I am having that many private conversations at home. However, I do for example spend time naked at home, and I'd prefer that to not be visible to any cameras.

There is thankfully a physical cutoff switch for the microphone whenever the laptop lid is closed in case I need to have a private conversation and ensure that there's no employee-provided microphones nearby.

The interface for the virtual desktop in many circumstances is by way of a simple browser tab.

Due to browser security standards, every time you access your work desktop via web, a warning pops up asking if you want to provide camera/audio/location services.

You can decline to consent and there won't be any problems, other than Teams won't be able to use your webcam/audio for a meeting.

The simplest way to treat any employer device at home (and work) is that they should be assumed to be hostile. It could be default settings, best practices of Microsoft for adoption, etc.

How to treat a hostile device in your home network is the same as home automation - isolate it.

- Separate vlaned network that can’t see anything on your home network. Separate SSID.

Don’t like the microphone? Find an adapter that mutes it.

- Create a separate vlan and SSID that can’t see anything on your network. The ideal way to do this is configure a travel router behind your regular router. Then extra nat hop is worth it.

- Bonus points for a vpn at home that your travel router can connect to, making your work setup a little more mobile.

> inviting employers the opportunity to monitor employee home-life, recording private conversations, for example.

Employers have bigger things to worry about than some minor employee’s bickering with their family. I think you can safely worry about bigger things.

No, no, it doesn't happen ever at all.

https://www.businessinsider.com/work-from-home-sneek-webcam-...

https://remotedesk.com/solutions/webcam-monitoring

https://www.cbsnews.com/news/remote-workers-monitoring-spywa...

I think it is dumb for employers to do this.

However, these examples don’t seem to have anything to do with spying on your private life, i.e. outside typical work hours.

As someone who is growing a business and who looks to make the jump from "here is a laptop, GSD*" to "here is a laptop with security, GSD", how does one go about setting up this sort of system of cloud desktop?

* GSD: get shit done (because I literally can't be arsed if you watch Netflix, play TOTK, or whatever so long as clients are happy and you are satisfied with your work)

> how does one go about setting up this sort of system of cloud desktop?

Check out Windows 365 Enterprise. We have it configured for multiple regions in order to minimize latency. One AD security group per US state. Then, we set up an intune provisioning profile per region to map them through.

You can push custom images or take the default 10/11 builds. It seems to be working out really well for us. I run a heavy VS2022 workload all day and have no issues (4vCPU, 16gb, 128gb). Build times are definitely slower than my 32 core battleship, but that's to be expected.

I just checked my RTT stats in MS endpoint management and I am seeing ~18ms between my desktop and the actual desktop. The worst case we have right now is S Florida to N Virginia (US East) @ ~60ms, but they are adding a new region soon so hopefully we will have every employee well under 50ms over time.

> If you feel like you have to use the digital panopticon to micromanage your tech/knowledge employees, you are potentially a really shitty manager.

The higher up the management chain you go, the lower your visibility into developer productivity. It is natural that executives and owners should want that visibility, it's just that it's too fuzzy -- it can't be had with the kind of resolution that they want. Hence we have all these faddish metrics that get gamed and never end up being useful.

We should have empathy for management's need to know even if we don't think they can really get a clear picture.

What to do? Two things:

- Manage better. Companies need managers who can get a good sense for their direct reports' abilities, skills, and productivity. And those managers need to have good BS detectors too. And managers need these skills up and down the management chain.

- Look for outcomes. Teams and employees that never deliver enough value should be looked at with some care -- maybe they are, but the value they deliver is not very visible, or maybe they're expert bullshitters.

Regarding outcomes, long delivery delays need to be investigated because one of the many problems we have as an industry is in estimating time and effort needed to deliver. This happens for reasons, but mainly that software development is harder than we tend to think.

(Also, investigate your software development lifecycles. Maybe your change management schemes are wasteful and delay-inducing.)

I say software development is hard, but I think management is probably much harder. The business school metrics fads that lead managers astray don't help.

Do you enforce any security for the PC used to connect to the virtual desktop? Thinking of possible keylogging, possible mitm when connecting to the virtual desktop, a RAT on the PC used.

No. We aren't this paranoid. Keylogging could be as far up the stack as the employee's brain.

We are still in the dark ages of no root, all kinds of agents and spyware, multiple layers of TLS intercepting proxies, etc.

I still surf HN and listen to questionable and obscure genres of metal while I code. If they ever complain I'll explain that is what I need to get my work done.

I assume programming related websites are ok which I include HN in that category.

Not enrolling work devices into IT policies actually goes against your encouragement to separate your work/cloud client and a 2nd computer/non-work things.

Having rigid boundaries encourages this separation, and I don't mean overly strict IT policies. I think you can easily allow people to listen to their music apps and watch netflix, without opening the floodgates for games that require kernel level anticheat.

IT policies should be as simple as possible, even an app whitelist coupled with preconfigured browser is plenty. You wouldn't even need to monitor them at all this way.

So how do you manage the risk of a user connecting to a remote desktop with an un-updated machine full of malware? In the end if the client machine is breached the remote virtual one will also fall?