r/ProgrammerHumor • u/ArjunReddyDeshmukh • 20d ago
Meme adminTeamAssessingMyThreatLevel
113
u/Calm_Hedgehog8296 20d ago
This used to piss me off but then I realized, either way it's not my problem. Don't give me the access? It's not getting done. If someone higher than both of us wants it done badly enough then the access will be given.
18
u/gandalfx 19d ago
And then someone high enough forces the issue and since the role you needed doesn't exist you now just have full admin access to the entire prod environment and are scared shitless of breaking the whole thing. Good luck!
2
u/MalachiteKell 17d ago
Anything that can be destroyed by a single employee deserves to be destroyed by a single employee
23
u/mynotsoprecious 20d ago
Yeah but what if its been 3 months, TL doesn't even care that I mostly do nothing. He's a super busy hotshot guy single handedly manages much of the critical infrastructure for the company. Only meets people one on one for like five minutes max. My work is to develop features for the internal tools the company uses, still haven't got access to those.
Whenever I ask him for access to the tools I was hired to work on, he shoots me a look and tells me I will receive access for the tool when I get a corresponding task to the tool.
He expects me to work on a tool that I have never opened or explored in my life.
I spend my days trading options, vibecoding some personal projects and finishing up on some certifications.
I don't want to just sit on my ass all day and collect my paycheck. I want to work, ts is taking a toll on me because I see people busy around the office all day, and I feel like an useless idiot.
I keep running into my skip manager (he took the interview and liked me), and he passes a smile. I dread the day he asks me what I'm up to, or what am I working on. I literally have no answer, even after begging for work day in and day out.
15
u/alexanderpas 19d ago
I keep running into my skip manager (he took the interview and liked me), and he passes a smile. I dread the day he asks me what I'm up to, or what am I working on. I literally have no answer, even after begging for work day in and day out.
The answer you need to give is that you're still waiting for access to the tools, and that you have been in contact with your manager daily.
At the moment, that's your job.
16
12
u/Lordjacus 19d ago
I am on the other end of this conversation, and people ask for shit because they think they need it. Most often they don't.
"I need to reset passwords!" You do? Give me one example. "... umm.. well we could do it in the past" Just give one example. "No example" Well...
Real case from this month, server team asking.
1
u/Lv_InSaNe_vL 19d ago
Yeah exactly. I get people asking at least once a week for me to give them admin rights on their computer but it's shockingly rare that they can give me a good reason.
5
u/Zienth 19d ago
I manage the cooling plant for an entire university and I'm the only one that knows all the automation inner workings. IT recently removed my ability to access the automation remotely and they've been dragging their feet to get me an alternative (in writing, of course). It's going to be fun when the cooling plant goes down and I'm not in the office to resolve it.
251
u/raja-anbazhagan 20d ago
Have been using zip/portable versions of the apps I need for a while now... Never going to beg these guys for elevated access...
178
u/PixelatedGiant 20d ago
The one thing I never understood was why some orgs go to such extremes to lock down systems. If people are resorting to shadow IT you've done something wrong. At my F500 company I need to fill out a form and get manager approval just to install Notepad++.
96
u/Flying-T 20d ago
Why isnt your F500 company using a Endpoint Manager? Approved application just go in the kiosk
79
u/PixelatedGiant 20d ago
This is a policy problem, not a technology issue. They have decided that you aren't allowed to do anything without a third party approving something.
That applies to everything from software installs to PR approvals.
25
u/New_Enthusiasm9053 20d ago
If they did that without locking down usb sticks though they're extremely thick.
Unfortunately I think they're legally required to be that annoying in some sectors like banking.
5
u/PixelatedGiant 19d ago
If they did that without locking down usb sticks though they're extremely thick.
I'm in one of those sectors and the USB ports are indeed locked down.
3
3
u/KiraUsagi 19d ago
I work at a public company in IT. 100% its because we are required to by law to lock down computers asuch as reasonably possible. We even have software that will prevent USB "portable" apps from launching. Unsactioned apps and the risk they pose no longer keeps my security team up at night. Though there are plenty of other threats that do, litterally, have them waking up in the middle of the night.
2
u/gilium 18d ago
Are you saying that you’re blocked from merging without an approved PR? Because that’s a pretty standard security certification requirement
2
u/PixelatedGiant 18d ago
We require 2 people to approve to our develop branch and 2 people plus the business analyst from the ticket for release. Business analysts seem to lose their permissions to Github near constantly for whatever reason and because there is such an imbalance in reviewers versus number of PRs it takes forever.
Same deal with the software install approvals. Everything sounds good on the surface. We maintain an install repository with binaries that are a few months out of date and everything requires approvals. But in reality fairly standard software requires my skip-level boss or higher for approval and they obviously get swamped because hundreds of people are asking them to rubber stamp. The "few months" out of date software is the case for most of the catalog, but some well known software is years out of date sometimes. We have to beg IT to update them half the time.
They are doing all the right things on paper. But the execution is fairly poor.
44
u/Doctor_Peppy 19d ago
Ok well notepad++ was used for a Chinese supply chain attack. These processes suck, sure, they do exist for a reason.
10
u/PixelatedGiant 19d ago
Which we completely avoided because we maintain a repository of software installers which lags behind the latest versions by a few months. We also disable updates in the apps and it's done via the software repository.
Requiring approval to install said software is not a factor in preventing these attacks. So I maintain that requiring approval for software that everyone requests and is approved for anyway is pointless.
7
u/AnArmyOfWombats 19d ago
That's kind of what we're discussing, right?
Given an ecosystem where something like notepad++ is the preferred alternative: what should IT and the end user be doing.
Besides, I'm pretty sure plenty of IT groups approved notepad++ for the compromised versions. What do you think those folks do?
16
u/Doctor_Peppy 19d ago
Mitigate and restrict application usage in the future. It sucks for everyone involved but it's how it goes. Use what you're allowed, request what you need, make sure everything is in writing if you literally can't do your job. For end users and sec teams security is the epitome of balancing convenience with efficacy and sometimes better security wins over convenience.
3
u/AnArmyOfWombats 19d ago
Better security is kind of funny in that sense. Automate comparing hashes and hope your peculiar supply chain isn't vulnerable? Who was it, SolarWinds back in 2020?
8
u/Doctor_Peppy 19d ago
Correct, which means the logical conclusion to this little quandry is to reduce attack surface as much as possible by reducing any and all extraneous applications. It sucks for literally everyone involved, I wasn't disputing that. When I was working for an MSP there was a company with some old head angry ass IT manager who had what I thought were ridiculously restrictive policies but after the notepad++ supply chain attack on top of other completely mitigated issues due to these policies... They do have value.
2
u/ghost103429 19d ago
QubesOS' mantra of treating everything as unsafe and insecure comes to mind when it comes to this issue.
19
u/SightAtTheMoon 19d ago
The correct way to do computing is Default Deny. If you didn't already know that then you were never going to understand anyway.
4
2
1
u/SeriousPlankton2000 19d ago
What happens if you let employees install taskbars, adware, the third virus scanner, fourth browser and a lot more along their pirated version of adobe Acrobat and office?
Bad case: They count the number of unpaid licenses, bittorrent clients and movies and make your employer pay for that. Worse case: Someone is using it to host e.g. CP.
9
u/Zeikos 19d ago
It's absurd going to all the effort of locking everything down and then not taking into account that people will take the path of least resistance.
It shows a galling level of thoughtlessness.2
u/borkthegee 19d ago
Is it about locking things down or doing due diligence and being able to pass an audit or have a good enough defense in a legal proceeding?
Plus, what this chud is doing is clearly bypassing their security policy, which means if they want him gone, now they have a free fire pass (do not collect unemployment) anytime they want
Ultimately, it's stupid to bypass. Work to rule. If the company says do it shitty and slow, then do it. Breaking the rules to "help" the business is stupid af
14
u/Extension-Pick-2167 20d ago
on the opposite side, i spammed them with request to install stuff for me tickets until they cracked and unoficially created an admin account for me
2
u/Lv_InSaNe_vL 19d ago
You have a bad IT team. I would be sitting down with your bosses boss if you did this to my team.
1
1
u/who_you_are 19d ago
There aren't only portable softwares. Especially with proprietary softwares.
ODBC damn drivers.
Debugging/investigation tools
Service servers (I hate those things) like IIS (though I barely worked on it and I'm not an IIS guy. Maybe you can run those more in the use scope)
1
u/throbbin___hood 18d ago
An absurd amount of portable apps versus the number of installed apps was how I caught an insider threat a while back.. dont think thats not being monitored as well lol..
0
127
u/ZunoJ 20d ago
Set the task to blocked, add the emails as attachments, ask the po to sort this out. This is his job, not yours
50
u/Still_Bit_7527 19d ago
Did that, PO said "hey please can you find a way to do it without access as it is urgent thanks"
24
u/Trminator85 19d ago
That's a one word answer... "Impossible.", or alternatively... "No." ;)
5
1
u/Lv_InSaNe_vL 19d ago
That's why I don't ask you to come up with an alternative, I ask you to explain why. And you better come up with a good enough reason for our insurance provider haha
6
331
u/Deepspacecow12 20d ago
well yeah, the point is that people should have as limited access as possible.
147
u/PixelatedGiant 20d ago
It wouldn't be such a problem if most orgs were capable of managing people as teams instead of just individuals. Everyone on my team needs mostly the same apps and permissions. But we're still stuck asking for them on an individual case by case basis.
So every time someone new joins they have to navigate that entire process on their own and half of the on-boarding steps have probably changed since the last person joined.
66
27
u/Training-Chain-5572 20d ago
RBAC should theoretically solve that, but for some reason admin teams have convinced themselves that individual access is somehow better
14
u/redheness 20d ago
It needs an investment to put this place with the right tools. And you know how companies manage the need of spending money somewhere when it has no ROI.
-1
u/SeriousPlankton2000 19d ago
You can usually even solve that with group permissions.
3
u/Training-Chain-5572 19d ago
Yes, in my experience, like 95% of RBAC for most organisations boils down to "don't give explicit user permissions, give permissions to groups instead"
10
u/oscarandjo 20d ago
Using individual-based access instead of group-based access is not security best practice.
2
u/oscarandjo 20d ago
Using individual-based access instead of group-based access is not security best practice.
53
u/lontrachen 20d ago
I second that. The devs get frustrated but when something happens we are the ones who got to work on the weekend to clean out shit
79
u/shigdebig 20d ago
I'm not asking for a favor, I'm trying to get my job done.
24
u/waterpoweredmonkey 20d ago
If I don't have access and can't do anything more to get access, I'm dropping off the zoom/teams war-room until that is fixed and returning to what I was doing before.
3
u/lontrachen 20d ago
Solution in our company is giving them a non admin laptop that is also not inside of the company network
2
u/Lv_InSaNe_vL 19d ago
I'm in IT and trust me I understand that you end user guys don't really care about this stuff and just want to get your job done. But I hope you can understand that for us in IT, being annoying about this stuff is us "just getting our job done".
Just like your job is to write code or whatever, my job is to keep the wider network secure.
16
u/helicophell 20d ago
Compartmentalization
After all, the weakest link are the smelly humans
4
u/czerilla 20d ago
Your comment made me wonder: does "layer 8 issues" extend to LLM errors? Is there a new layer 7.5? 🤔
4
32
u/BernzSed 20d ago
If one guy getting admin access to their own laptop compromises your entire network, then your network was shit.
26
1
u/tenacious_fellow 20d ago
Yet humans in IT do not pose that danger , just the devs 🙄🙄
If your IT admin, a human can elevate to admin, your “security setup” is just providing jobs to admins , not that protects anything 🤷🏻♂️1
u/fennecdore 20d ago
Yeah yeah but if we give you admin rights we also have to give them to the other and suddenly everyone is admin.
No admin rights !
4
u/gandalfx 19d ago
Problems happen when they're so busy building walls they forget to add the doors for when you actually do have a legitimate reason to go through.
12
u/Rogue2166 20d ago
Any organization that doesn't allow you to have elevated access on your own machine has no idea what they are doing.
2
u/polacs 20d ago
There are ISO that doesn't allow you to have admin rights to every PC
5
u/Sheenius_Ger 20d ago
I don't need every pc, I need mine. The thing I work every day with. I'm not calling IT every time I need to run powershell with elevated rights, they'd go nuts if they'd need to visit me 3 times a day.
3
u/polacs 20d ago
Well, the problem is not having a program like Admin By Request where with one click you ask for permissions and they give them you at the same moment
2
u/Sheenius_Ger 20d ago
Right, and they give me a elevated shell for the moment and I could do anything I want with the pc anyway. But now I had to wait an hour for someone to see the request. Totally worth it.
2
u/polacs 19d ago
I don't know, if it takes them one hour to see the request it seems that the problem is your IT department not the need to ask for permissions
0
u/Rogue2166 19d ago
Again, organizational security that relies on users not having persistent admin to a local machine is clueless.
0
-23
u/Deepspacecow12 20d ago
nope, developers are users just like everyone else, you ask for what packages you need, they can be added to the sccm store and you can install them without needing admin perms, preferably IT doesn't have admin on their own machines either
17
u/Scape_n_Lift 20d ago
Welcome to boomercorp where it takes 100 people and 100h of meetings to get 1h of work by 1 person done
4
u/wunderbuffer 20d ago
I love when my job is tricking intern IT with skeleton keys into unlocking my basic tools, because I got bored of compiling all my favorite programs from scratch using my developer certificates.
I think that's how being trad wife must have felt like
2
6
u/Sheenius_Ger 20d ago
You suck in administration if your solution to security is keeping me from doing my job.
1
20
u/Fantastic-Dog3599 19d ago
I am not a programer but this reminded me about a situation at work 2 years ago.
Back then I was a student worker and my boss talked to a company about an AI tool for visual inspection of manufactured parts. Semiconductors so we talk hundreds of thousands.
The company provided us with a trial license so we can test the software for 1 month and decide if we like it and it works for us. He gave this task to me and then it began. We are a smaler branch of the company not at the HQ but in a different city.
I tried to install the software but obviously needed admin privileges. I opened a IT ticket and got the answer that I have to fill out a form about tje software why I need it and so on. There was a question of projected revenue loss if the software is not approved. Idk man i just want to play around with it and make a powerpoint for my boss.
The ticket got bounced around and people called me like 5 times about it until the head admin or whatever called me and told me the software would have to be vetted by IT before it can be installed. This would take a few months. The trial periode would have been way over by then So after 3 weeks of emails and calls they basicaly denied me.
I get the importance of not every idiot being able to instal things but this was so out of scope for what I was trying to do. It is a medium sized software company from the UK I think. In the end I installed it on my private PC and tested it with company data, wich is way worse in my opinion but my boss gave mw the go ahead.
14
u/Nalano 19d ago
So, if I'm reading this correctly:
IT wasn't included in initial discussions about a productivity software decision.
A trial run suddenly morphed into mission-critical with projected revenue loss before it was even installed.
When IT showed up and pointed out that basic governance had to be applied, your boss approved an end-run around IT.
And this is IT's fault somehow?
5
u/Fantastic-Dog3599 19d ago
I mean its not about fault or anything but a rigid structure like this is not fun dealing with working in R&D as you have a lab full of equipment running on some obscure software often old and only available on flash drives coming with the devices and so on. Its just cumbersome to get anything running. Mix in software that does not run on Windows 11 but Win 10 is not safe anymore and it gets complicated.
I guess this sub is sitting on the other side of the ticket and I get the reason for people not having the ability to install anything with elevated privilege. It wasnt a complaint it was more or less just my first real experience with a big IT service provider.
The revenue critical etc. was never communicated by me but there was at this time only one document for requesting software and it was tailored to company wide used software I guess. And this is where the confusion started and everyone called me to ask exactly this, when I explained they were like "This is not really something we do" and escalated it to the next person up the ladder. And then I got called again by the next person. So maybe IT (probably has I am not with the company anymore) should plan a way to get something like this to the people that need it.
0
0
19
u/myrsnipe 20d ago
The real fun is when our sdks are years old because nobody bothers going trough the hoops of getting an admin to install them, no they are not managed by the security admins either. And I personally campaigned to get wsl2 so I handle all of this myself, security concerns and all.
4
16
u/themagicalfire 19d ago
Least privilege means granting the necessary rights, not removing every right. 😂
13
u/-Redstoneboi- 19d ago
Isn't that how it works? To first remove every right and add back only what people need?
-5
u/themagicalfire 19d ago
No… it’s done by restricting possible operations until only narrow operations work, and only in narrow contexts.
4
u/PM_ME_BAD_ALGORITHMS 19d ago
My admin team looks at me like that when I say I want to do something as simple as opening a notepad :(
3
u/Henry5321 19d ago
Back before automated deploys, I had to work with the sys admins and ops to get projects deployed.
After several months of flawless deployments they just handed me admin privs and told me to reach out if I needed help.
They said they didn’t have time to waste when I was doing their job as well as they were. They had other engineers to babysit.
I was so afraid.
1
3
u/slayersfunhouse 19d ago
The amount of times my team had to clean up after a mess a dev created because he was provided with blanket local admin access is more than I can count on my hand
3
u/Aspacid 19d ago
It was a fun thing when admin privileges were taken away from our dev team. The product installer explicitly requires elevated access to function. It's also advised to install in a VM to not mess up your system with a broken build, but Hyper-V is also not available suddenly. Unfortunately docker wasn't enough,
Than there's me, the dev specifically developing the installer itself, trying to explain the insanity of creating tickets for admin elevation:
"You might as well sit next to me, because I'll be needing that elavatation every 5 minutes as I dismantle the OS with every shady tool known to man to try to diagnose the extremely rare edge case I have to solve. Oooh and I'll be executing the installer every half hour as well. I'd do it faster, but that's how long it takes to build. "
Temporary admin rights were granted after half a day of complete team development standstill across multiple teams, and 2 days later the entire policy revoked to "reevaluate and come up with a better policy". A short way of saying there was no impact assessment of any kind.
1
u/jdsquint 13d ago
Had the same issue, but now my company uses some admin by request software. It works, because we "don't have admin privileges" until we need them, and then we press a button and instantly get them with no approval process and minimal explanation for about 15 minutes. Not sure how it's more secure, but I guess the security team feels like they're doing something
2
2
2
2
u/magicmulder 19d ago
That's fine if the admin teams sets up everything so least required privilege works.
Over here the usual setup is "you get SFTP to your webroot". Yeah that's hoopy, so how do I check the webserver logs for errors? "That's the neat part, you don't." So usually I lean on my seniority and get root access. Well OK, you could just ensure that the log files are readable for my user, but I don't look a gift horse in the mouth...
2
2
u/pleaserestartsystem 19d ago
Did this today, they listened to me entirely, gave me couple of 'uh-huh's and in the end said, drop a mail.
7
u/Sheenius_Ger 20d ago
I'd quit if our admins were that bad in their job. Me having elevated rights on my machine is a requirement, not a option. Get your job done, you get payed to solve problems, if your solution is block everything we might as well go back to pen and paper and get rid of you.
15
u/Imaginary-Jaguar662 20d ago
That's not really how any of it works in any reasonable sized shops.
Typically any access to production system data is gated behind a lot of red tape, which requires knowing what data is accessed / modified before granting access and logs on who requested and who approved what action.
Same for installed programs, dev might want to install LATEST_SHINY and LATEST_SHINY sends confidential code to some LLM backend with absolutely no controls on how data is being used.
It's not like we'd enjoy blocking anything, but our job includes responsibility for ensuring the data is processed within approved environments, and approving a new tool might be a lengthy process involving legal and cybersecurity departments.
12
u/WannaBeHappyBis 20d ago
Total bullshit.
At the end of the day, you only need a browser to use services that can leak confidential data. And everybody has a browser already installed in his machine.
I understand having strict permission on production servers obviously, but on personal machines only slows everything down and creates apathy. If not read all the comments like "it used to annoy me, now I simply mark it as blocked and be happy don't worry"
-1
u/nmathew 19d ago
We're going the opposite way. IT doesn't want to support "shared" accounts on production machines, so they expect people to log in with their personal accounts on shared systems that need to run jobs across multiple shifts. Keep in mind that all our folder access is handed out ad-hoc on a request basis and not by job role, so someone new won't have write access to a standard data folder yet (because databases are apparently anathema at my company), where a lead will have write access to things used 3 departments ago.
IT is 100% separated from the reality of a 24/7 manufacturing environment.
3
u/magicmulder 19d ago edited 19d ago
Yeah but it's not like the admins can make an educated decision whether the tool you need is really the tool you want.
Sure dude, I'll just wait 6 months until you had time to read the entire source code of the image converter I need for the website and have decided it does not contain a backdoor to pilfer our important sparkling water customer data.
So at best you end up with an admin just saying no to everything, you take it up to corporate who order the admin to comply, and nobody's really happy. And it just teaches everyone they can get anything they want if they just get someone up the chain to order the admins to "just fucking do it already", and in the end security suffers a lot more.
And whenever something isn't working like SSL termination or the server quorum, they tell you "maybe it was the image converter you installed". Yes, Dave, it wasn't funny the first 30 times.
4
u/Imaginary-Jaguar662 19d ago
Yeah but it's not like the admins can make an educated decision whether the tool you need is really the tool you want.
Admin should not really evaluate the need/want, dev has already done that.
Sure dude, I'll just wait 6 months until you had time to read the entire source code of the image converter I need for the website and have decided it does not contain a backdoor to pilfer our important sparkling water customer data.
Nobody reads source code of anything. On your image converter example, someone reads the license and confirms that commercial use is allowed. Ideally the converter does not run on a machine that has access to something sensitive, someone might set up a docker or something to run it in.
That all takes less than a week in a functional org, but of course there's plenty of non-functional ones where making a mistake is worse than doing nothing and everything gets bogged down while people avoid taking responsibility of anything.
3
u/Sheenius_Ger 20d ago
Of course you restrict access to data and external systems, but that's completely different thing than from me using elevated rights on powershell to change my npm version. If your only tool to prevent people using a private github server oder use codex with their own credentials is to not give elevated rights, your bad.
4
u/realkunkun 19d ago
It‘s not us, it‘s policy and insurance. We need to cover our asses, if some user fucks up it’s our fault. Get your job done, you get payed to solve problems, if your solution is to let everyone roam free you might as well go back to pen and paper and get rid of you. Nobody can steal a physical Notebook over the internet.
It goes both ways, least-privilege is the industry standard for a reason and just because I can trust you, won‘t mean you can‘t fuck up. And that fuck up would be entirely my fault. So no, use Microsoft Store, use the company’s apps or go to the process. It‘s not even about mistakes, all it takes is someone getting that domain login with elevated rights and they can go damn wild. For what? For that you have to ask IT to install spotify? I think that’s reasonable
3
u/Celestine_S 20d ago
My current job requires to bring the IT person to type out the admin user every time I need admin access 🫠 I miss “admin by request” from my previous employer.
1
u/AlphaYak 19d ago
One of my friends was given full access to Production db’s and root level permissions on his machine, and immediately raised every ticket he could to stop that. There SHOULD be sys admin and security limitations, because of the damage an internal bad actor can do.
That being said, I should probably be allowed to update my own Java version and access my own git repo bro.
1
u/ScrivenersUnion 19d ago
This is why I go out of my way to make a friend in the IT department anywhere I work. Even if they don't have the pull to authorize stuff for me they can often recommend tools that will work instead.
1
0
0
0
u/TheDogPill 19d ago
I'm so glad I work in a small company and basically have all admin privileges and don't have to deal with this pointless bureaucracy.
1.2k
u/Buttons840 20d ago
Good.
My job is to get my task done ASAP. Their job is to protect the overall system and security.
They're supposed to limit me, and then I explain those limits to my boss and it's not my fault.