Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I learned about corporate firewalls

valcanbuild.tech

Post reply on HN
Print view View original

101–110 of 204 posts

Re: How I learned about corporate firewalls

#101

Post by unethical_ban »

P5fRxh5kUvp2th wrote: post #62
hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

I was recently told by an old-timer at my current company that at one point security tried to remove Visual Studio from developers machines because it had reported security incidents. The problem with security people is that they think security is the most important thing.

The problem with devs is they think all security admins are reductionist. A good security admin will work within the bounds of compliance to make the business work. And any good blocks will be apparent to the user. Trust me, security doesn't enjoy pissing people off, we just accept that it happens sometimes.

Re: How I learned about corporate firewalls

#102

Post by xani_ »

tanepiper wrote: post #2

If I want to push to GitHub when I am in the office, I have to VPN out of the office connection because Port 22 is blocked. And they wonder why I prefer to work from home?

You can just push using port 443

    -> ᛯ ssh -T -p 443 git@ssh.github.com
    Warning: Permanently added '[ssh.github.com]:443' (ED25519) to the list of known hosts.
    Hi XANi! You've successfully authenticated, but GitHub does not provide shell access.

Re: How I learned about corporate firewalls

#103

Post by BizarroLand »

nightpool wrote: post #79
BizarroLand wrote: post #5

Earlier quoted context omitted.

I would have taken that as my queue to start finding another job. Not that I can't puzzle everything out from scratch every single time I need to do anything, but why should I reinvent the wheel when off-the-shelf is both faster and higher quality?

(cue, as in "a signal (such as a word, phrase, or bit of stage business) to a performer to begin a specific speech or action", e.g. "That last line is your cue to exit the stage". See https://www.merriam-webster.com/dictionary/cue )

Rats. I should have known it was the wrong version when my brain made me slow down to spell it out. Thanks for the correction!

Re: How I learned about corporate firewalls

#104

Post by marcosdumay »

bombcar wrote: post #72
huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

That first one indicates something is being injected and the checksums are failing, that's ... worrying. Or npm and pip use their own certificate stacks and refuse the firewall's cert, which is ... good I guess.

It could be just the problem of the certificate being invalid for those tools because the MITM one was installed only for Chrome up to the firewall replacing all of the files with html pages of some antivirus with internal links where the user can download them.

Corporate middleboxes come in all shades of stupid.

Re: How I learned about corporate firewalls

#105

Post by szszrk »

criddell wrote: post #19
szszrk wrote: post #8

I'm currently in my very first job where running a local silent NTLM proxy is not a vital skill of survival. For similar reasons I somehow always made an opensource sonatype nexus that is doing pypy proxy or similar, so that operators team can actually do meaningful work without triggering security teams daily.

Can you expand on this a bit? I googled "ntlm proxy" and "sonatype nexus" and still have no idea what it is you've done but I'd like to understand.

The nexus part was laid out nicely by others. ntlm proxy is a proxy that can authenticate inside a corporate network with your own credentials and forward all requests, while exposing a simple old school proxy. You hit simple local proxy, it gets forwarded to a small tool that does NTLM auth inside your company's network pretending you are doing that traffic yourself.

This is hopefully a trend that is disappearing with a wave of modern transparent proxy solutions, but in general companies tend to set up proxies that get automatically authorized by your workstation. It may have some issues with less known browsers and your console tools will not be able to use that at all.

So when you build something locally, want to download a .deb, or a pypi package to have modern Python tools your are out of luck - you have to download it manually using a browser or not at all.

This is where such proxy comes into play.

Re: How I learned about corporate firewalls

#106

Post by justin_oaks »

hathym wrote: post #65

tldr: do error handling.

Yes, it's more about error handling than it is about corporate firewalls.

There are lots of reasons why the request would fail and returning a 403 or 503 from a corporate firewall is just one of them. What happens if the user's wifi is flaky and the HTTP request is canceled? What happens if the connection is slow and the request times out? What if, heaven forbid, the destination server is down or unreachable temporarily?

As a web developer, never let a user's action lead to nothing happening. Always give feedback. Whenever sending background HTTP requests, always provide a visible error message to the user when you encounter unexpected results or HTTP/network errors.

Re: How I learned about corporate firewalls

#107

Post by marcosdumay »

jve wrote: post #37

I wonder what _showHtmlPage_ does? Did he just write something, something that allows 3rd party (corporate firewalls) inject HTML under his domain within TLS protected connection? Cannot judge by not knowing how he displays errors. But a question to HN public: Is opening unknown HTML under my domain within another window safe? Or is there any possibility to strip down any "permissions" to cookies, requests, resources…

I dunno. The frontend just made a TLS connection to his server and downloaded an HTML page. I don't think displaying that page adds any extra vulnerability.

If he put it in a sandboxed iframe, it will have the same kinds of access as the main page, because it comes from the same domain. Everything is already as messed up as it can be, and there isn't anything the frontend can do to improve it.

Re: How I learned about corporate firewalls

#108

Post by dhosek »

denton-scratch wrote: post #73
raxxorraxor wrote: post #50

Earlier quoted context omitted.

Sensible for the users that really download and execute attachments from the most obvious spam mails. The only protection you have is to put these high threat users in a separate subnet and use some antivirus to scan everything they download. At least that offers some protection. Not possible to scan downloads with TLS. Although I still think that breaking it up is a very bad idea in general and it is appalling that…

> put these high threat users in a separate subnet Ideally a subnet belonging to one of your competitors? I thought that nowadays only very ignorant people follow links or open attachments in spam emails. Certainly all the spam I've seen for a few years has been as plain as the nose on your face: only an ignorant person would mistake it for ham.

I did almost get caught in a scam—email appeared to come from CEO in my medium-sized company (so it wouldn’t have been out of place to hear from him). First email simply said, do you have a moment to chat, second was, fortunately, an obvious scam request—“can you buy some gift cards for a client?” but everything was disguised enough that I might have gotten caught with a better-conceived spear phishing attack.

Re: How I learned about corporate firewalls

#109

Post by P5fRxh5kUvp2th »

unethical_ban wrote: post #101
P5fRxh5kUvp2th wrote: post #62

Earlier quoted context omitted.

I was recently told by an old-timer at my current company that at one point security tried to remove Visual Studio from developers machines because it had reported security incidents. The problem with security people is that they think security is the most important thing.

The problem with devs is they think all security admins are reductionist. A good security admin will work within the bounds of compliance to make the business work. And any good blocks will be apparent to the user. Trust me, security doesn't enjoy pissing people off, we just accept that it happens sometimes.

last week a former co-worker called me laughing.

He was on the phone with the CISO who was explaining it's impossible to give him access to SPLUNK because of the network segmentation.

While he's ON THE PHONE, he received an email from the IT group with credentials to access splunk.

And to be clear, I left specifically because of their security stance. I was once told they couldn't automate pulling data from production because of the same reason as mentioned above, the network segmentation wouldn't allow it.

So no, developers aren't just whining because they can't directly access PAN.

Security people always think their concerns should trump everything else. I would almost be willing to bet 70% of the mind-numbingly stupid decisions made across the industry had some security justification behind it.

If human beings took the same approach to safety that Security people do to security, they'd insist the wheels on your vehicle should only be able to turn straight and right. That the vehicle should _actively_ prevent you from turning your wheels left because left turns are more dangerous than right turns and they can show that you can _always_ get to your destination with just right turns.

Re: How I learned about corporate firewalls

#110

Post by pigbearpig »

jve wrote: post #37

I wonder what _showHtmlPage_ does? Did he just write something, something that allows 3rd party (corporate firewalls) inject HTML under his domain within TLS protected connection? Cannot judge by not knowing how he displays errors. But a question to HN public: Is opening unknown HTML under my domain within another window safe? Or is there any possibility to strip down any "permissions" to cookies, requests, resources…

That seems pretty unsafe without running it through some sanitizer. Trying not to judge too hard, but I would be concerned about the implementation of showHtmlPage by the same author that didn't handle non-json responses.
Post reply on HN