Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I learned about corporate firewalls

valcanbuild.tech

Post reply on HN
Print view View original

121–130 of 204 posts

Re: How I learned about corporate firewalls

#121

Post by Spooky23 »

wahnfrieden wrote: post #95
dspillett wrote: post #88

Earlier quoted context omitted.

> IT absolutely doesn't give a flying ** about developers. They are not paid to. Their performance is judged against how close they get to zero compliance issues, not how close they get to zero times developers were unhappy! > I think they're preventing people from hiding their internet browsing. Without delving into the “do you have the right to privacy even on a company machine”, who would be daft enough to do some…

You’re just arguing for surveillance (by capital or state) with the tired line of you should have nothing to worry about unless you deserve it which is absurd/reactionary

You’d probably feel differently if some developer at the IRS compromised your identity because he used some compromised library to avoid internal processes.

Security, public trust, etc requires controls and audit to deliver. You don’t want a startup “fake it till you make it” mentality in government or banking.

Re: How I learned about corporate firewalls

#122

Post by sillystuff »

huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

The MiM might not be your IT folks, but rather management. I was in a meeting which included folks from Palo Alto (PA) and management where PA was hard selling their ability to MiM all https connections and link all activities of the users to their usernames through various methods from directory integration to log scraping on radius servers. The managers were super excited about the possibilities. Management not only wanted to implement this, but wanted to do so in secret. IT folks were pushing back-- hard.

Firewall as bossware.

Firefox being banned is because it uses its own certificate store, so Firefox users would see a browser warning every time they visit any https site notifying them that their traffic is being MiM'd. Chrome and chrome reskins like MS Edge use the OS store which MS Windows centric organizations can easily (centrally using MS tools [GP]) add the trusted CA for MiM into. For the Macs, it probably wouldn't matter since the 3rd party mgmt tools could probably push out either.

Re: How I learned about corporate firewalls

#123

Post by _fat_santa »

Spooky23 wrote: post #117
huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

For good reason. Stuff like that is a really high risk and won’t meet audit standards. I’m in charge of the IT goons somewhere. We aspire to provide a better level of service and maintain local repos of things you’re allowed to use. Stuff like Node isn’t allowed near anything important though. I would be careful. An agency doing stuff like that is probably running an EDR that will detect and report on what you’re doi…

It might very well be for a good reason. But in my experience, it's never the policies but the communication. IT was right to make whatever policy change they needed to, the fucked up by not telling any of the dev teams.

Re: How I learned about corporate firewalls

#124

Post by [deleted] »

P5fRxh5kUvp2th wrote: post #62
hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

I was recently told by an old-timer at my current company that at one point security tried to remove Visual Studio from developers machines because it had reported security incidents. The problem with security people is that they think security is the most important thing.

[deleted]

Re: How I learned about corporate firewalls

#125

Post by _fat_santa »

tanepiper wrote: post #2

If I want to push to GitHub when I am in the office, I have to VPN out of the office connection because Port 22 is blocked. And they wonder why I prefer to work from home?

I worked for a place where they did wired stuff like this. Ended up that to install dependencies for a Node app, you had to:

1. Disconnect from VPN and run `npm install` until it failed

2. Connect to VPN "Profile 1" and run the command again until it fails

3. Connect to VPN "Profile 2" and run the command again until it fails.

4. Disconnect from VPN and run the command another time to finish installing all dependencies.

5. Reconnect to VPN to actually run the app.

Re: How I learned about corporate firewalls

#126

Post by sillystuff »

dspillett wrote: post #97
wahnfrieden wrote: post #95

Earlier quoted context omitted.

You’re just arguing for surveillance (by capital or state) with the tired line of you should have nothing to worry about unless you deserve it which is absurd/reactionary

I'm not saying it is right for people to be monitored, but that I would never trust that I wasn't being so I'd not be daft enough to do something I don't want the company to know about using their resources. And there are perfectly valid reasons for companies to monitor traffic: data exfiltration, accidental or malicious, is a significant concern for companies that hold and process PII and for the people who have the…

Some of these "security" products that MiM TLS traffic allow configurations that objectively reduce your security. You can configure Palo Alto devices to accept a self-signed cert from the Internet, but present your trusted MiM cert to the on-site user. Now the user isn't aware that they are the victim of a second MiM outside the organization.

The organization also exposes itself to greater liability. E.g., a rogue employee could use the trusted MiM CA cert for their own MiM e.g., capturing banking credentials of co-workers or accessing user/employee PII they would otherwise not have access to.

Yes, monitoring traffic by MiM https to external sites can alert you to / possibly prevent accidental exfiltration, but it doesn't prevent intentional exfiltration. It is, however, very effective at monitoring employees. The thing it is best at, might be its true purpose in an organization.

Re: How I learned about corporate firewalls

#127

Post by TheRealDunkirk »

huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

Oh, how I have learned the hard way on this.

Our IT now blocks outbound SSH entirely. You know, the secure way to access VM's in, say, our cloud? Sigh. I'm sure there's a "jump" server somewhere that I'd have to log into, `sudo` to another account, THEN SSH to my target box. Whatever. I just avoid the VPN.

I used to use `cntlm` to tunnel requests through our firewall for things like Ruby's bundler, as it required NTLM authentication. Now they've also gone the additional mile, and installed a certificate (Cisco Umbrella) in all of our computers, and require its signature to pass the firewall. Unfortunately, it took me a long time to sort this out: why `cntlm` no longer worked, and why none of the usual suggestions on SO fixed it. I finally figured out that RubyInstaller for Windows included a nice facility to deal with this. You just place additional certs in a directory, run a Ruby script, and it will bundle the whole stack into a single .pem, which it will reference for all network-related commands. Thankfully, bundler's error messages were telling me the specific certs I needed, and I could download them from Cisco's web site.

Just about a month ago, my company started requiring that cert for ALL traffic, not just HTTP(S). Like for, say, Postgres connections on port 5432. I finally realized that I could reference that same SSL bundle in my Postgres client connections, and get through.

I've spent about 8 years here now, and it's been a cat-and-mouse game the whole time. I'm always wondering what's coming next.

Re: How I learned about corporate firewalls

#128

Post by TheRealDunkirk »

thaeli wrote: post #74
huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

Why are they allowing you to run npm, pip, etc from public repositories at all? That's a huge supply chain risk. If builds are worth doing on prem they also need to be pulling solely from internal, vetted repositories.

The idea that some team is "vetting" that the entire stack of stuff you'd pull from npm for a React front-end app is "safe" is ridiculous. Forget the mirroring; that's trivial. What criteria or process would make you think you had a "vetted" snapshot, beyond what they already do!?

Re: How I learned about corporate firewalls

#129

Post by repiret »

jve wrote: post #37

I wonder what _showHtmlPage_ does? Did he just write something, something that allows 3rd party (corporate firewalls) inject HTML under his domain within TLS protected connection? Cannot judge by not knowing how he displays errors. But a question to HN public: Is opening unknown HTML under my domain within another window safe? Or is there any possibility to strip down any "permissions" to cookies, requests, resources…

I get where you’re coming from, but keep in mind that the filtering proxy returning 403 instead of relaying the POST is already able to inject arbitrary HTML into all of his TLS protected pages. If the proxy wants to scrape card information, it already can; if it’s malicious, the user is toast no matter what the website operator does.

Re: How I learned about corporate firewalls

#130

Post by slt2021 »

huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

this is because "pip install" is insecure, this is supply chain risk. Your IT team should have provided local artifactory proxy through which you can pip install.

you should use this command "pip install -i http://artifactory.mycompany.local pandas" and get url for artifactory from admins

Post reply on HN