Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I learned about corporate firewalls

valcanbuild.tech

Post reply on HN
Print view View original

151–160 of 204 posts

Re: How I learned about corporate firewalls

#151

Post by tikkabhuna »

zasdffaa wrote: post #23
hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

Little experience with javadocs, so how do they fall?

Javadoc I find is excellent, but its firmly in the "Reference"[0] quadrant of documentation. I find it very readable and useful when you know what you're looking for (finding subclasses of Collection, for example). However, Stack Overflow is excellent when you don't know where to start.

[0] https://documentation.divio.com/

Re: How I learned about corporate firewalls

#152

Post by TheRealDunkirk »

slt2021 wrote: post #137
TheRealDunkirk wrote: post #127

Earlier quoted context omitted.

Oh, how I have learned the hard way on this. Our IT now blocks outbound SSH entirely . You know, the secure way to access VM's in, say, our cloud? Sigh. I'm sure there's a "jump" server somewhere that I'd have to log into, `sudo` to another account, THEN SSH to my target box. Whatever. I just avoid the VPN. I used to use `cntlm` to tunnel requests through our firewall for things like Ruby's bundler, as it required NT…

your practices are the epitome of Shadow IT that company management doesnt like and fights

You don't know the half of it.

Re: How I learned about corporate firewalls

#153

Post by pandaman »

pilif wrote: post #47

My favourite issue caused by a corporate firewall was when it altered an AJAX request to replace a specific combination of digits (in a long product ID) by asterisks. Turns out that a substring of that product ID matched the client company's phone number and their security theatre intercepting proxy was replacing all occurrences of "sensitive" strings sent to the internet with asterisks. The irony is, of course, that…

They have just implemented this protocol http://bash.org/?244321

Re: How I learned about corporate firewalls

#154

Post by ornornor »

slt2021 wrote: post #140
pilif wrote: post #47

My favourite issue caused by a corporate firewall was when it altered an AJAX request to replace a specific combination of digits (in a long product ID) by asterisks. Turns out that a substring of that product ID matched the client company's phone number and their security theatre intercepting proxy was replacing all occurrences of "sensitive" strings sent to the internet with asterisks. The irony is, of course, that…

this is because you deployed your somewhere in the public cloud and testing it from your workstation over public Internet? This is policy violation, and you need to learn how to develop and test properly over secure channels. Reach out to your Director of Engineering and request proper instructions how to develop and test software. public Internet facing channel is rightfully scanned and screened for these kind of pa…

You must be fun to work with.

Re: How I learned about corporate firewalls

#155

Post by ornornor »

huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

Worked at an insane place that did 1.

“It’s more secure” they said.

The “solution”? Disable certificate checking of course! What could go wrong?

Same place that ran a vulnerable instance of nexus (the package manager) for all internal npm and maven packages for a whole year before patching. It was publicly accessible. And it had a banner on the homepage that said “this version is vulnerable (severity 10/10 anonymous RCE), update NOW”. Anyone who went to https://nexus.1337company.com would see it.

That company did software for the government. I’m sure I wasn’t the only one who noticed the vulnerability and that some packages got tainted. But we’ll never know because no audit was ever performed and there were no backups of that server anyway.

Like I said, absolute joke of a workplace.

Re: How I learned about corporate firewalls

#156

Post by ornornor »

wahnfrieden wrote: post #95
dspillett wrote: post #88

Earlier quoted context omitted.

> IT absolutely doesn't give a flying ** about developers. They are not paid to. Their performance is judged against how close they get to zero compliance issues, not how close they get to zero times developers were unhappy! > I think they're preventing people from hiding their internet browsing. Without delving into the “do you have the right to privacy even on a company machine”, who would be daft enough to do some…

You’re just arguing for surveillance (by capital or state) with the tired line of you should have nothing to worry about unless you deserve it which is absurd/reactionary

More like you can’t possibly expect your work machine to have any kind of privacy, being in the trade and knowing all the ways companies can (and will) use anything they managed to gather about you should they need to obliterate you.

It’s simply good practice not to use your work machine for anything personal at all ever. Because depending where in the world you are, anything stored or viewed on a work machine gives your employer de facto access to it, legally speaking.

Re: How I learned about corporate firewalls

#157

Post by Spooky23 »

_fat_santa wrote: post #123
Spooky23 wrote: post #117

Earlier quoted context omitted.

For good reason. Stuff like that is a really high risk and won’t meet audit standards. I’m in charge of the IT goons somewhere. We aspire to provide a better level of service and maintain local repos of things you’re allowed to use. Stuff like Node isn’t allowed near anything important though. I would be careful. An agency doing stuff like that is probably running an EDR that will detect and report on what you’re doi…

It might very well be for a good reason. But in my experience, it's never the policies but the communication. IT was right to make whatever policy change they needed to, the fucked up by not telling any of the dev teams.

100% agree. Most fubar things are caused by poor communication, lack of empathy and poor understanding.

Re: How I learned about corporate firewalls

#158

Post by wahnfrieden »

ornornor wrote: post #156
wahnfrieden wrote: post #95

Earlier quoted context omitted.

You’re just arguing for surveillance (by capital or state) with the tired line of you should have nothing to worry about unless you deserve it which is absurd/reactionary

More like you can’t possibly expect your work machine to have any kind of privacy, being in the trade and knowing all the ways companies can (and will) use anything they managed to gather about you should they need to obliterate you. It’s simply good practice not to use your work machine for anything personal at all ever. Because depending where in the world you are, anything stored or viewed on a work machine gives…

You can be careful as a worker and still be against workplace surveillance

Re: How I learned about corporate firewalls

#159

Post by justsomehnguy »

sillystuff wrote: post #122
huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

The MiM might not be your IT folks, but rather management. I was in a meeting which included folks from Palo Alto (PA) and management where PA was hard selling their ability to MiM all https connections and link all activities of the users to their usernames through various methods from directory integration to log scraping on radius servers. The managers were super excited about the possibilities. Management not onl…

> Firefox being banned is because it uses its own certificate store

FYI You can instruct FF to use system trust store: https://support.mozilla.org/en-US/kb/setting-certificate-aut...

Re: How I learned about corporate firewalls

#160

Post by erinaceousjones »

richbell wrote: post #21
cheschire wrote: post #12

"Aha, so an overzealous IT network decided to block the request before it even reached my server." What classifies this as an "overzealous" act of network configuration? There may be a subjectively legitimate reason the user's network was configured this way. "I had no idea I was ever going to get anything different." There's an entire list of HTTP status codes. That was your clue that you would get something differe…

> What classifies this as an "overzealous" act of network configuration? There may be a subjectively legitimate reason the user's network was configured this way. Worked at a large FI. Our corporate firewall used to block any website or payload that contained the word "hack". At one point, the security team decided to roll out a change that blocked all verbs except GET and POST without telling anyone. I could go on.

Wow, that's whack. I couldn't PUT up working in a place with such a hackneyed firewall limiting my OPTIONS so much, really raises my hackles. I'd HEAD out the door so fast in such a ramsackle establishment, I wouldn't even ask for a reference, I'd just kindly ask that they DELETE my number
Post reply on HN