Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I learned about corporate firewalls

valcanbuild.tech

Post reply on HN
Print view View original

21–30 of 204 posts

Re: How I learned about corporate firewalls

#21

Post by richbell »

cheschire wrote: post #12

"Aha, so an overzealous IT network decided to block the request before it even reached my server." What classifies this as an "overzealous" act of network configuration? There may be a subjectively legitimate reason the user's network was configured this way. "I had no idea I was ever going to get anything different." There's an entire list of HTTP status codes. That was your clue that you would get something differe…

> What classifies this as an "overzealous" act of network configuration? There may be a subjectively legitimate reason the user's network was configured this way.

Worked at a large FI.

Our corporate firewall used to block any website or payload that contained the word "hack". At one point, the security team decided to roll out a change that blocked all verbs except GET and POST without telling anyone. I could go on.

Re: How I learned about corporate firewalls

#22

Post by gwillz »

I have a government client that has locked down all outgoing access for a web server except though a socks proxy.

It makes simple things really hard - like a links checker, package dependencies, remote servers or integrations with Google.

We can't even run test scenarios on the machine because we're also locked _out_ of the server. Instead, we rely on their IT department to run test scripts that we send them via email.

We were debugging an elastic server connection for 2 weeks that was working perfectly fine in their "QA". It's a horrible existence.

Re: How I learned about corporate firewalls

#24

Post by reisse »

hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

We once had an idea about integrating libtorrent for distributing binaries. Turned out libtorrent website was banned by corporate firewall due to "piracy".

Decided the idea was not worth it to fight with infosec guys.

Re: How I learned about corporate firewalls

#25

Post by zasdffaa »

incomingpain wrote: post #13
hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

As a security guy, we are taught the CIA triad early and it's easy to forget. The A stands for availability and if you don't make things available, you're failing at your own job.

CI = ??

Re: How I learned about corporate firewalls

#26

Post by PcChip »

gabesullice wrote: post #15

> It helpfully spits out this HTML response in return but, of course, my frontend code was expecting a JSON response. I had no idea I was ever going to get anything different. I wish more front-end devs recognized that they're building HTTP clients whenever they make HTTP requests. There's a whole specification written about how to do that well so one doesn't have to learn things like this the hard way. Specs may loo…

Isn't there some kind of library to handle this without having to code it each time?

Re: How I learned about corporate firewalls

#27

Post by easton »

hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

If anyone is stuck somewhere like this, Stack Overflow has dumps regularly updated on archive.org -- https://archive.org/download/stackexchange/

Dash (or its Windows equivalent, name escapes me) can be used to view and search these dumps (as well as dumps from GitHub, language docs, etc) offline: https://kapeli.com/dash

Re: How I learned about corporate firewalls

#28

Post by n4r9 »

zasdffaa wrote: post #23
hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

Little experience with javadocs, so how do they fall?

Also no experience with javadocs or Java, but in my experience Stackoverflow is a huge productivity boost for a junior dev.

For example I wonder if javadocs shows you how to convert an InputStream to a string, as per this question: https://stackoverflow.com/questions/309424/how-do-i-read-con...

Re: How I learned about corporate firewalls

#29

Post by easton »

zasdffaa wrote: post #25
incomingpain wrote: post #13

Earlier quoted context omitted.

As a security guy, we are taught the CIA triad early and it's easy to forget. The A stands for availability and if you don't make things available, you're failing at your own job.

CI = ??

Confidentiality, Integrity

Re: How I learned about corporate firewalls

#30

Post by richbell »

criddell wrote: post #19
szszrk wrote: post #8

I'm currently in my very first job where running a local silent NTLM proxy is not a vital skill of survival. For similar reasons I somehow always made an opensource sonatype nexus that is doing pypy proxy or similar, so that operators team can actually do meaningful work without triggering security teams daily.

Can you expand on this a bit? I googled "ntlm proxy" and "sonatype nexus" and still have no idea what it is you've done but I'd like to understand.

Nexus Repository (commonly referred to as just "Nexus", which is confusing because Sonatype has several products called "Nexus $name") is a local artifact repository. Running it locally allows you to cache artifacts from external repositories like pypi.org or repo.maven.org, which is beneficial because it cuts down on the amount of outbound traffic required to install dependencies.
Post reply on HN