Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I learned about corporate firewalls

valcanbuild.tech

Post reply on HN
Print view View original

41–50 of 204 posts

Re: How I learned about corporate firewalls

#41

Post by doubled112 »

zweifuss wrote: post #36
zasdffaa wrote: post #25

Earlier quoted context omitted.

CI = ??

I didn't know either, so I looked it up: The three initials stand for the three most important IT protection goals, often referred to as the "pillars of data security": Confidentiality, Integrity, Availability. There are other IT protection goals, including authenticity, privacy, reliability, and (non)repudiation.

I think CIA covers everything in the list, right?

Authenticity and non-repudiation falls under integrity.

Privacy falls under confidentiality.

Reliability in context is another word for availability.

Re: How I learned about corporate firewalls

#42

Post by roflyear »

gwillz wrote: post #22

I have a government client that has locked down all outgoing access for a web server except though a socks proxy. It makes simple things really hard - like a links checker, package dependencies, remote servers or integrations with Google. We can't even run test scenarios on the machine because we're also locked _out_ of the server. Instead, we rely on their IT department to run test scripts that we send them via emai…

Hopefully you can bill them for all of this, but yeah, totally ridiculous and costing the taxpayer a ton of money.

Reminds me of a friend who started a government job, and they went 6m before they were fully onboarded and able to work. ????

Re: How I learned about corporate firewalls

#43

Post by ravio64 »

easton wrote: post #27
hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

If anyone is stuck somewhere like this, Stack Overflow has dumps regularly updated on archive.org -- https://archive.org/download/stackexchange/ Dash (or its Windows equivalent, name escapes me) can be used to view and search these dumps (as well as dumps from GitHub, language docs, etc) offline: https://kapeli.com/dash

Windows equilevant is zeal, which dash is a mac version of :)

Re: How I learned about corporate firewalls

#44

Post by shireboy »

ValCanBuild wrote: post #3
tanepiper wrote: post #2

If I want to push to GitHub when I am in the office, I have to VPN out of the office connection because Port 22 is blocked. And they wonder why I prefer to work from home?

Oh god this is horrible! Yeah, I can't believe how stupidly locked down some of these networks are. I once had an employer said they needed a "whitelist" of websites we wanted to visit instead of a "blacklist" of ones we shouldn't. That was an interesting day...

I’m dealing with this now. Company got hacked and so now are over the top locking down everything to the point it’s unusable. I told them the other day that the most secure thing they could do is just turn it all off.

Re: How I learned about corporate firewalls

#45

Post by dijit »

gwillz wrote: post #22

I have a government client that has locked down all outgoing access for a web server except though a socks proxy. It makes simple things really hard - like a links checker, package dependencies, remote servers or integrations with Google. We can't even run test scenarios on the machine because we're also locked _out_ of the server. Instead, we rely on their IT department to run test scripts that we send them via emai…

Used to work at Ubisoft and they had this same policy, they used an authenticated http proxy, so you either expose your entire SSO credentials to your environment (HTTP_PROXY=http://user:password@proxy:3128) or you don't get access to the internet for all your console applications.

Even then, if you were using certificate pinning, it wouldn't work as the HTTP proxy would serve a "are you sure you want to continue" HTML page, which is of course not expected.

SSH is out of the question.

it's amazing what "simple" things break; like kubectl, gcloud, go get.

So frustrating. Countless development hours lost to bypasses.

Re: How I learned about corporate firewalls

#46

Post by karatinversion »

n4r9 wrote: post #28
zasdffaa wrote: post #23

Earlier quoted context omitted.

Little experience with javadocs, so how do they fall?

Also no experience with javadocs or Java, but in my experience Stackoverflow is a huge productivity boost for a junior dev. For example I wonder if javadocs shows you how to convert an InputStream to a string, as per this question: https://stackoverflow.com/questions/309424/how-do-i-read-con...

I’ve used javadocs plenty, and really like them, but they are organised by package and class, so figuring out how to do something when you don’t know what package to use is very painful. Say you want to know how to delete a file at a given path. I’ve been around the block a few times, so I’ll know that it’ll probably be an operation on java.nio.file.Path, so I can find the Java doc for that, hit “Uses”, and search for “remove” (nothing) and “delete” (ah-hah, there it is).

If you don’t have a starting point like that from prior experience or stackoverflow, you’re stuck clicking around the package lists, hoping to land on something useful

Re: How I learned about corporate firewalls

#47

Post by pilif »

My favourite issue caused by a corporate firewall was when it altered an AJAX request to replace a specific combination of digits (in a long product ID) by asterisks.

Turns out that a substring of that product ID matched the client company's phone number and their security theatre intercepting proxy was replacing all occurrences of "sensitive" strings sent to the internet with asterisks.

The irony is, of course, that as the people running the site, I didn't know (and would never have wanted to know) the user's phone number until this incident.

How I loathe security theatre.

Re: How I learned about corporate firewalls

#49

Post by ballenf »

richbell wrote: post #21
cheschire wrote: post #12

"Aha, so an overzealous IT network decided to block the request before it even reached my server." What classifies this as an "overzealous" act of network configuration? There may be a subjectively legitimate reason the user's network was configured this way. "I had no idea I was ever going to get anything different." There's an entire list of HTTP status codes. That was your clue that you would get something differe…

> What classifies this as an "overzealous" act of network configuration? There may be a subjectively legitimate reason the user's network was configured this way. Worked at a large FI. Our corporate firewall used to block any website or payload that contained the word "hack". At one point, the security team decided to roll out a change that blocked all verbs except GET and POST without telling anyone. I could go on.

And the nearby Burger Shack wondered why their online orders plummeted.

Re: How I learned about corporate firewalls

#50

Post by raxxorraxor »

Neil44 wrote: post #11

Yep not to mention pushing their SSL root CA to all the clients so they can scan everything without SSL errors.

Sensible for the users that really download and execute attachments from the most obvious spam mails. The only protection you have is to put these high threat users in a separate subnet and use some antivirus to scan everything they download. At least that offers some protection. Not possible to scan downloads with TLS.

Although I still think that breaking it up is a very bad idea in general and it is appalling that this became common practice. Especially because there are exceptions where it fails and you train users to just disregard TLS errors.

Even worse, the IT security industry shamelessly uses the data to spy on employees. For that alone it deserves its bad reputation. Still, there is no real solution to shield data from the the most careless users.

Post reply on HN