Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I learned about corporate firewalls

valcanbuild.tech

Post reply on HN
Print view View original

81–90 of 204 posts

Re: How I learned about corporate firewalls

#81

Post by happimess »

P5fRxh5kUvp2th wrote: post #62
hyperman1 wrote: post #4

We once had to fight for stackoverflow access. Security responds: you devs should only require the manual provided by the vendor(in this case: Oracle javadocs)?

I was recently told by an old-timer at my current company that at one point security tried to remove Visual Studio from developers machines because it had reported security incidents. The problem with security people is that they think security is the most important thing.

The most secure option is to bury everyone's computer in concrete.

Re: How I learned about corporate firewalls

#82

Post by jjoonathan »

huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

The #1 value proposition of the cloud is escaping dogshit expense processes and the #2 value proposition of the cloud is escaping dogshit IT.

Re: How I learned about corporate firewalls

#83

Post by Karunamon »

bombcar wrote: post #72
huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

That first one indicates something is being injected and the checksums are failing, that's ... worrying. Or npm and pip use their own certificate stacks and refuse the firewall's cert, which is ... good I guess.

I would be willing to bet the first one is caused more by those tools not being aware of the firewall appliance CA rather than failing checksums. Doing your own certificates at scale is a pain in the ass because every tool/container has its own way of handling the trusted list.

Re: How I learned about corporate firewalls

#84

Post by jwolfe »

adev_ wrote: post #77
jjoonathan wrote: post #18

Earlier quoted context omitted.

There's a subjectively legitimate reason to consider blocking POST (but not GET) requests ruder things than "overzealous."

> There's a subjectively legitimate reason to consider blocking POST (but not GET) No, just no. In a world where many website use GraphQL (POST request with content) (or gRPC) that's complete garbage decision. - This kind of brain-dead admin decision is exactly what bring protocol abuse: people would just use GET query with a ton of parameters and violate semantic just to avoid stupid middle box problems. Same goes w…

The rest of the sentence that you left off in your quote is saying that blocking POST requests is worse than overzealous. You are in agreement with them.

Re: How I learned about corporate firewalls

#85

Post by deepsun »

pilif wrote: post #47

My favourite issue caused by a corporate firewall was when it altered an AJAX request to replace a specific combination of digits (in a long product ID) by asterisks. Turns out that a substring of that product ID matched the client company's phone number and their security theatre intercepting proxy was replacing all occurrences of "sensitive" strings sent to the internet with asterisks. The irony is, of course, that…

Now the other site knows the phone number (they know what was sent, and they see what was replaced by asterisks).

And now they can exfiltrate all the sensitive phone numbers -- just sending clients (you) long strings of numbers, and see what was replaced.

Re: How I learned about corporate firewalls

#86

Post by raxxorraxor »

huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

> They ban all non-Chrome browsers from being installed.

There are portable apps for other browsers, Firefox for example. FF has its own certificate store that overwhelms IT.

about:config -> security.enterprise_roots.enabled and it uses the system store.

Overall Firefox is a very good browser to configure for different machines. The out of the box Chrome or Edge are just a bit more forgiving to MITM attacks. So the user doesn't notice perhaps? Aside from that they are horrible browsers with horrible priorities.

Re: How I learned about corporate firewalls

#87

Post by thayne »

bombcar wrote: post #72
huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

That first one indicates something is being injected and the checksums are failing, that's ... worrying. Or npm and pip use their own certificate stacks and refuse the firewall's cert, which is ... good I guess.

> Or npm and pip use their own certificate stacks and refuse the firewall's cert, which is ... good I guess.

Combined with the fact that chrome is the only allowed browser, I suspect it is the other way around. Chrome uses its own certificate stack, and I would guess IT only added the MITM certificate to the chrome trusted CA list, not the system one.

Re: How I learned about corporate firewalls

#88

Post by dspillett »

huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

> IT absolutely doesn't give a flying ** about developers.

They are not paid to. Their performance is judged against how close they get to zero compliance issues, not how close they get to zero times developers were unhappy!

> I think they're preventing people from hiding their internet browsing.

Without delving into the “do you have the right to privacy even on a company machine”, who would be daft enough to do something they want to hide from the company on a company machine, or the company network at all? Though there are valid useful uses of pron^H^H^H^Hicognito mode so it seems silly to ban it.

Re: How I learned about corporate firewalls

#89

Post by dspillett »

thaeli wrote: post #74
huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

Why are they allowing you to run npm, pip, etc from public repositories at all? That's a huge supply chain risk. If builds are worth doing on prem they also need to be pulling solely from internal, vetted repositories.

> Why are they allowing you to

Maybe “you shouldn't be doing that anyway” is a key part of why they don't care to spend effort resolving the problem.

Re: How I learned about corporate firewalls

#90

Post by deepsun »

huy-nguyen wrote: post #64

I work at a government agency and here are my tales. 1) They install a root certificate on all machines and use that to MITM all TLS connections using a firewall appliance. They turn this MITM on one day without notifying any developer. Overnight, all our builds (run on-prem) fail because npm install, pip install etc fail and we spent a long time trying to figure it out. They are still failing to this day and I have…

Well, if we're talking about security, their ban on NPM is a good thing, that's a huge supply chain risk.

If you don't have a budget for the vetted repositories, it means you don't have a budget for the project within the security requirements. You shouldn't be circumventing the security requirements, you should escalate the issue.

PS: of course I'm not talking about other things like MITM certs, that only reduces security.

Post reply on HN