Places I worked in the early years barely had an IT department at all. As a developer you were expected to be able to maintain your machine. We'd install whatever we want, experiment with different operating systems, etc. Total free rein, box was our tool to get work done with, they didn't care how you did it.
That went away a long time ago. Basic corporate spyware and rules came pretty early but still free rein over our tools.
I've worked with the same company for close to a decade now, and they have been tightening and tightening the noose slowly but surely. We're purportedly a software company, but we lost admin rights, installable software went from a blocklist to an allowlist. Everything we install needs to get approved by IT, and that approval takes weeks.
Today they took our Chrome extensions away. They've got an allowlist of about 15 extensions we can install. Everything I submitted for approval got rejected.
I'm frustrated with this arrangement and am wondering how standard this is these days in this industry?
So I'm genuinely curious, Hacker News: How big of a company do you work for, what industry, and how locked down is your machine?
On the rest I rather agree with you. General-purpose computers are key tools over which users should be admin. Sysadmins provide a security backstop. Full lock down is the sign of an unhealthy understanding of how the org’s value is actually created.
- Force disables the firewall.
- Disables SSH key auth.
- Disables Touch ID.
- Disables FileVault.
- Disables software updates. I'm not sure if this is on purpose or the policy is broken. I get different answers, depending on who I ask.
- Sets up a service account with a weak password (cartoon character name plus two digit number)
- Removes admin for us
- Sets the wi-fi interface as the preferred interface, even if using ethernet.
- Gives full-time admin to the level 1 help desk staff despite our computers having boatloads of confidential data.
When it was Intel Macs, I had a secret exploit to disable the forced MDM that I kept secret as hell, but with the introduction of Apple Silicon Macs, that exploit went away.
No, none of this is a joke.
Most of this is because of the strict compliance requirements our security team enforces on us. But some of it is done because we dont know how to implement the stuff in a way that is strict but lenient. Mac is way better because we dont have as much invasive tooling that supports it.
Linux & macOS people have zero support (outside hardware, corp VPN) and the password to the local admin account (thankfully Jamf does not reset sudoers file)
As more developers/operators opt for Linux or macOS I'm surprised support hasn't been expanded.
We were an open macOS shop acquired by major locked down Windows using corporation. Started with nothing, slowly Jamf -> Intune -> Intense Corporate MDM Controls.
At MegaCorp, there is a never ending arms race between security/compliance teams locking things down, adding approval and surveillance checks, and everyone else just trying to do their job.
Usually there are workarounds and backdoors available to people in the know. If you kick up a fuss, you'll be seen as "difficult". A key part of the job is finding tricks to get things done _despite_ all of the rules / checks in place trying to protect you from yourself.
Machine not locked down at all, I could install OS/2 and nobody would care.
Extensions are full of malware of various sorts, so it makes sense that they take them away. Allow list vs. block list makes sense as a block list is impractical to maintain.
Only thing you can do is complain to management and prove with real #s how this is impacting productivity.
But if you're a webdev, it's super unlikely today that you need local admin and cannot work within an allow list of applications. If you're a driver dev, sure I can see how it might be a blocker.
Worth noting this absolutely impacted usability and stability to a massive degree. The machine ran far hotter to the touch than my personal (equivalent model) MBP, and would make it maybe a month of uptime before it failed to wake from sleep/kernel panic'd/locked up the desktop.
Most other typical desktop software was "vended" via internal software "store" thing (managed browsers, etc), but I could, and did, install various extensions on Firefox (internal Wikis even encouraged using Tampermoney (or whatever the successor is called now) like UBO/Sideberry etc.
Current employer issued machine is a Windows laptop with no admin and basically locked-down.
Even getting something like Docker installed/WSL configured is a whole episode in frustration.
The huge positive is this Enterprise-whatever version of Windows has minimal slop--no CoPilot things or ads in the start menu/lockscreen, but I can't even change the desktop wallpaper. Also, the CPU idles at basically 40% utilization with the various agent things/endpoint security running. For any sort of local development, I largely "sidestep" things by running whatever I need in containers/WSL, so it's really not a huge problem. There's minimal Windows-specific use outside of Teams/Outlook whatever.
Enjoy being crippled and use the time to be mediocre and just collect checks.