Ask HN: Do you have sudo on your company-issued machine?
I'm wondering if people have infosec restrictions about sudo access for their work machines.
11 comments
megacorp; laptops have much enterprise security & surveillance bloatware installed. whirrr, such cpu fan, very compliance. by default no one has local admin rights for their work laptop. developers are approved local admin rights upon request.
once blessed with local admin rights, developers manually invoke a utility to grant themselves temporary admin permission for a limited time period each time they wish to sudo. this sounds worse than it is in practice, provided one doesn't need to sudo continually.
once blessed with local admin rights, developers manually invoke a utility to grant themselves temporary admin permission for a limited time period each time they wish to sudo. this sounds worse than it is in practice, provided one doesn't need to sudo continually.
I won't work anymore for a company than ask me to work without being able to install the tools I need to work.
Current work sent tech employees a blank computer and any licenses we ask. So basically, you'll have sudo if you install it.
On the other hand, we are often reminded to upgrade our stack / to check if we have been compromised, etc.
Current work sent tech employees a blank computer and any licenses we ask. So basically, you'll have sudo if you install it.
On the other hand, we are often reminded to upgrade our stack / to check if we have been compromised, etc.
At my current employer they have mobile device management and corporate "security" software installed. It appears to do full network monitoring / event capture. Performance on the machine is terrible due to all the resulting overhead. Recently several devs have complained and had it disabled. We all do have sudo.
Regardless: as a software employer, I'd currently treat any contributor device as loaded with malware, under surveillance, potentially hostile, and with the possibility that it will reside on competitor networks in future.
Ultimately most of the contributions I'm looking for are plaintext and reviewable -- none of the above properties should be blockers, so the way to maximize contributions is to allow for all of them.
Ultimately most of the contributions I'm looking for are plaintext and reviewable -- none of the above properties should be blockers, so the way to maximize contributions is to allow for all of them.
I have a managed Windows machine I used at work that I wouldn't normally have Administrator access to but I do because I am a software dev.
I would add to that, if yes does the company allow and test for passwordless sudo? Reason being that passwordless sudo + ssh multiplexing makes bypassing 2FA/MFA via phishing a breeze.
One can test this in scripts with
One can test this in scripts with
sudo -nMy current work laptop is self managed, so yes. My previous was a locked down Mac and I don't think I had full admin. Before that I did have root on both my desktop and laptop.
I do yes, and I can't really imagine being able to do my job without it.
We are encouraged to install Spotify and Steam during the first week :)
Yes. My last few jobs, developers get full admin/root access to their personal machines.
Yes