• Duke of New York (unregistered) in reply to Nagesh
    Nagesh:
    olaf:
    Here some yet unpublished articles to make up for the empty article!

    http://thedailywtf.com/Articles/The-Long-Way.aspx http://thedailywtf.com/Articles/Psychic-Software.aspx http://thedailywtf.com/Articles/Your-Letters-are-Numbered.aspx http://thedailywtf.com/Articles/Social-Insecurity-Number.aspx

    Where are you getting these from?
    The future
  • Cheong (unregistered)

    This one is easy to solve actually, just apply for VB6 installation and you can continue to work without "installing" the program you should produce. (Hint: Interpreters does not need to create EXE file when debugging) Just remember to apply for "installation permission" before the day of deployment.

    Now that's just one good reason for governments to continue using VB.

  • Jeff Grigg (unregistered) in reply to ZoomST
    article:
    "Well, is it malicious?"
    Answer: "No. But it soon will be."

    ;->

  • doug (unregistered)

    Ha... I used to work for a bank and this sounds like it.

  • nobulate (unregistered) in reply to operagost
    operagost:
    So they're going to build a secured environment inside the secured environment? I didn't know you could have the inner platform effect with hardware.

    It is called the Inception Design Pattern. The trick is to keep an infinite while(true) loop running in a separate process, and the moment it falls over you know you have gone too deep.

  • nobulate (unregistered) in reply to Anon
    Anon:
    Protip: Users, also known as "the people to whom you sell and distribute your software," on average, don't know what the fuck a ".jar file" is.

    Two things....

    1. users who don't know technical details can GTFO.

    2. If java supported real garbage collection it would delete itself on first run.

    Carry on.

  • immitto (unregistered)

    I don't think you people grasp the full WTFness of this.

    two computers. One was stuffed in a broom closet down the hall; he used it for email, Internet access, and other administrative items. At his cubicle
    Why on earth would you not put them at least side by side? Do they never have to research something on the internet? Really?
    No Internet connectivity, and login was only possible with an RSA SecurID dongle. The stated purpose was to provide a secure environment for software development.
    That's fair enough. I mean, how else are you going to provide a secure environment when using windows?
    Steven logged a ticket. Within an hour, he was watching an SDE admin reinstall Java for him.
    Wait, so they did not even try to find out what happened? Just reinstall and hope for the best? Well, fair enough, that sounds like "windows admins"...
    Once the admin had unchecked all the predatory toolbar options and got the install going,
    After the first question, why anyone would even try to software development on windows, the second question: Why on earth would you use a proprietary java implementation, especially one from oracle?

    They are just looking for torturing themselves there, aren't they?

    Steven gaped. "That's not what the word 'install' means!"
    What the fuck? Is Steven really going to argue about the semantics of "install"? Why didn't he laugh in the administrators face and tell him that from a security standpoint it makes ZERO difference whether an executable is "installed" or not?
    The whole developer team was forced into numerous interviews with the sort of drones who couldn't hack Accounting or Finance in business school.

    "All we did was develop software in the environment we were provided to develop our software in!" they explained for the umpteenth time.

    What the fuck are they doing there? They should go to exactly one first interview to complain about the managers 1. not understanding their own job. 2. Not understanding their employees' job. 3. keeping their employees from doing their job.

    Unblinking incomprehension. "Why did you install this software on your machines?"
    "Because it is my job to develop this software." And then just walk out. Seriously. If you get fired for it, take it up with a lawyer. You can't possibly lose such a case, can you?
    Steven's team was ordered to keep working, but immediately cease generating any "prohibited files."
    Write a mail to all their managers "Since my job is generating these "prohibited files" I can not do my job as per the policies created by manager XY. I will stay at home until you fix your policies. KTHXBYE". Why would you even try to take it up with them?
    Finally, someone shed light on the real problem: the SDE team's definition of the word "install" was so ambiguous, it covered everything from putting down an SDK to setting an adorable kitten picture as one's desktop background.
    This is not the real problem. The real problem is that the SDE team has no idea how computers and software works.
    as long as all .exe's, .lib's, and other generated files were manually tracked within a shared drive Excel spreadsheet
    Why THE FUCK would you REQUIRE the use of another proprietary microsoft program that is UNFIT for this purpose?

    Maybe it is not that insane to track all the files that the developers create. What is fucking insane is that you are tracking that manually in an application that is not fit for this purpose.

    If you actually wanted to implement their insane policies, you'd take 5 minutes and write shell scripts that maintain a list of generated files in their version control fully automatically.

    the SDE admins were to set up a special "development system" for Steven's team
    Why the fuck did nobody ask them what they *thought* their SDE was supposed to be used for?

    Raise this fucking issue to the managers because it shows that the SDE team clearly has no idea what they are even supposed to do.

    A high-level issue was raised against Cyber Security and the SDE admins to properly define the term "install" and adjust their policies accordingly.
    Why did they not raise another high level issue against cyber security to ask why they think executables that are not "installed" are somehow automatically harmless?

    Why did Steven not complain to everyone who has any sort of power in that company that the SDE team neither understands the technology they work with nor what their job nor what their coworkers' job is and only cause the developers to be less productive?

  • dna (unregistered)

    I had the same kind of problem on my first job. It was on eve of the century, when VoIP was still science fiction.. I worked in 2nd level support, the kind of support that call back users, and stay with him on the phone the time needed for solving problems...

    On day, our boss come to us, and say : "I was in direction commity, and they flamed our service : 7 of 10 of the biggest phone bill come from our service. I'm sorry, i laughed too much to be able to defend you."

    The real WTF... the compagny i worked... was the national (and only at the time) phone compagny...

  • olaf (unregistered) in reply to Duke of New York
    Duke of New York:
    Nagesh:
    olaf:
    Here some yet unpublished articles to make up for the empty article!

    http://thedailywtf.com/Articles/The-Long-Way.aspx http://thedailywtf.com/Articles/Psychic-Software.aspx http://thedailywtf.com/Articles/Your-Letters-are-Numbered.aspx http://thedailywtf.com/Articles/Social-Insecurity-Number.aspx

    Where are you getting these from?
    The future

    I traveled back in time to bring you these!

  • gnasher729 (unregistered) in reply to FreeMarketFan
    FreeMarketFan:
    This screams defense contractor all the way.

    Several years back a co-worker got in a ton of trouble because he/she made a picture of their child their desktop background. Someone from security claimed he/she 'installed' unapproved software and had to remove the photo.

    A story that I was told by a guy who claimed to have witnessed it: Somewhere in the military a hard drive broke down. It contained important data that wasn't backed up, so it needed to be recovered. So they hired a data recovery company. There was the conundrum that the data wasn't only important but also secret, so they needed to make sure the data recovery company couldn't read the secret data. The problem was solved by drilling holes through the hard drive and sending the hard drive with holes to the data recovery company.
  • gnasher729 (unregistered) in reply to ilsatyd
    ilsatyd:
    What keeps software engineers in such places? Hefty salaries?

    It depends. If you don't give shit about anything else than your pay check at the end of the month, I suppose it is an easy job. You'd need to use the time to learn things to keep yourself up-to-date. Buy a MacBook, install some VMs, learn all about iOS, Android, server programming that you didn't know.

  • (cs) in reply to immitto
    immitto:
    I don't think you people grasp the full WTFness of this.
    I'm not sure you do either, not fully, anyway.
    immitto:
    No Internet connectivity, and login was only possible with an RSA SecurID dongle. The stated purpose was to provide a secure environment for software development.
    That's fair enough. I mean, how else are you going to provide a secure environment when using windows?
    It isn't that hard, but of course achieving that would rob you of an opportunity to have a go at Microsoft and its products.
    immitto:
    Steven logged a ticket. Within an hour, he was watching an SDE admin reinstall Java for him.
    Wait, so they did not even try to find out what happened? Just reinstall and hope for the best? Well, fair enough, that sounds like "windows admins"...
    Yeah, confirmed, you're just trolling.
    immitto:
    Once the admin had unchecked all the predatory toolbar options and got the install going,
    After the first question, why anyone would even try to software development on windows, the second question: Why on earth would you use a proprietary java implementation, especially one from oracle?

    They are just looking for torturing themselves there, aren't they?

    And you're some sort of FOSS fanboi as well. Great, just what the world needs, more religious fanatics.

    immitto:
    Steven gaped. "That's not what the word 'install' means!"
    What the fuck? Is Steven really going to argue about the semantics of "install"? Why didn't he laugh in the administrators face and tell him that from a security standpoint it makes ZERO difference whether an executable is "installed" or not?
    Did you really want to suggest that he should deliberately make matters worse for himself? Saying something like this is tantamount to confirming the validity of the misconceptions that drive the SDE admin's statements.
    immitto:
    Unblinking incomprehension. "Why did you install this software on your machines?"
    "Because it is my job to develop this software." And then just walk out. Seriously. If you get fired for it, take it up with a lawyer. You can't possibly lose such a case, can you?
    Of course you can, and probably you would lose, since you walked off the job without taking authorised leave, because that's what they'd sack you for.
    immitto:
    as long as all .exe's, .lib's, and other generated files were manually tracked within a shared drive Excel spreadsheet
    Why THE FUCK would you REQUIRE the use of another proprietary microsoft program that is UNFIT for this purpose?

    Maybe it is not that insane to track all the files that the developers create. What is fucking insane is that you are tracking that manually in an application that is not fit for this purpose.

    Yes, but it doesn't matter who produced the program, nor their business model. Using tools that aren't fit for purpose is never a good idea.

  • Carrie (unregistered) in reply to Shoreline
    Shoreline:
    faoileag:
    nobulate:
    Oh Yeah! Good oll C-x M-c M-butterfly...
    But where on roundworld do you get a quantum weather butterfly?

    You sure have a lot of expectations of a world created by the dean waggling his hand.

    As Above, So Below and all that. If the Dean waggling his hand can create the universe, why's it too much to ask for a butterfly waggling its wings to create weather systems.

  • Consoleo (unregistered) in reply to lettucemode

    Would that company happen to be in Canada ?

    I think I work for them too. Pretty hilarious what they came up with for the glass thing (anyway the video with the mascot was pretty funny until you realize the amount of resource that was put into it).

  • faoileag (unregistered) in reply to anonymous
    anonymous:
    faoileag:
    Coding small games was what kept me up well into the wee hours of the morning at the time because learning how to make the home computer do the things I wanted it to do was way more fun than playing games (just creating strange noises with EACA's Colour Genie three sound channels kept me up for hours).
    Of course, some reasonable restrictions still applied... "as many as you want" didn't ever really quite mean that. Things like mealtime, bedtime, chores or homework still superseded my ability to be on the computer 24x7...
    Mealtimes? Yeah, I must have had those... but what is this homework you are talking about?

    He he he, at one point in art class I was so tired, I fell asleep and slept through the end of class. I was woken up by some guy from the next class coming in and telling me "who are you and why are you sitting on my place?"

  • Guest (unregistered)

    This seems like a good excuse to abuse alternate data streams:

    http://www.undermyhat.org/blog/2012/04/ultimate-guide-manipulating-alternate-data-streams/

  • willaien (unregistered) in reply to nobulate
    nobulate:
    Hey this is great - finally a chance to have a real-life unbiased and coherent discussion!

    So... vi or emacs?

    (covers and runs)

    Pico/Nano, of course.

  • fsckmegently (unregistered) in reply to lettucemode

    I work in one of the most heavily regulated industries in the world.

    So, I'm going to hazard a guess that it has something to do with the word "mobility"? If so, my condolences. Everything in that industry is backwards as fuck. People getting paid shit are the ones that actually have an IQ above 70, where the ones that get paid what the former deserve are absolute idiots that have security sniffing around your cube if they see a terminal window. I have one of those 90s glare/privacy filters on my display for that very reason. I claimed it was to keep shoulder surfers away from sensitive data.

  • (cs) in reply to olaf
    olaf:
    Duke of New York:
    Nagesh:
    olaf:
    Here some yet unpublished articles to make up for the empty article!

    http://thedailywtf.com/Articles/The-Long-Way.aspx http://thedailywtf.com/Articles/Psychic-Software.aspx http://thedailywtf.com/Articles/Your-Letters-are-Numbered.aspx http://thedailywtf.com/Articles/Social-Insecurity-Number.aspx

    Where are you getting these from?
    The future

    I traveled back in time to bring you these!


    So tell me the winning ticket number for Jai Laxmi lottery in Andhra Pradesh. Don't waste time in posting links for unpublish articles.

  • John (unregistered)

    Reminds me of the time when I was asked to sign a modified contract of employment. The amendment was to add a clause stating that I would never supply any software to any of our customers.

    It was at the time when companies were getting much more savvy about the need for proper software licensing, and I knew what it was they had meant to say, but since we were a software development company it was more than a little silly. You can't sign something as badly phrased as that.

    I just refused, and it went away and never came back.

    Captcha: inhibeo - to prevent the proliferation of silly contracts.

  • (cs) in reply to Cheong
    immitto:
    This is not the real problem. The real problem is that the SDE team has no idea how computers and software works.

    Minor correction - those who wrote and approved the SDE policy have no idea how computers and software development works. It was likely a combination of technical and non-technical cyber security employees (though it was approved by the head of cyber security). Somehow, the fact that yes, you can run software without installing it first, and software developers do that kind of thing an awful lot, slipped past all those people.

    Cheong:
    This one is easy to solve actually, just apply for VB6 installation and you can continue to work without "installing" the program you should produce. (Hint: Interpreters does not need to create EXE file when debugging) Just remember to apply for "installation permission" before the day of deployment.

    Now that's just one good reason for governments to continue using VB.

    Under the policy as written, "installing" includes the creation and/or movement of any binary file. God knows what the policy's definition of "binary" is. "If it's not XML, TXT, or if you can't open it with Word, Powerpoint, Adobe Reader, or Excel..."

  • anonymous (unregistered) in reply to Nagesh
    Nagesh:
    olaf:
    Duke of New York:
    Nagesh:
    olaf:
    Here some yet unpublished articles to make up for the empty article!

    http://thedailywtf.com/Articles/The-Long-Way.aspx http://thedailywtf.com/Articles/Psychic-Software.aspx http://thedailywtf.com/Articles/Your-Letters-are-Numbered.aspx http://thedailywtf.com/Articles/Social-Insecurity-Number.aspx

    Where are you getting these from?
    The future

    I traveled back in time to bring you these!


    So tell me the winning ticket number for Jai Laxmi lottery in Andhra Pradesh. Don't waste time in posting links for unpublish articles.
    Everyone knows that when you go to an exotic place you keep all the cool stuff you bring back. Your friends get coffee mugs or t-shirts that say "my friend went to Mecca and all I got was this lousy t-shirt". Random people on the internet get little more than the pleasure of hearing you talk about it.

  • nightwolf (unregistered)

    ahhh, redtape makes the world go 'round (or at least corporate world!)

  • (cs) in reply to Nagesh
    Nagesh:
    olaf:
    I traveled back in time to bring you these!

    So tell me the winning ticket number for Jai Laxmi lottery in Andhra Pradesh. Don't waste time in posting links for unpublish articles.

    How do you think he was able to pay for the time machine in the first place?

  • ZBungalow (unregistered) in reply to lettucemode

    If it were me I would have quit immediately upon being interrogated for doing my job.

  • Jay (unregistered) in reply to Steve The Cynic
    Steve The Cynic:
    TRWTF is this HTML comment in the article source...
    <!-- <b>The End is Nigh! The Daily WTF's OMGWTF2 Contest Ends Today!! </b> - Prizes! Fame! Trophies! Do your worst: <a href="http://omg2.thedailywtf.com/">http://omg2.thedailywtf.com/</a> -->
    According to the cited site, today is 28 June 2013. According to my calendar, phone, computer, etc., today is 16 April 2014. (Well, actually, most of them say that today is 16 avril 2014, but you get the idea, right?)

    You are not authorized access to dates between 29 June 2013 and 15 April 2014.

  • Jay (unregistered) in reply to faoileag
    faoileag:
    This almost sounds too weird to be true. As I said almost.

    But of course "He and his team sat on their thumbs for a day" is TRWTF. There are so many things you can do. Like updating your cv.

    I used to work for the government. This is EXACTLY what we went through every day.

  • (cs) in reply to Steve The Cynic
    Steve The Cynic:
    immitto:
    Unblinking incomprehension. "Why did you install this software on your machines?"
    "Because it is my job to develop this software." And then just walk out. Seriously. If you get fired for it, take it up with a lawyer. You can't possibly lose such a case, can you?
    Of course you can, and probably you would lose, since you walked off the job without taking authorised leave, because that's what they'd sack you for.

    Don't forget that whole "at will" thing

  • Craig (unregistered) in reply to lettucemode

    Windows...? Installers with toolbar options...? And you're calling this security? What the f*ck is this, the twilight zone?

    Giving things big-dick titles with macho sounding acronyms doesn't make their implied descriptions true.

  • GlassGuy (unregistered) in reply to lettucemode

    For a door-sized piece, if it's tempered glass and 5mm or thicker, it's simply not going to break from walking into it. Thinner pieces probably wouldn't break either, but door-sized pieces would be able to bend quite a bit so I would expect that the door is at least 5mm thick.

    I have personally beaten on similarly sized pieces of glass with a metal shovel and had great difficulty breaking them when we were trying to dispose of them. The only way to get it to break is to hit the edge or corner and even that isn't always easy. Glass doors are normally protected by a metal frame and they almost certainly have done edgework to smooth (and possibly shape) any edges which are exposed.

    If, somehow, a tempered glass door did break it would shatter into a million tiny pieces. You might get minor cuts or glass splinters, or get glass into your eyes, but you would not generally be injured. I have personally had similarly sized pieces of glass explode (and yes, tempered glass does explode) when I was carrying them and we hit the corner on something. Granted, I was wearing safety gear at the time, but those only really protect your eyes and hands. You may still have to comb broken glass out of your hair. It's also possible to use plastic instead of actual glass which will not shatter like that.

    So I can't see what they're studying here. Can't they just look up the relevant building codes?

  • (cs) in reply to GlassGuy
    GlassGuy:
    For a door-sized piece, if it's tempered glass and 5mm or thicker, it's simply not going to break from walking into it. Thinner pieces probably wouldn't break either, but door-sized pieces would be able to bend quite a bit so I would expect that the door is at least 5mm thick.

    I have personally beaten on similarly sized pieces of glass with a metal shovel and had great difficulty breaking them when we were trying to dispose of them. The only way to get it to break is to hit the edge or corner and even that isn't always easy. Glass doors are normally protected by a metal frame and they almost certainly have done edgework to smooth (and possibly shape) any edges which are exposed.

    If, somehow, a tempered glass door did break it would shatter into a million tiny pieces. You might get minor cuts or glass splinters, or get glass into your eyes, but you would not generally be injured. I have personally had similarly sized pieces of glass explode (and yes, tempered glass does explode) when I was carrying them and we hit the corner on something. Granted, I was wearing safety gear at the time, but those only really protect your eyes and hands. You may still have to comb broken glass out of your hair. It's also possible to use plastic instead of actual glass which will not shatter like that.

    So I can't see what they're studying here. Can't they just look up the relevant building codes?

    The injury would come from a frail person walking into the glass. The glass wouldn't have to shatter at all, it would just need to have the person bounce off to injure them. Think of an 80 year old walking into a sheet of glass. Probably best to put something on the glass to make it more visible.

  • Grumpy Code Monkey (unregistered) in reply to FreeMarketFan
    FreeMarketFan:
    This screams defense contractor all the way.

    Defense or financial services.

    Worked on a system like that back when I was in the MIC; we had a public network and an internal development network with no outside access. There was a single transfer point where you could move files between networks via physical media (CDs). Thumb drives were verboten; if IT caught you with one they confiscated it immediately.

    We had similar policies wrt admin privileges (developers had none) and all transfers into the dev network had to go through a malicious code review. Fortunately, our IT staff was pretty sharp and understood the nature of the business (that we wrote software), so we didn't have the kind of nonsense that the article describes.

    The main drawback was that both classified and unclassified development took place on the internal network, so all devs had to obtain a clearance.

  • Gunslinger (unregistered)

    The mind boggles.

  • (cs) in reply to cellocgw
    cellocgw:
    bypass the restriction on sending/receiving ".zip" files due to [redacted] idiots' Outlook filters by renaming them ".txt" .

    Our filter has a policy just for that -- Detected file type does not match file extension.

    iWork files give it fits.

  • i❦ssl (unregistered) in reply to immitto
    immitto:
    What the fuck?
    Yes. Daily.
    immitto:
    Unblinking incomprehension. "Why did you install this software on your machines?"
    "Because it is my job to develop this software." And then just walk out. Seriously. If you get fired for it, take it up with a lawyer. You can't possibly lose such a case, can you?
    Yes, you can lose such a case. Partly because you can't afford a lawyer (remember? you've just been fired). Partly because doing your job is a perfectly legal reason for firing you.
  • Dhamp (unregistered)

    Sounds like there was about to be (or had just been) a third-party audit.

    When I was part of a SAP admin team, we had been working with, you know, administrative rights.

    A new auditor from the third party came out, after 10 years of the same one, and told us that we were not permitted to have any access to the systems we were running unless we specifically requested what was needed for each fix, and set a time limit in which to fix it.

    And they made us close our master admin account.

  • anonymous (unregistered) in reply to oheso
    oheso:
    cellocgw:
    bypass the restriction on sending/receiving ".zip" files due to [redacted] idiots' Outlook filters by renaming them ".txt" .

    Our filter has a policy just for that -- Detected file type does not match file extension.

    iWork files give it fits.

    Some file types have no good way to recognise them other than by extension.

  • (cs) in reply to anonymous
    anonymous:
    oheso:
    cellocgw:
    bypass the restriction on sending/receiving ".zip" files due to [redacted] idiots' Outlook filters by renaming them ".txt" .

    Our filter has a policy just for that -- Detected file type does not match file extension.

    iWork files give it fits.

    Some file types have no good way to recognise them other than by extension.

    Hence why a whitelist would be more secure in that case.

    "I have no idea what a .xyz file is, so it's blocked."

  • anonymous (unregistered) in reply to chubertdev
    chubertdev:
    anonymous:
    oheso:
    cellocgw:
    bypass the restriction on sending/receiving ".zip" files due to [redacted] idiots' Outlook filters by renaming them ".txt" .

    Our filter has a policy just for that -- Detected file type does not match file extension.

    iWork files give it fits.

    Some file types have no good way to recognise them other than by extension.

    Hence why a whitelist would be more secure in that case.

    "I have no idea what a .xyz file is, so it's blocked."

    So the point is to find a way to encode a file that would be blocked so that it looks like a file that it recognises. Not an impossible task when you approach it from that angle...

    For example, there are infinitely many different ways that you could encode an arbitrary binary file to make it look like plain text (base-64 being one). The system cannot possibly hope to detect all of them. The main question is how to accomplish this without making it unduly difficult for the recipient to decode the file.

  • (cs) in reply to chubertdev
    chubertdev:

    The injury would come from a frail person walking into the glass. The glass wouldn't have to shatter at all, it would just need to have the person bounce off to injure them. Think of an 80 year old walking into a sheet of glass. Probably best to put something on the glass to make it more visible.

    The person doesn't even have to be frail. A very healthy middle aged coworker of mine walked into a (very clean, thus almost invisible) glass partition once, and he was so disoriented afterwards that some people decided to take him to the doctor to make sure he was OK.

  • Tux "Tuxedo" Penguin (unregistered) in reply to Anon
    Anon:
    Tux "Tuxedo" Penguin:
    ubersoldat:
    no laughing matter:
    They are developing Java applications and build .EXE out of them? This is at least unusual.

    You can build EXE files with the jars inside so you don't have to go the whole "java -jar foo.jar" trouble.

    Funny enough, if they did go through this, they wouldn't have cyberpolice up their butts. Also you can bind .jar files so Java will launch those automatically (judging by article it was Windows machine, so Java installer would do this automatically and on Linux/Mac you can do this via settings of your favorite file manager). Which would go unnoticed as from article we know they didn't know what Java even is.

    Protip: Users, also known as "the people to whom you sell and distribute your software," on average, don't know what the fuck a ".jar file" is.

    PROTIP: Users usually launch their apps via shortcuts in Start Menu, so they don't need to know if link points to jar file or to exe. It'll work either way.

  • Norman Diamond (unregistered) in reply to Tux "Tuxedo" Penguin
    Tux "Tuxedo" Penguin:
    Anon:
    Tux "Tuxedo" Penguin:
    ubersoldat:
    no laughing matter:
    They are developing Java applications and build .EXE out of them? This is at least unusual.
    You can build EXE files with the jars inside so you don't have to go the whole "java -jar foo.jar" trouble.
    Funny enough, if they did go through this, they wouldn't have cyberpolice up their butts. Also you can bind .jar files so Java will launch those automatically (judging by article it was Windows machine, so Java installer would do this automatically and on Linux/Mac you can do this via settings of your favorite file manager). Which would go unnoticed as from article we know they didn't know what Java even is.
    Protip: Users, also known as "the people to whom you sell and distribute your software," on average, don't know what the fuck a ".jar file" is.
    PROTIP: Users usually launch their apps via shortcuts in Start Menu, so they don't need to know if link points to jar file or to exe. It'll work either way.
    PROTIP: Most users don't run Linux, so they don't have a Start Menu.
  • DERP DERPSON (unregistered)

    My school has this in it's IT policy, and I quote:

    Pupils may not download, install or run programs or scripts of any kind on any School computer.

    After a while you realise that you can't even log in - a script will run so you're in violation :P

  • Rob (unregistered)

    Steven, Are you guys hiring? I thought my current company had some weird practices, but through your story I have realized that there are higher planes of weirdness that I cannot hopefully achieve in my current position.

    Alas, my storytelling is the lesser for it.

  • anonymous (unregistered) in reply to Norman Diamond
    Norman Diamond:
    Tux "Tuxedo" Penguin:
    Anon:
    Tux "Tuxedo" Penguin:
    ubersoldat:
    no laughing matter:
    They are developing Java applications and build .EXE out of them? This is at least unusual.
    You can build EXE files with the jars inside so you don't have to go the whole "java -jar foo.jar" trouble.
    Funny enough, if they did go through this, they wouldn't have cyberpolice up their butts. Also you can bind .jar files so Java will launch those automatically (judging by article it was Windows machine, so Java installer would do this automatically and on Linux/Mac you can do this via settings of your favorite file manager). Which would go unnoticed as from article we know they didn't know what Java even is.
    Protip: Users, also known as "the people to whom you sell and distribute your software," on average, don't know what the fuck a ".jar file" is.
    PROTIP: Users usually launch their apps via shortcuts in Start Menu, so they don't need to know if link points to jar file or to exe. It'll work either way.
    PROTIP: Most users don't run Linux, so they don't have a Start Menu.
    Why, did Microsoft release an EOL service pack for Windows XP that removed the Start Menu?
  • (cs) in reply to nasch
    nasch:
    chubertdev:

    The injury would come from a frail person walking into the glass. The glass wouldn't have to shatter at all, it would just need to have the person bounce off to injure them. Think of an 80 year old walking into a sheet of glass. Probably best to put something on the glass to make it more visible.

    The person doesn't even have to be frail. A very healthy middle aged coworker of mine walked into a (very clean, thus almost invisible) glass partition once, and he was so disoriented afterwards that some people decided to take him to the doctor to make sure he was OK.

    Does he play for the Montreal Canadiens?

  • Norman Diamond (unregistered) in reply to anonymous
    anonymous:
    Norman Diamond:
    Tux "Tuxedo" Penguin:
    Anon:
    Tux "Tuxedo" Penguin:
    ubersoldat:
    no laughing matter:
    They are developing Java applications and build .EXE out of them? This is at least unusual.
    You can build EXE files with the jars inside so you don't have to go the whole "java -jar foo.jar" trouble.
    Funny enough, if they did go through this, they wouldn't have cyberpolice up their butts. Also you can bind .jar files so Java will launch those automatically (judging by article it was Windows machine, so Java installer would do this automatically and on Linux/Mac you can do this via settings of your favorite file manager). Which would go unnoticed as from article we know they didn't know what Java even is.
    Protip: Users, also known as "the people to whom you sell and distribute your software," on average, don't know what the fuck a ".jar file" is.
    PROTIP: Users usually launch their apps via shortcuts in Start Menu, so they don't need to know if link points to jar file or to exe. It'll work either way.
    PROTIP: Most users don't run Linux, so they don't have a Start Menu.
    Why, did Microsoft release an EOL service pack for Windows XP that removed the Start Menu?
    Who knows? After all, if you reinstall Windows XP you can't use Windows Update to get SP3 because Windows Update won't work until after SP3 is installed.

    But anyway, you know I was talking about OSes currently on the market. Windows Server 2012 R2 doesn't have a Start Menu. Neither does Me 3 (the successor of Me Too (which was the successor of Me (which no one even remembers when making lists of Microsoft's usable OSes such as Windows NT4 SP3, Windows 2000, Windows XP SP2 and SP3, alternating with pieces of crap that no one even knows why they existed))).

  • Reductio Ad Ridiculousum (unregistered) in reply to faoileag
    faoileag:
    This almost sounds too weird to be true. As I said almost.

    But of course "He and his team sat on their thumbs for a day" is TRWTF. There are so many things you can do. Like updating your cv.

    No, no, you got it wrong. Not your fault, of course, just an American idiom.

    "Sitting around on their thumbs all day" actually means "updating their resumes and installing it to their thumb drives".

  • (cs) in reply to VictorSierraGolf
    VictorSierraGolf:
    dtech:
    ObiWayneKenobi:
    nobulate:
    ObiWayneKenobi:
    nobulate:
    Hey this is great - finally a chance to have a real-life unbiased and coherent discussion!

    So... vi or emacs?

    (covers and runs)

    Sublime
    Oh no you didn't! I see your sublime and raise you a notepad.
    Notepad? Watch out guys, we're dealing with a badass over here...
    Psssh, everyone knows real programmers just directly make their executables with a hex editor.
    echo and >>. Are you guys even trying?
    C:> COPY CON STUFF.EXE
    or 
    bash$ cat >> stuff ; chmod +x stuff

  • Ol' Bob (unregistered) in reply to lettucemode
    lettucemode:
    Hey all, Steven here.
    steenbergh:
    So they're getting a separate development environment WITHIN the separate development environment?

    This article was made possible by the department of redundancy department.

    Sort of. This new development environment will be connected to the SDE network, and we'll be able to remote into it to do our work. We'll also appoint our own admin for this environment who will install and approve software. So basically, the admins of the actual SDE network will never have to do any work ever again.

    MrBester:
    A few days later, Steven's entire team received an email stating they were in violation of Cyber Security policy for installing "malicious, unapproved" software on their SDE machines. The message ended with a sinister promise: Disciplinary actions are forthcoming.

    TRWTF is that Steven and his entire team didn't respond to this email with "Fuck off".

    Another is that the entire team didn't walk out of the interviews.

    I work in one of the most heavily regulated industries in the world. As a result it is policies and procedures first, code and common sense second. And it has to be that way, otherwise the government will shut us down. One guy walked into a sliding glass door before it fully opened at one of our sites, and now some departments in the company are spending a lot of time and money doing safety evaluations on all things glass instead of writing it off as idiocy. You can see why telling the head of cyber security to fuck off in this environment would accomplish nothing. Luckily my project manager has a good head on his shoulders and got the situation taken care of, more or less.

    Spezialpfusch (too lazy to log in):
    Provided that their developped software somehow served the company's purpose, it would be sufficient if the developers told the bosses that SDE administration is impeding revenues.

    That we did, which is how we got cyber security to issue us an "exception" which runs out in about a month, and there's still no sign of that separate system we were promised, so this whole thing will likely kick off again. Whee!

    Do the letters 'N', 'O', and 'G' have any relation to this issue?

    CAPTCHA: acsi - our computer don' use EBCDIC, it use ACSI.

Leave a comment on “Secure Development”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article