IT guy here, if we gave developers the option to exclude whatever the hell they wanted from AV scanning it would just mean that we would end up with computers where the entire C: drive would be excluded.
No, can’t have that.
So what should a decent IT department do to give developers the access they need to do their job while maintaining a decent level of security?
Well, the least bad solution I have worked with was to have a non generic path that was excluded by policy.
Something like C:\Excluded
The directory was excluded from AV scan and allowed in policy, the user could put what they needed there and it would be fine.
So what should a decent IT department do to give developers the access they need to do their job while maintaining a decent level of security?
Give them a Linux machine?
This doesn’t remove security and compliance requirements for the business though. For our Linux endpoints we still deploy an AV on them and limit the user’s ability to add exclusions.
A machine that takes extra time and skills to manage?
As someone who does exactly that right now. Yes.
You need a Linux machine in a separate network with separate firewall rules and the developer has to devote a bit of their time to managing that machine.
It can even be centrally managed, if you have the capacity.But why would you want that? To secure your shit while allowing the devs to to what they like to their equipment.
In an ideal world I agree with you, but when resources are limited, running a separate environment is not allways realistic.
^ this
As an example of scale, my company has an entire IT team of a handful of people for managing such an environment for a thousand or so devs and engineers.
My past role was a combined role of these:
Helpdesk technician
VIP technician
Linux system administratorWe didn’t effectively administrate the Linux environment, I was the only linux admin at the company, and I wasn’t even doing it full time.
I appreciate you trying to keep your developers productive. Deeply appreciate the concern.
Your user base must be better than mine.
Some chucklefuck over a decade ago caved to the “need” for a public shared drive. I can see the argument for things like HR policy documents and such. But they didn’t just give all users read access. Oh no, everyone got full read write. No fucking governance model, no process to check that PII wasn’t being stored there by people too lazy to follow proper procedure.
Thankfully that horror has been thoroughly killed, and MS Teams makes it so easy for people to spin up collab spaces and file storage that there’s no use case anymore.
At our place it’s the IT guys trying to tell us to exclude the entire Downloads folder. One of our devs had to put her foot down and say no, we’d do something more sensible/limited instead!
That deserves a slap
Ah, that time when my job required me to write an executable scanner, and all the AVs got jealous I was honing in on their turf.
AV running in kernel mode charges its CPU cycles to the process being monitored, instead of the AV doing the monitoring.
I got a whole bunch of “your program is slow” support tickets which were resolved by telling the client to follow the AV exclusion instructions.
Took me way to long to notice I was accidentally reading “charges” as “changes”. Now I finally got what you were saying.
“Will I have root on my dev machine” is on my list of interview questions, now.
Asking questions like that can cause hiring managers like myself to have no choice but to offer you higher pay grades, because that question is a strong signal of experience.
Experience shows that you still force me to use WSL, because you want to develop your stupid app in the same setup as the Windows store version and i have to fix the not-so-much cross-platform monster of three people before me who never heard of technical debt.
Absolutely.
My environment sucks almost as much as the next one. It just pays better and we get to be angry at difficult real problems caused by the previous people, instead of stupid self-inflicted problems caused by our own shortsightedness.
Edit: I mean, there’s still some problems caused by our own shortsightedness, obviously.
And technically I didn’t say you would like my answer, just that I’ll pay more because you asked. Lol.
Probably is for me too. This is something I’ve taken for granted as I work for a small company and I am the IT admin…and development team lead, I wear lots of hats. Not the owner though, basically like a CTO+.
Corporate antivirus is so great that it restricts windows update while not connected to the main network by ethernet.
Some of us are there once a month.
Last windows update broke it, and now nobody can update.
It also bring 5 seconds of load time to any website
You could, and I’m just spitballing here, start sending your compiled executables to the anti-virus provider and only continuing work once they’ve been added to the upstream exceptions. Bonus points for compiling hundreds and sending them all. Do that for a day or two and there is sure to be a number of communications many levels above you.
If executed perfectly and all goes well, you’ll get your exceptions access.
Worst case… uh. Maybe this isn’t such a good idea after all.
Because too many developers don’t understand cybersecurity.
As is obvious from some of these comments here.
Whats next, you want domain admin access to every computer/server you touch as well?
Nah, sudo is fine. I can create users without touching the domain stuff. 🙃
you want domain admin access to every computer/server you touch as well?
Heh. I’ve had it. It’s not all it’s cracked up to be. And I didn’t even get one of those humorous “all I got was this lousy T-shirt” shirts.
What they don’t understand is their own machine can get compromised, and in turn compromise their accesses and other infrastructure in a pivot attack.
Developers tend to have quite a lot of access, and some can even deploy to production. At my company, the dev workstations are even more locked down than the regular users’ computers for that reason, they can’t even leave the province.
I hate blanket generalization. You know when you get to that point that your company is over managed and understaffed, not creating a good work environment.
I also suspect it hangs Firefox’s network stack while it does its initial scan after each boot. Chrome does not have this issue.
Same. It is after all their own time they are wasting, so whatever. I get paid either way.
