Had that discussion before. Was attacked because I use a f&os lib from GitHub instead of a paid and licensed one, the latter somehow meaning it’s error free. Spoiler alert: it wasn’t. Or at least their usage wasn’t.
This has nothing to do with security, and everything to do with liability.
You can’t really sue an open source project using a proper license, they disclaim any liability or warranty, meaning the buck stops with you.
If you hire a software development firm and pay for them to build software for you, you will have a different license, the software company can just repackage open source software into their own UI and branding, take the money and declare bankruptcy if their customers try to sue them.
The customers are mostly happy, they get to tick the box that they have a support contract for the software and a company is liable if shit hits the fan. The software development company is happy, they get money for doing very little actual work.
The open source project probably doesn’t know about the abuse of the license and thus mostly doesn’t care.
I’ve been in these meetings and you’re on the money. Insurance (the concept, not necessarily the product) is almost always the reason any time you see some stupid policy.
When I was young and naive I thought the technologically correct way to do things was the best. In the business world that’s seldom the case, though.
At one place I worked we couldn’t use eclipse licensed things because the license mentioned indemnification or something. I don’t really understand what that meant because I think some other licenses mentioned it too. Plus literally all of us used Eclipse IDE.
My org told me “you can’t install open source software”
Everyone uses Firefox
I just want OpenShell
Honestly, a policy of “no free-of-charge software installed on workstations except FOSS” might improve security a bit and probably without doing all that much damage to the day-to-day workings of the company.
For that matter, if my employer instituted a policy of “no software except FOSS”, my own particular job probably would be a surprisingly small adjustment. As long as they were willing to do the work to set up infrastructure and/or let us switch to FOSS alternatives that require third-party server providers as necessary. About all I can think of that’s installed on my work machine that’s proprietary is:
- Zoom
- A paid corporate VPN client
- A random program that I use to authenticate to Kubernetes clusters in use where I work (so I can use Kubectl)
- Chrome
- The Client Management software my company uses (the software they use to remotely administrate the company-provided machines – force install shit without telling you, spy on you, nag people who have computers that aren’t actually used to return them, wipe your computer if you report it stolen, etc)
- And, of course, bios, proprietary firmware blobs, etc
Beyond that, I honestly can’t think specifically of anything else proprietary installed on my work machine. My personal computers have far less proprietary software installed than the above list.
Not related, but did you ever use k9s? Quite nifty CLI tool to control Kube, albeit not on a very advanced level, it helped me a lot to not get drowned in Kube commands.
Every day I wake up I thank God I’m not an MBA 🙏
Sometimes I wish I was a piece of shit so I didn’t need to worry about money.
MBAs would just buy an LLM software subscription to fix it
“This fucking paycheck! What am I going to do with all this money?”
this is supposed to be more secure because it costs money
It makes blaming someone really easy though and that’s all that matters in a corporate world.
This is legitimately it. The same reason corporations often pay for Linux (e.g. RHEL)—the people in charge want to be able to pick up a phone and harass someone until they fix their problem. They simply can’t fathom any alternative approach to managing dependencies.
Not just pick up the phone and harass someone but to also have someone to press a lawsuit against if things go really wrong. With free software the liability typically ends at the user which means all they can do is fire the employee and eat the loss. Suppose now corporate paid for it, well now there is a contract and a party that can be sued.
As if the Eulas don’t make it all arbitration?
What software company allows liability for mistakes in a EULA?
Companies and individuals play by different rules.
When a big company purchases software a team of people from both parties (whose entire job and career are based on doing this) negotiate with each other to decide exactly who is liable for what and to what degree.
When you purchase software you agree to let the company fuck you over at their leisure because you literally do not have enough hours in the day to even read everything you agree to, let alone understand it, let alone argue with it. And even if you did you don’t have enough bargaining power to make a large company care.
Most do, but limited to the amount of the contract.
I hear that a lot but would that actually work? Sure, you will get a redhat level 1 support employee within the hour for a severity 1 ticket. But does the actual contract (which I don’t have access to) make any legally binding guarantees regarding the time-to-resolution? I seriously doubt it. Which is to say – your legal team will be SOL.
They also won’t take responsibility for any fuckup on your part if you install a bad driver or deviate from the admin guides in anyway (which is why Legal says for a minor issue you can’t apply a patch from StackExchange, you must raise a ticket and wait 3 business days for RedHat to tell you to apply the patch from StackExchange).
Getting phished definitely falls in this category BTW. Vendors may or may not help you but they certainly won’t accept any liability.It’s still a good enough safety net to have for corporations with no trustworthy in-house expertise as vendors do have an incentive to keep their customers happy and most will help to the best of their abilities (which often isn’t as much as one might think…), but it’s hardly a legal panacea. If you need guarantees against catastrophic financial losses, that is what insurance is for.
The greentext reminds me of this FAQ entry: https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-vendor
A.9.17 As one of our existing software vendors, can you just fill in this questionnaire for us?
We periodically receive requests like this, from organisations which have apparently sent out a form letter to everyone listed in their big spreadsheet of ‘software vendors’ requiring them all to answer some long list of questions […]
We don’t make a habit of responding in full to these questionnaires, because we are not a software vendor.
A software vendor is a company to which you are paying lots of money in return for some software. They know who you are, and they know you’re paying them money; so they have an incentive to fill in your forms and questionnaires […] because they want to keep being paid.
[…]
If you work for an organisation which you think might be at risk of making this mistake, we urge you to reorganise your list of software suppliers so that it clearly distinguishes paid vendors who know about you from free software developers who don’t have any idea who you are. Then, only send out these mass mailings to the former.
I read only part of the URL and thought this was about puzzles. Never knew the guy made Putty as well
So corporations are just The Gang in It’s Always Sunny In Philadelphia?
Would be really funny if they still get fucked over because of some fine print in the disclaimer
Or maybe the vendor goes with “take the money and run”.
It’s “more secure” because there’s a specific company to blame when it goes wrong.
That would make some sense if the company was purchasing a solution, not a tool. Or a contract/SaaS model or something. Instead, it’s like banning known screwdriver brands and expecting people to still have no problem loosening and tightening screws…
Security through liability
The bigger you get the more this is a thing actually.
Sure but what if they have “we can at best refund you, no more liability from us” in the EULA?
Like, when the $10 “Yeblie PDF Censorship Tool” turns out to just have drawn a black rectangle and kept the CEO’s SSN underneath copiable, what’s stopping Yeblie from just forking over the $10 (and perhaps rebranding to Gtriik for good measure)?
Yeah, i worked briefly at multinational japanese motor company and this was their logic. I was hired as a software developer contractor and HQ had rules stating, no open source software, no free software and the one that puzzled me the most no in house executables (WHY THE FUCK DID THEY HIRE ME?)
How were you supposed to test your software if you weren’t allowed to create an executable?
You had to go to the balcony to test it.
insert thats the neat part meme
Eventually it was decided I would write Javascript on a web page I made. Skills I never declaired having I told them I was a java dev.
So they essentially hired you for no reason and then had to come up with something for you to do?
It’s more common than you think.
Yeah, I really don’t understand why they hired me. It was a contract role and they ended it early once they ran out of things for me to do. Last day I drove home laughing the way home I was so fucking happy to leave that place.
They really sucked afterwards though since they wouldn’t even say if I worked there or not while I was job hunting, so I spent the next few months unemployeed.
Javascript is a part of Java, duh!
I literally had the “Java is to javascript as car is to carpet” conversation with my dickhead boss. He didn’t get it and I had to explain to him that you don’t drive a carpet to work.
Maybe your boss was from the middle east and didn’t understand your point…
Honda?
Nope.
My old boss called that “one neck to choke”.
Everyday my misnathropy is justified
I majored in Anthropology in college. I should have done Misanthropology.
You did; just need to apply it.
I’ll try that. Fuck you.
They grow up so fast sheds tear
Print the fucking t-shirt man. I’ll buy one for every day of the week.
It’s not more secure, it’s so they can offload blame and have people to sue if/when something ugly happens. Liability control, essentially.
We had to pay for fucking Docker container licenses at my last job because we needed an escalation to the vendor in case our SMEs couldnt handle things (they could), and so we had a vendor to blame if something out of our control happened. And that happened: we sued Mirantis when shit broke.
Hey PS: search engines do return a result for a suit against that company so potential self-doxxing territory (but maybe you’re open in your comment history IDK)
(Don’t have a PACER login so couldn’t tell what was up with the suit that came back when I checked this morn, also could’ve been an unrelated suit)
Ever hear how the suit turned out, generally?
There is an entire sub-industry and probably thousands of jobs being propped up by this stupid way of thinking about software. I can’t be mad at it because it pays the bills for a few of my friends…
I could really see companies just fork open source and give it a tweak like UI or new switches…
Terrible.
At one point my company made us buy Eclipse from a vendor because free software was not allowed. It had no tweaks or support, just out of date Eclipse that I had to wait for purchasing to get
Whenever I hear about shit like this I wonder if I should just start a company and package free software lol. Could like donate a bunch of the profit to the actual projects.
The issue here is you’d be selling it to morons who, when shit inevitably happens, would sue your pants off. So that means having lawyers that can protect you, probably on staff. Not sure it’s worth it. You’d need to do the maths I guess
Now I wonder if one could pull a scam by selling some packaged software and closing the company the next month, simultaneously announcing End of Support
I could really see companies just fork open source and give it a tweak like UI or new switches…
They should not be able to do that if it comes under non commercial licence
Won’t stop some people.
There is famously little money in open source those projects can spend on legal battles
New wealth redistribution method?
deleted by creator
Worked for a company that had a similar policy against free software, but simultaneously encouraged employees to use open-source software to save money. I don’t think upper management was talking to the IT department.
My last boss got rid of the pfSense routers because “open source is not secure”. I argued that pfSense has been vetted over and over and over again. Nope. “Everyone can see the source code.” That’s the fucking point!
TBF, pfSense isn’t the fastest routing, but at our small company is was more than sufficient.
For a small to medium sized business pfsense is the only solution that makes sense. The only requirement is that you have a actual sysadmin on staff and not a vendor jockey.
OPNsense is also a viable alternative.
Sure, I’ve tried it but honestly there wasn’t much difference. I use pfsense because its what I started with. I imagine if you started with opnsense it would be the same thing. I use pfsense+ licensing for all the routers at work and that makes the higher ups happy that its has commercial support if needed.
Tried that for awhile at home, just didn’t seem as robust. Also, you can get Netgate hardware if the company doesn’t want a 10-yo Dell running the edge.
Bought some of the higher end negate routers for work. 1u rack mount. Five locations all linked with fail over tunnels. I run our filter and monitoring on them as well . Pfblockng works great for general purpose filtering. When you filter porn you really need a lot of ram. The intel boards they have are a little finicky on the type of SFP you can install but other than that they work great.
Running a 1U work gave me! Haven’t messed with it much, just works.
I’ve had opnsense running for 7 years without a single issue. It might be the most reliable part of my whole setup.
Don’t forget your new 32 character/symbol/number/nordic rune passwords that will need to be changed every 17 days.
Oh you gonna love those new directives for SSL certificates we got cooking!
I hate sites that make me constantly change passwords. it’s been shown time and time again that making users change passwords often decreases security by a pretty large factor, and yet a lot of sites still do it
Our workplace did that. You had to change every month and you weren’t allowed to just add a digit. It meant that people started writing their passwords on post-its stuck to the monitor.
Mind you, back in the 90s your password was the same as your username. It was very handy, because if someone went home leaving a document locked, you could just log in and unlock it. Our first “proper” IT professional was horrified.
Interesting, stopped seeing this a while back. Forced change after the inevitable hack though of course
Could be because OWASP now actively recommends against periodic password changes.
Ensure credential rotation when a password leak occurs, at the time of compromise identification or when authenticator technology changes. Avoid requiring periodic password changes; instead, encourage users to pick strong passwords and enable Multifactor Authentication Cheat Sheet (MFA). According to NIST guidelines, verifiers should not mandate arbitrary password changes (e.g., periodically).
And don’t forget required 2-factor authentication, in an age where that becomes 1-factor authentication as soon as someone has your phone, because both factors are accessible there!
2FA is utterly worthless in the age of smartphones, and whenever my employer tries to implement it, I refuse and tell them that, if they want me to do 2FA, they can either provide me with a work phone, or they can give me a USB key that is just going to sit in my desk drawer.
There are other ways to 2FA, such as having a physical key on yourself /srs
Hence why I tell my employers that I’m good with h That option (see the last bit of the comment to which you replied) the problem is that this method of 2FA is not implemented commonly, and so most systems I’ve encountered bug out when trying to set it up.
which still requires someone to swipe the phone and the owner not recognizing it long enough to do a remote wipe. I am not someone who hangs on the smartphone 8 hours per day, and even i would realize my phone is gone within 15 - 30 minutes, giving an attacker a pretty small time window to act.
e: and they have to break into the phone as well - if it’s updated, that might buy more than enough time
My previous employer was bought by a huge company. I liked it in the small company, because I had freedom to do what was needed without much questions, and I was trusted to make the relevant decisions and purchases. Kind of a “Costs be damned, get it done in a reasonable amount of time” kind of arrangement.
When we came under the big corpo, we got an email instructing us to list all the software we used/needed, so that it could be added to the whitelist that big corpo worked with. Anything not in the whitelist simply couldn’t run.
I gave them the list, but spoke to my on-shore It guy that out in the field we often needed to install something that we didn’t need before on short notice, and waiting for a ticket to be resolved for an administrative matter had the potential to stop production.
They found it easier just to make an exception for my work PC. I just had to promise not to VPN in to the office while running “weird” stuff, otherwise the higher ups would get upset.
That’s fine. I had my own VPN for only the stuff I needed anyway. I VPNed into offshore production systems on a daily basis. I needed to VPN I to the office once or twice. Plus in my book, the “main” VPN client is what I consider weird software. My shit was basically a wrapper around openvpn.
EDIT: To be fair, the huge corpo employer wasn’t unreasonable. It was just so large with so many employees that strct security implementations were needed for IT to have some sort of control. I was technically also IT, but I only dealt with field equipment, so that IT could focus on “normal” stuff. They trusted me to handle my end, they handled theirs, and we usually cooperated fairly well when our systems “met”.
“we need this NOW”
> Package I install is immediately black listed by IT, I submit a high priority ticket and I don’t hear from them for days, maybe weeks
Like what the fuck can I do
“Yes, but does one of the existing whitelisted executables fulfill the same function?”
“Have you tried using MS Excel instead?”
*Looks at industrial robotics with a proprietary TPU that needs a firmware update.*
“Yes”
Anon works for my company? Because they did exactly this with the same excuse.
Yeesh. I would find a new job immediately. Absolutely unhinged behavior.
Yup, my boss would get my 2-weeks notice immediately. Like same day. I’m not putting up with that BS.
how thoroughly was it followed through? how was ensured that no free beer software was used?
I’ve had some workplaces where they instituted overly heavy-handed crackdowns through IT Policy then rolled them back after a couple of weeks because someone in upper-manglement needed to see the impacts in the real world that they already were already warned of before they could be convinced that their genius new policy wasn’t such a good idea
That’s a great question. In my experience (15 years at MSPs and several years as a freelance consultant where I’m mostly in house one place but take side jobs) I’ve been the one who had to make this change.
Some companies are very serious about it. Laptops end up on some device management solution that can tell every program you’ve got installed and flag anything not pre-approved. Then take away everyone’s ability to install outside of device management.
Some companies want to scare the users into compliance but want IT to be able to do their own thing. So they’ll install some easily bypassed thing or enroll everyone but not keep an eye on their network to find rogue devices.
Some companies threaten it, pay money for a consultant to put together a plan, don’t like the price, threaten to go elsewhere, and the exec who championed it finds a new job while nothing of note was done, but they’re sitting on a handful of licenses for software no one is using.
I used to carry a toolkit of free software in portable format on a thumb drive and another thumb drive with a full Linux environment in case I had to do something at the first kind of company.
