HTTPS on Stack Overflow: The End of a Long Road

Re:HTTPS on Stack Overflow: The End of a Long Road by nfriedly on Monday May 22, 2017 @04:28PM (#14396659)

You should try this link from home: https://stackoverflow.com/jobs

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by techolic on Monday May 22, 2017 @11:06PM (#14398518)

Many banks have very strict IT policies on posting things on internet, and they have valid business reasons for that. Not saying you meant that, but it's not like they're some dark, silly workplaces that people should get away from asap.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by darklajid on Monday May 22, 2017 @11:28PM (#14398592)

No, the reasons for the policy might be sound.

The enforcement is stupid (both the previous hack and now the block). For me this actually would be a sign that the workplace isn't quite the right fit for me, if the basic assumption is that I ignore the policies anyway - because that's what this seems to indicate?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by lucb1e on Tuesday May 23, 2017 @01:35AM (#14399021)

> The enforcement is stupid (both the previous hack and now the block)

Hack indeed. Seems like blocking POST would block posting stuff while blocking to log in allows you to just copy your cookie, and doesn't allow you to view your notifications.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by mcherm on Tuesday May 23, 2017 @07:35AM (#14400377)

> Many banks have very strict IT policies on posting things on internet

Yes, they do. And I really love it. Because it means that MY bank eats their lunch, because the bank I work for actually UNDERSTANDS how to use technology, while still keeping (very!) strict controls.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by tvanantwerp on Tuesday May 23, 2017 @07:49AM (#14400447)

Would be curious which bank you work for. Most do not seem to value technology--which is odd, since most "cash" only exists as data in a computer somewhere. I'd much prefer to patronize a bank that understands and takes seriously their tech.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by mcherm on Wednesday May 24, 2017 @01:21PM (#14411696)

I work at Capital One. We have been a bank (and are regulated as one), but are trying hard to become a technology company that is specifically focused on banking.

And I'm probably biased, but I think we have some pretty great products also (checking accounts with no fees that pays some interest, savings accounts with very good rates, and so forth), so maybe you'll get a good deal as well as a technical focus.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by boyter on Monday May 22, 2017 @04:51PM (#14396834)

Same thing happened to me at a workplace once. They blocked StackOverflow, GitHub, Bitbucket, Sourceforge, CodePlex and Google Code.

I told them all estimates go up by 2 years since we would need to reimplement everything. It ended up being unblocked a week later.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by astrodust on Monday May 22, 2017 @06:42PM (#14397466)

I don't know how you'd get anything done since there are answers on Stack Overflow that solve problems that otherwise would involve hours to days of fussing to come up with the same non-intuitive solution.

All roads lead to Stack Overflow these days for progrmaming problems.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by linkregister on Monday May 22, 2017 @09:30PM (#14398156)

For every answered question, there are probably 20 unanswered ones. Almost none of my embedded programming questions got answered.

Edit: my estimate is wildly off. It's basically the opposite of what I said.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by Nick-Craver on Monday May 22, 2017 @09:35PM (#14398178)

12,095,709 questions have an answer, 7,506,004 of those have an accepted answer, and 1,813,270 aren't yet answered.

I'd say your 1:20 ratio is just a little bit off :)

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by tallanvor on Tuesday May 23, 2017 @05:52AM (#14400028)

Just out of curiosity, do those 7.5+ million accepted answers include those closed as duplicates? Because by far my biggest complaint is finding the exact question I have was closed as a duplicate and links to a question that is useless at answering my question.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by ygra on Tuesday May 23, 2017 @09:24AM (#14400936)

In that case you can vote to re-open and perhaps even post a bounty. Although bounties tend to invite lots of low-quality, low-effort answers just on the off chance that they might be the top-voted one once the bounty runs out.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by linkregister on Monday May 22, 2017 @09:47PM (#14398235)

Thanks for the correction! I am asking pretty niche questions.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by lucb1e on Tuesday May 23, 2017 @01:41AM (#14399051)

I feel you. I've taught myself programming between 13 and, well, I'm now 23; so by the time stackoverflow came around I had figured out how to solve things myself. When I have a question, it's usually either opinion-based (bad fit for SO) or not a common question.

I'd say 1:20 is a good estimate if I ignore answers that didn't read my question (which is most of them), but indeed the facts disagree.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by tyleraldrich on Tuesday May 23, 2017 @12:21PM (#14402536)

What? Stackoverflow has been around since ~2008 - You certainly didn't learn how to solve things yourself a year into programming :).

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by lucb1e on Tuesday May 23, 2017 @06:46PM (#14406069)

Back then I didn't speak proper English, and how many questions were actually covered on SO in the beginning? It took some years to get to where we are, both for SO and for my English ;)

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by _fizz_buzz_ on Tuesday May 23, 2017 @08:15AM (#14400540)

I have had the same experience with embedded programming questions. I suppose they depend too much on the hardware. I do quite a bit of programming with the beaglebone blacks (or at least the same processor). And it seems the best resource is the mailing list.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by make3 on Monday May 22, 2017 @10:17PM (#14398355)

This sounds beyond absurd to me. Do they also block usb ports to prevent you from copying everything on a usb drive or external harddrive, or phone? Do they lock/solder you machines shut to prevent you from taking out a hard drive / plugging in a new one and then taking it out? Do they prevent you from .. printing the code? In what parallel world do they exist that they think this would make a difference

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by kingbirdy on Tuesday May 23, 2017 @12:48AM (#14398859)

As someone who works at a finance related company: yes. No USB storage is allowed, all cloud hosting sites are blocked (not SO, thankfully, they're more worried about us stealing SSNs and other PII than code), and all printers are logged and have drivers that detect if you're printing PII and censor it by default (or so I've been told, I don't really feel the need to test that).

A friend works at an investment firm, and has similar restrictions as the above commenter mentioned (no SO, no USB, no printing, etc), as well as pulling his phone out while at his desk or around any other computer being an immediate fireable offense.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by michaelt on Tuesday May 23, 2017 @02:20PM (#14403745)

A few years ago, I interviewed at a company called 'G Research' and the security procedures I noticed included:

* A 'secure zone' where work took place.

* All desktops virtualised, using thin clients.

* All Windows, no admin access.

* Screens, filesystem snapshots, and web access recorded, all the time.

* All software installation subject to approval (e.g. Firefox not permitted, only Chrome).

* Desks fixed in place, all cables in locked cable trays.

* Separate internal-only e-mail system.

* No printers.

* Specially printed notepads & other stationary in the 'secure zone', no secure zone stationary to leave or non-secure-zone stationary to enter.

* No cell phones, cameras or laptops permitted (lockers were provided).

* Entry points with human guards and metal detectors.

* No late working outside guards' hours.

While it would have been possible to get around the security if you were inventive enough (e.g. camera with no metal parts) it would be difficult to do so then believably claim it was an accident.

I didn't take the job, because I didn't feel I could be productive with so much bureaucracy.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by kavok on Tuesday May 23, 2017 @12:10AM (#14398743)

I've worked in financial software and they do block USB ports for any storage device. They block SD card slots too. All work was done on a VM that could only be accessed from the company network and was remotely hosted.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by teraflop on Monday May 22, 2017 @04:35PM (#14396715)

Leaving aside all the reasons why this policy is super dumb (which I'm sure others will cover quite adequately), I guess your IT department can't figure out how to create their own CA certificate and do SSL interception?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by jcrawfordor on Monday May 22, 2017 @05:32PM (#14397100)

Yeah, I'm amazed and concerned that you have a security team so paranoid that they would make SuperUser read-only but apparently lack the ability to perform SSL interception. Considering the huge value the latter has in any kind of post-compromise scenario and, increasingly, to prevent compromise in the first place... there needs to be a real discussion about getting priorities in order.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by Spooky23 on Monday May 22, 2017 @09:22PM (#14398135)

I disagree about the dumbness.

People do incredibly stupid things. I've seen customer data dumps on web forums.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by indexerror on Monday May 22, 2017 @05:32PM (#14397098)

Certainly doable but this should not be done.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by BinaryIdiot on Monday May 22, 2017 @07:54PM (#14397780)

There are many enterprise "solutions" that basically do this "out of the box". Yeah it shouldn't be done and a lot of employees are likely unaware that IT can see all of their SSL traffic but it's a big business.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by erikbye on Tuesday May 23, 2017 @05:24AM (#14399938)

HTTPS or not, certainly nothing is private here, but that's expected for this sort of place.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by kentt on Monday May 22, 2017 @07:31PM (#14397685)

Banning SE really doesn't go far enough then does it? Perhaps any site with a text box should be forbidden.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by Shoop on Monday May 22, 2017 @04:27PM (#14396655)

What sort of company do you work at? Why can't everyone just be told not to post code?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by mathattack on Monday May 22, 2017 @04:51PM (#14396838)

In many places (banks) there are legal reasons for this.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by nimchimpsky on Monday May 22, 2017 @07:55PM (#14397785)

I've worked at three big banks (in three different countries actually). We've always had access to stackoverflow.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by astrodust on Monday May 22, 2017 @06:45PM (#14397479)

This is nothing that can't be addressed through training. Questions on Stack Overflow with generic code actually get better responses than those bogged down with irrelevant details. You should strip out all labels, namess, even extraneous fields that don't matter. It makes for a more generic problem and solution pair that can help others as well, and eliminates the problem of leaking proprietary information.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by RangerScience on Monday May 22, 2017 @08:54PM (#14398018)

Maybe about half the time I end up answering my own question during this step. The act of genericizing the question ends up giving me some new approach, which either works, or leads me to new existing questions-and-answers.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by astrodust on Tuesday May 23, 2017 @08:32PM (#14406673)

Yeah. When you remove all the confusion, the problem is usually pretty obvious.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by scott00 on Monday May 22, 2017 @06:30PM (#14397405)

Can you elaborate on this?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by mathattack on Tuesday May 23, 2017 @12:55AM (#14398889)

IP protection. In a prior life I saw someone fired for mailing a model to a home account. Pasting code to a public website would violate similar protocols.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by dogruck on Monday May 22, 2017 @04:39PM (#14396746)

What sort of company do you work at where every employee obeys every directive?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by sqren on Monday May 22, 2017 @04:43PM (#14396789)

A company that trust their employees. There are so many ways to get around this anyway so it doesn't make sense to try to enforce it in the first place (considering the issues that follows).

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by cortesoft on Monday May 22, 2017 @05:45PM (#14397179)

What sort of company do you work at that this sort of crude blocking attempt would actually work?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by maddyboo on Monday May 22, 2017 @04:26PM (#14396646)

Wow, that sounds ridiculous. What's the reasoning behind that policy?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by zcdziura on Monday May 22, 2017 @04:43PM (#14396784)

Seems obvious that someone high up on the corporate ladder, with no practical knowledge in how the nitty-gritty work gets done, made the decision. Probably to "minimize IP theft".

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by astrodust on Monday May 22, 2017 @06:43PM (#14397471)

"What do you mean our competitor is using 'for' loops? We invented those!"

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by knodi123 on Tuesday May 23, 2017 @12:25AM (#14398793)

Why don't they just recompile chromium without support for the textarea element, make that the only officially permitted browser, and call it a day? :-)

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by kbart on Tuesday May 23, 2017 @10:12AM (#14401304)

Sorry, but such policy is just stupid. There are many, many ways one could get a snapshot of code without posting it online. I respect SE for their decision to make things right, not kneel down against costumers and their faulty "security" practices which can be often seen.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by danielbarla on Tuesday May 23, 2017 @03:57AM (#14399634)

I honestly wonder how exactly places like this want to enforce policies like this. Do they allow you to take a phone into your workplace? Aren't they scared you will take a photo and upload the code fragment?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by BinaryIdiot on Monday May 22, 2017 @07:54PM (#14397782)

Damn, that's even more strict than when I worked in the IC as a government contractor. I don't know how you'd get anything done, realistically.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by glandium on Monday May 22, 2017 @08:34PM (#14397944)

Do they realize their employees can use 4G to access SE?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by ajdlinux on Monday May 22, 2017 @08:50PM (#14398005)

Not if they're forced to check their phones in. I have friends working in the defence industry for whom this is something they have to deal with.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by lostboys67 on Tuesday May 23, 2017 @06:55AM (#14400247)

Well sites doing TS work you can sort of understand that

I knew someone who worked for the scientific civil eservice and they where not allowed to have a phone with a camera.

I have also been for an interview at a site (HMGC) where you have to hand in all electronics at reception - this was an avowed role btw so I am not breaking any laws the organisation even has job adverts on the local buses

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by ajdlinux on Wednesday May 24, 2017 @01:04AM (#14407708)

Not even TS work - it can include lower level classifications too.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by shaunrussell on Tuesday May 23, 2017 @09:01AM (#14400758)

If the architecture and code quality is good you should be able to open source your code and not have any security vulnerabilities.

You need to find a new job.

[ Parent | on HN ]