When you're not allowed to install applications and tools to your own, that gets in the way of productivity and happiness at work.

I've worked at companies where even being able to install something simple like Notepad++ or VSCode was turned into a major chore or made impossible thanks to the locked down environment.

Locking down trivially important system preferences like your desktop background is another example of just plain annoying management that I've witnessed.

Don't forget corporate network content blocking, and I don't mean the obviously not safe for work content, but companies acting as the productivity police e.g. blocking Twitter and YouTube just because they don't trust you enough to not slack off at work, and furthermore not trusting your supervisor to be competent enough to determine whether or not you've been productive enough lately.

... You are aware that at a point in time, Notepad++ was compromised, right?...

https://notepad-plus-plus.org/news/notepad-7.3.3-fix-cia-hac...

As both developer and a systems administrator, I am constantly on both sides of the fence. I have seen developers who cannot even maintain their machines and download any random thing to streamline their job to the detriment of security. Yet, I have seen other organizations where it takes months to get something like VSCode installed (try keeping that up-to-date on an air-gapped machine, that isn't connected to the internet... or ... Node.js or... full Visual Studio...)

Notepad++ wasn't compromised, at least not in the incident referred to in that link.

> It's not a vulnerability/security issue in Notepad++

Ah yes - gotta love the HN pedantry - you are of course technically correct, however - a library used by Notepad++ was compromised for a period of time.

Outcome from a security perspective was the same.

> a library used by Notepad++ was compromised for a period of time

Nothing at the referenced URL corroborates how you are representing the referenced URL.

According to the URL, the CIA was replacing one of Notepad++'s components w/ another in order to run code on the user's system and stay hidden. Nothing in that links indicates that that replacement is done through any breach in security in Notepad++ itself, and AFAICT, they're using it merely as a good hiding place. The Notepad++ announcement fixes no particular bugs, but merely signs the code.

"It rather involved being on the other side of this airtight hatchway": https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

I'd also say that the CIA is probably not within the threat model of most companies. (If they had one.)

> Ah yes - gotta love the HN pedantry - you are of course technically correct, however - a library used by Notepad++ was compromised for a period of time.

No, it wasn't either. The security "issue" was that a shared library loaded by Notepad++ could be replaced with a compromised one. At no point did either Notepad++ or the library authors distribute a compromised version of that library.

Being able to replace shared libraries is not a security issue, it's the number one (or number two, depending on who you ask) reason for having shared libraries in the first place. It's like saying that if I compiled a custom version of glibc and installed it on a computer, the entirety of the GNU ecosystem was compromised.

I mean, my operating system itself was compromised many times, is my employer going to take that away too?

I think if I got this answer during an interview, as a candidate, I would be pleased that your criteria reject me as an incompetent dev.

That is a wide brush you are using. Once you start needing to prod the operating system internals or do any sort of devops work it is prudent to have root access.