Things like this happen all the time.

"Shadow IT" is the official name for circumstances that lead to this and it's the consequence of:

A) Deprioritising "non-urgent" but "important" tasks consistently

and

B) IT being bureaucratic and/or unable to allocate budget

I had a Mac Pro (trashcan) at Ubisoft that was the only way people were able to play our studios live game from within the office. (Ubisoft had a "NO OUTBOUND CONNECTIONS TO INTERNET" policy for Studios)

That same Mac Pro was running our internal slack bot to run Maintenances (and, insult people).

I left Ubisoft 5 years ago, as far as I know that Mac Pro is still plugged in on my former desk chugging along, last time I asked my former manager about it was last year.

----

At another company (now owned by Oracle), we had an internal IRC (this was before Slack) and nobody thought about it.

One day it went down, and traceroute had indicated it was in our server room; after checking every single server we could not find it, until someone noticed an ethernet cable that went through a run into the floor but didn't come back out.

After opening the suspended floor we noticed a laptop running Solaris. That was our IRCd and the OS had an uptime of close to 8 years.

> Shadow IT

Universities seem to install unlimited hurdles to achieving anything. The stuff staff and students do within the network to make shit work is amazing.

Yet they forget to put a password to BIOS so I am able to write this comment from a school computer, on NixOS running from a USB drive. Though I'd probably crack it even if they did.

Don’t forget IT ignorance. A lot of places IT is full of Microsoft MVPs that have no understanding of the needs of people developing in and for Linux systems.

Ah, never attribute to malice or incompetence that which can be attributed to the pain response from trying to secure a heterogeneous OS environment.

Ding ding ding. So much friction from this factor alone.

> request was denied

> mac mini proxy server

I love that the programmer's solution is more expensive than doing it the right way had OP's request been approved.

... At the end of the the deal with had two mac mini's with auto fail over configured via health checking. Thank goodness we got rid of the service provider that refused to let us pair with the network. Once that happened the networking team could just do normal peering with a standard router.

But yea, in the early days that mac sat on my desk. It only got moved when I pointed out the issue to our new security team and their jaw hit the floor. =)

I would have thought so too, before I worked on a team where we had our own load-bearing Mac Mini installed at a client site - in that case, load-bearing for A/V reasons (no one was able to get PulseAudio working in time).

Client's IT loved to unplug that thing.

I think it was pretty common in the 2000s when devs could't provision machines/VMs without asking for permission

Also when you could just plug something into a switch and a) the port is active and b) it goes unnoticed.

Probably still the case in a lot of startups.

Most startups I deal with these days don't even have offices anymore, let alone network ports. =)

But yea.. same deal with wifi. Its amazing how often the wifi password is posted on something visible. In fact I have found the password in so many public images which means somebody on the street could just connect to the wifi network fomr the street.

That's only a denial of service issue, not a security issue. Wifi is too cheap to meter

Unknown persons getting onto the company wifi is not a security concern?

It shouldn't be. Treat the network as public, require credentials for any access whether it comes from inside or outside.

With work from home the security perimeter is the machine. All networks are untrusted.

Correct. Company wifi is just like any other network. Why would there be any services on it that don't use encryption and authentication?

In the context of this thread - how many startups do you think strictly adhere to best practices?

In this context, almost all of them? The whole concept of a "secure network" is very enterprisey

> I guess it's just a case of programmers taking the easiest route and having it backfire.

Or a case of IT not actually providing needed services. That, too, is more common than it should be.