Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Ok, so we've seen the questions about allowing developers different amounts of latitude when locking down or deploying machines, but what about their internet access? Do you allow unlimited NATing of their workstations? Do they have to at least run through a proxy to log their access? Do they run through a proxy that filters the content that is returned to them? Or do you simply restrict their access as needed?

My personal opinion is to run them through a proxy with no limits on the sites visited, but filter the content as it's delivered to prevent malicious code from crossing into the "inside". Useful data - ISO images, programs, etc. are not limited, but are scanned.

What is the best resolution to this? Am I wrong? Should developers just have whatever access they want at any time?

Follow-Up Edit:

For the record, I am a Generalist. That is, I am both the proxy admin and the resident ERP developer where I work. And yes, my access is logged and filtered, although I can go anywhere I please. I've seen both sides of this issue, but I have yet to hear a good reason why letting people run wild with your internet resources is a good thing. And not everyone has enormous amounts of bandwidth - my work still uses a T1 to connect, and it can fill up very, very quickly.

(Sigh) Yet Another Edit:

Ok, easy there, put down the pitchforks and torches...I mention "restrict" and everyone suddenly sees the world in black/white, not a slight shade of gray. This isn't a question of either/or, it's a question of how much, as in how far is acceptable to everyone involved?

(Revisit)

So, after some time to stew about this question, it's clear that the crux of this is a cultural issue, not a technical one. I'm not a big fan of having to filter everything - I'd much rather get people what they need when they need it - but I just remembered that there are little things that can get in the way of this.

  • HIPPA rules are not terribly keen about exposing sensitive data. Openning up tunnels and the like create potential exposure vectors for data leaks.
  • There are some places with rules so draconian that just the attempt to open a tunnel would result in immediate termination without question. I'm not a big fan of this either - it's a mean-spirited mentality - but these places exist.

This was, by far, the most hated question I think I've ever seen.

It touched so many raw nerves that people may be needing novocaine for a few weeks to get over this.

The question's intent was innocent enough - to find out if this is a common practice - and as it turns out, it's a practice that's hated. I'll be sure to not mention such things in polite company. :)

share|improve this question
add comment

12 Answers

up vote 4 down vote accepted

This is more of an organizational culture question as opposed to a technical question.

Technically, there's no good reason to restrict their access unless you have specific "problem children" that have bad habits that need to be regulated. (Disclaimer: I have been the problem child in the past.) My website has posts about things as diverse as raising a puppy to doghood and gardening, which ends up triggering draconian "work-related-only" content filters. Even if you're on a limited bandwidth internet connection, it's pretty easy to track down excessive users at the network layer and manage your users that way.

Culturally, there's lots of reasons that this could be desirable to management, but that's a management question/answer.

share|improve this answer
    
+1 for a well-thought-out response, AND for pointing out that it's not entirely a technical issue. –  Avery Payne Jun 4 '09 at 17:33
add comment

I work in a large organisation. My internet access, like almost everyone elses, has to go through the web proxy. There is network security in place so that I can't just change the IE settings to skip the proxy. Other than occasionaly blocking TheDailyWTF forums when it notices certain words it doesn't cause me any issue. Our total internet connection is somewhere around 2*2Mb for 2000 staff. It is sometimes inconvenient when I need to download a service pack, but generally a little planning prevents the issue. and if it is really urgent then there is a standard broadband line that comes into the office for exactly this purpose. So No. I see no reason why developers should be exempted from any but the most draconian internet policy.

share|improve this answer
add comment

Why do you want your developers to jump through hoops? Don't you want them to use their time to do actual work?

What problem are you trying to solve?

If you're trying to lock them in by force so that they don't facebook on company time, why not just have a policy "No facebook on company time"? Don't you trust your developers? And if you don't, why do you hire developers that don't have the skill to go around your barriers?

There is also the issue of worker morale. If you don't trust them by either blocking them or logging accesses, they will want to switch jobs. I know I would be actively looking for a new job if my employer logged internet access. Treat people like criminals and they will act like criminals.

share|improve this answer
1  
Not all developers work in a pure-play tech environment. They may be part of a larger organization that has corporate rules that (sometimes nonsensically) must be followed. Then there's the goatse.cx factor to consider as well - do you really want to end up on a jury stand trying to explain to disinterested people why your company shouldn't be sued into oblivion, because your company is on trial for sexual harassment? It's not always an obvious thing, but there should be a good reason for restricting them. Otherwise, yes, why bother at all? –  Avery Payne Jun 4 '09 at 7:19
    
I almost forgot - what if one of your developers is a little "daring" and decides to download source and binaries from a rather, ahem, shady site? What if they incorporate source code from someone else that doesn't have a permissive license? What if their download is not meant for development, but instead, meant to crack your server passwords? Do you implicitly trust everyone? Should you? Or is there a line that needs to be set in the sand? –  Avery Payne Jun 4 '09 at 7:22
1  
I think it's more expensive to make your developers jump through hoops. Maybe I'm wrong though. Regarding your second comment: if they want to, they will. Filter or no filter. Are you underestimating your developers or are you actually hiring unqualified monkeys? A developer that can't trivially get past a filter should at the very least be sent on some courses. –  Thomas Jun 4 '09 at 7:27
    
An admin that can't reasonably block a developer from traversing a firewall without the proxy should also be sent to some courses. Touche'. (+1 for defense of your developers and their freedoms. :) ) –  Avery Payne Jun 4 '09 at 7:31
    
How much time (=your money) do you want the developers to spend setting up IP over DNS to be able to check their personal notebook wiki? Sure, you can allow them to surf only to a whitelist, but then they won't be able to do their jobs propery. This is not a battle the you and the firewall guy can win. If you really want to it'll probably be better (cheaper) to unplug the internet alltogether and not have a firewall guy. I'm not just defending the developers. The really really good developers will be able to find another job. If this was a dealbreaker for just one, was it worth it? –  Thomas Jun 4 '09 at 8:42
show 8 more comments

Where I work //Everyone// goes through a proxy. It's not a big deal. It's used to enforce internet policy, but we're responsive to fixing stuff being blocked that should not be.

share|improve this answer
add comment

I've always been of the opinion that using IT to police HR issues is a bad idea. If you have a problem with people not working by messing around on the internet, then limiting their internet access is only going to cause them to waste time in some other way. If you want to stop the problem you have to address the root cause.

How you do this can take different forms depending on the type of job.

share|improve this answer
add comment

Blocking porn and streaming content (youtube, etc) should be enough. You can do this with squid or a proprietary network appliance (like BlueCoat).

I think what's more important is to limit their bandwidth. In a previous job, as a networkd administrator, i used to share the network connection with the dev team. And that's not fun when you're working on a remote system through a VPN while some developer is downloading a CD ISO, etc.

share|improve this answer
3  
Totally disagree on both fronts. There is loads of good stuff on youtube which can be work-related; like tutorials and technical demos. Limiting bandwidth sucks, too... if I need to download a CD ISO image, it's equally annoying for me when I'm not allowed to do it. If you have problems with bandwidth hogs, then make metrics of everybody's internet access and publish them. Light social barriers tend to bring down unnecessary abuse of shared resources. –  Nik Reiman Jun 4 '09 at 7:20
    
I think there might be an unwritten assumption that the bandwidth limits are so draconian as to make internet usage unusable. Nothing prevents the admin from setting up a proxy that provides 95% of the total bandwidth, while securing that measly 5% for their own work. However, the "social barrier" aspect is a good idea, +1 for a non-technical solution. –  Avery Payne Jun 4 '09 at 7:35
1  
Well, that depends a lot of the type of your internet connection. If you work in a small business with a DSL line, even a fast one, you are going to find out that when the link is used at 90%, the latency gets very bad, with much more packet losses. That's my experience. I know there are good resources on youtube-like websites, but people are anyway going to spend 90% of their internet times watching funny videos, wasting bandwidth that other may need. –  Benoît Jun 4 '09 at 7:47
add comment

Any knowledgable person will have access to whatever he/she wants as soon as you allow outgoing https (corkscrew anyone?). Really, policy and education are far more effective with tech-savvy people... .

That being said, some filtering might be appropriate, but you should be aware that it can be easily circumvented, and so not rely on that line of defense exclusively...

share|improve this answer
    
Why do people say it's "easily circumvented" With some pretty simple stuff its "easy" to limit and log your access without you being able to get around it. Short of you hacking your way out which would get one fired pretty quick. –  SpaceManSpiff Jun 4 '09 at 12:26
    
LEAT, in theory that is right. However, the thing is that there is no way at all that you can easily make the distinction between a "legitimate" https request and one carrying an SSH session inside it (which in turn may do port forwarding etc.). Many people I know use this to bypass wrongly configured proxies (to name one kind of legitimate use). The whole point is that circumvention is easy, so you shouldn't rely on that alone to protect your network from malware etc. –  Vincent De Baere Jun 4 '09 at 15:06
add comment

Not strictly on-topic, but regarding proxies and developers, what I'd do first is take care that (web) developers make sure that their apps play nice behind a reverse proxy, URL rewriting and all.

More on-topick, philosophically, an employer has every right to control and monitor what you see through their uplink, but (a) in many places in the world, foremost Europe, the law takes a dim view on that and (b) if you have developers that are not self-motivated enough not to clog the tubes during work hours and not competent enough to see whatever they want if they're allowed HTTP (less blacklists) or, even more, SSH, your problem is not proxy filtering.

Now, QoS is a completely different story - but filtering, nah.

(Edit: QoS may be the right way to filter, anyway. This may look a little passive-aggressive and is more from psychology than strictly technological, but a firewall admin at a customer's found that if he blocked stuff, people would find a way around - it was a very tech-savvy user base - but if he just made it unusably slow, they wouldn't. Maybe that's useful to you...)

share|improve this answer
add comment

Maybe we should turn the question around?

What do developers need to do that cannot be done with a proxy in place? Why do developers need to be treated differently (in terms of web/net access) to everyone else?

share|improve this answer
1  
I've had trouble with our proxy corrupting Oracle patch downloads. Took ages to track it down, but we now have an exception in place and everyone's happy. –  Jonathan Jun 4 '09 at 10:52
1  
Depends on what they're developing. If you're doing anything with networking, you pretty much need pretty much unfiltered access to the internet. (what happens when I do this, do browsers sent data in the first ack, what's the latency of this, and I need to be sure that nobody is caching that, etc...) And as for logging sulf traffic: that's just nasty. Chilling effects. –  Thomas Jun 4 '09 at 10:54
    
I'd like to add that why do developers need local admin access as well? If they developed as limited users, maybe the applications would run better as limited users, when they relize that writting to that reg key maybe isn't a good idea. –  SpaceManSpiff Jun 4 '09 at 12:28
1  
Developers generally need local admin to install their software run a debugger on it. I think in theory it's possible to give them just the permissions needed to do that, but it's a lot easier to just give them local admin. –  pgs Jun 4 '09 at 14:57
    
On-topic: if they are writing pure networking apps, then I don't see any reason to proxy that portion of their development. Off-topic: local admin on a machine is fine, domain admin is a different story altogether. Although Power User typically gets the job done for most software. –  Avery Payne Jun 4 '09 at 17:36
show 3 more comments

Filter (and cache!) as much you want, but for goodness sake, please use an autoconfigured proxy (preferably with WPAD) and don't force the developers to use it. I use my work laptop from a variety of locations (company network, public and private WLANs, customers' networks etc), so autoconfiguration saves a lot of hassle. Also, I frequently work with not-yet-public (read: no DNS) websites residing on customer premises, and these sites are only accessible from specific computers (usually with a VPN). Unless you want to maintain an exception list, please let me bypass the proxy so that I can do my work.

share|improve this answer
add comment

If you restrict outbound access too much, developers are certain to open up complete tunnels instead over ssl or ssh to some private network outside - exposing your infrastructure to even more risk with uninspectable encrypted traffic imho...

...not being able to get to a simple unencrypted svn repository on the internet for samples because the svn port is blocked is extremely annoying, among a lot of things :)

These are things you need to bring up for review with those in charge though - decisions first, technical solutions afterwards.

share|improve this answer
    
I see as the administrator's duty to get the access needed, so I don't disagree. Most of the proxy work I've dealt with doesn't intentionally block, rather, it just acts as a go-between, so the SVN example shouldn't be an issue. Still, +1 for a nice answer. –  Avery Payne Aug 4 '09 at 13:41
add comment

Should developers just have whatever access they want at any time?

Yes, or else your organization will be anonymously mentioned on stackoverflow in one of the many "annoying working conditions" community wiki questions. ;)

But seriously, there are two things to consider here. First, developers are a pretty technically savvy bunch, obviously. There is a less of a risk of them opening up stupid email attachments, visiting/downloading malicious content, etc. Second, unless you have a reason to proxy internet access, why bother? Has your organization been plagued by malicious content seeping in? Has there been a number of intrusions or other security problems? Have your other solutions failed to address such problems?

If none of these questions apply to you, then you're solving a problem that doesn't exist, and people will see proxied access as draconian because of it.

share|improve this answer
    
1. I've seen developers do some, ah, less-than-stellar things, so while that's a valid assumption, it's not 100% true. 2. There's this little thing called "the monthly bandwidth bill"... and it has a cousin, "my-ssh-access-is-running-like-mollasses-in-January". 3. Don't get me wrong, I'm not big on blocking people from websites, but I am big on blocking people from using stupid browsers with security holes that download unwanted "things" with the next iteration of banner ads displayed... –  Avery Payne Jun 4 '09 at 7:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.