Should you force your developers to run through a proxy?

Question

Ok, so we've seen the questions about allowing developers different amounts of latitude when locking down or deploying machines, but what about their internet access? Do you allow unlimited NATing of their workstations? Do they have to at least run through a proxy to log their access? Do they run through a proxy that filters the content that is returned to them? Or do you simply restrict their access as needed?

My personal opinion is to run them through a proxy with no limits on the sites visited, but filter the content as it's delivered to prevent malicious code from crossing into the "inside". Useful data - ISO images, programs, etc. are not limited, but are scanned.

What is the best resolution to this? Am I wrong? Should developers just have whatever access they want at any time?

Follow-Up Edit:

For the record, I am a Generalist. That is, I am both the proxy admin and the resident ERP developer where I work. And yes, my access is logged and filtered, although I can go anywhere I please. I've seen both sides of this issue, but I have yet to hear a good reason why letting people run wild with your internet resources is a good thing. And not everyone has enormous amounts of bandwidth - my work still uses a T1 to connect, and it can fill up very, very quickly.

(Sigh) Yet Another Edit:

Ok, easy there, put down the pitchforks and torches...I mention "restrict" and everyone suddenly sees the world in black/white, not a slight shade of gray. This isn't a question of either/or, it's a question of how much, as in how far is acceptable to everyone involved?

(Revisit)

So, after some time to stew about this question, it's clear that the crux of this is a cultural issue, not a technical one. I'm not a big fan of having to filter everything - I'd much rather get people what they need when they need it - but I just remembered that there are little things that can get in the way of this.

• HIPPA rules are not terribly keen about exposing sensitive data. Openning up tunnels and the like create potential exposure vectors for data leaks.
• There are some places with rules so draconian that just the attempt to open a tunnel would result in immediate termination without question. I'm not a big fan of this either - it's a mean-spirited mentality - but these places exist.

This was, by far, the most hated question I think I've ever seen.

It touched so many raw nerves that people may be needing novocaine for a few weeks to get over this.

The question's intent was innocent enough - to find out if this is a common practice - and as it turns out, it's a practice that's hated. I'll be sure to not mention such things in polite company. :)

Answer 1

This is more of an organizational culture question as opposed to a technical question.

Technically, there's no good reason to restrict their access unless you have specific "problem children" that have bad habits that need to be regulated. (Disclaimer: I have been the problem child in the past.) My website has posts about things as diverse as raising a puppy to doghood and gardening, which ends up triggering draconian "work-related-only" content filters. Even if you're on a limited bandwidth internet connection, it's pretty easy to track down excessive users at the network layer and manage your users that way.

Culturally, there's lots of reasons that this could be desirable to management, but that's a management question/answer.

Answer 2

I work in a large organisation. My internet access, like almost everyone elses, has to go through the web proxy. There is network security in place so that I can't just change the IE settings to skip the proxy. Other than occasionaly blocking TheDailyWTF forums when it notices certain words it doesn't cause me any issue. Our total internet connection is somewhere around 2*2Mb for 2000 staff. It is sometimes inconvenient when I need to download a service pack, but generally a little planning prevents the issue. and if it is really urgent then there is a standard broadband line that comes into the office for exactly this purpose. So No. I see no reason why developers should be exempted from any but the most draconian internet policy.

Answer 3

Why do you want your developers to jump through hoops? Don't you want them to use their time to do actual work?

What problem are you trying to solve?

If you're trying to lock them in by force so that they don't facebook on company time, why not just have a policy "No facebook on company time"? Don't you trust your developers? And if you don't, why do you hire developers that don't have the skill to go around your barriers?

There is also the issue of worker morale. If you don't trust them by either blocking them or logging accesses, they will want to switch jobs. I know I would be actively looking for a new job if my employer logged internet access. Treat people like criminals and they will act like criminals.

Answer 4

Where I work //Everyone// goes through a proxy. It's not a big deal. It's used to enforce internet policy, but we're responsive to fixing stuff being blocked that should not be.

Answer 5

I've always been of the opinion that using IT to police HR issues is a bad idea. If you have a problem with people not working by messing around on the internet, then limiting their internet access is only going to cause them to waste time in some other way. If you want to stop the problem you have to address the root cause.

How you do this can take different forms depending on the type of job.

Answer 6

Blocking porn and streaming content (youtube, etc) should be enough. You can do this with squid or a proprietary network appliance (like BlueCoat).

I think what's more important is to limit their bandwidth. In a previous job, as a networkd administrator, i used to share the network connection with the dev team. And that's not fun when you're working on a remote system through a VPN while some developer is downloading a CD ISO, etc.

Answer 7

Any knowledgable person will have access to whatever he/she wants as soon as you allow outgoing https (corkscrew anyone?). Really, policy and education are far more effective with tech-savvy people... .

That being said, some filtering might be appropriate, but you should be aware that it can be easily circumvented, and so not rely on that line of defense exclusively...

Answer 8

Not strictly on-topic, but regarding proxies and developers, what I'd do first is take care that (web) developers make sure that their apps play nice behind a reverse proxy, URL rewriting and all.

More on-topick, philosophically, an employer has every right to control and monitor what you see through their uplink, but (a) in many places in the world, foremost Europe, the law takes a dim view on that and (b) if you have developers that are not self-motivated enough not to clog the tubes during work hours and not competent enough to see whatever they want if they're allowed HTTP (less blacklists) or, even more, SSH, your problem is not proxy filtering.

Now, QoS is a completely different story - but filtering, nah.

(Edit: QoS may be the right way to filter, anyway. This may look a little passive-aggressive and is more from psychology than strictly technological, but a firewall admin at a customer's found that if he blocked stuff, people would find a way around - it was a very tech-savvy user base - but if he just made it unusably slow, they wouldn't. Maybe that's useful to you...)

Answer 9

Maybe we should turn the question around?

What do developers need to do that cannot be done with a proxy in place? Why do developers need to be treated differently (in terms of web/net access) to everyone else?

Answer 10

Filter (and cache!) as much you want, but for goodness sake, please use an autoconfigured proxy (preferably with WPAD) and don't force the developers to use it. I use my work laptop from a variety of locations (company network, public and private WLANs, customers' networks etc), so autoconfiguration saves a lot of hassle. Also, I frequently work with not-yet-public (read: no DNS) websites residing on customer premises, and these sites are only accessible from specific computers (usually with a VPN). Unless you want to maintain an exception list, please let me bypass the proxy so that I can do my work.

Answer 11

If you restrict outbound access too much, developers are certain to open up complete tunnels instead over ssl or ssh to some private network outside - exposing your infrastructure to even more risk with uninspectable encrypted traffic imho...

...not being able to get to a simple unencrypted svn repository on the internet for samples because the svn port is blocked is extremely annoying, among a lot of things :)

These are things you need to bring up for review with those in charge though - decisions first, technical solutions afterwards.

Answer 12

Should developers just have whatever access they want at any time?

Yes, or else your organization will be anonymously mentioned on stackoverflow in one of the many "annoying working conditions" community wiki questions. ;)

But seriously, there are two things to consider here. First, developers are a pretty technically savvy bunch, obviously. There is a less of a risk of them opening up stupid email attachments, visiting/downloading malicious content, etc. Second, unless you have a reason to proxy internet access, why bother? Has your organization been plagued by malicious content seeping in? Has there been a number of intrusions or other security problems? Have your other solutions failed to address such problems?

If none of these questions apply to you, then you're solving a problem that doesn't exist, and people will see proxied access as draconian because of it.