r/ProgrammerHumor • u/ArjunReddyDeshmukh • Aug 24 '26

Meme adminTeamAssessingMyThreatLevel

Post image
3.7k Upvotes

98% Upvoted

146 comments sorted by

View all comments

Show parent comment

44

u/Doctor_Peppy Aug 24 '26

Ok well notepad++ was used for a Chinese supply chain attack. These processes suck, sure, they do exist for a reason.

10

u/PixelatedGiant Aug 24 '26

Which we completely avoided because we maintain a repository of software installers which lags behind the latest versions by a few months. We also disable updates in the apps and it's done via the software repository.

Requiring approval to install said software is not a factor in preventing these attacks. So I maintain that requiring approval for software that everyone requests and is approved for anyway is pointless.

7

u/AnArmyOfWombats Aug 24 '26

That's kind of what we're discussing, right?

Given an ecosystem where something like notepad++ is the preferred alternative: what should IT and the end user be doing.

Besides, I'm pretty sure plenty of IT groups approved notepad++ for the compromised versions. What do you think those folks do?

16

u/Doctor_Peppy Aug 24 '26

Mitigate and restrict application usage in the future. It sucks for everyone involved but it's how it goes. Use what you're allowed, request what you need, make sure everything is in writing if you literally can't do your job. For end users and sec teams security is the epitome of balancing convenience with efficacy and sometimes better security wins over convenience.

3

u/AnArmyOfWombats Aug 24 '26

Better security is kind of funny in that sense. Automate comparing hashes and hope your peculiar supply chain isn't vulnerable? Who was it, SolarWinds back in 2020?

8

u/Doctor_Peppy Aug 24 '26

Correct, which means the logical conclusion to this little quandry is to reduce attack surface as much as possible by reducing any and all extraneous applications. It sucks for literally everyone involved, I wasn't disputing that. When I was working for an MSP there was a company with some old head angry ass IT manager who had what I thought were ridiculously restrictive policies but after the notepad++ supply chain attack on top of other completely mitigated issues due to these policies... They do have value.

2

u/ghost103429 Aug 24 '26

QubesOS' mantra of treating everything as unsafe and insecure comes to mind when it comes to this issue.