Technology

Able to talk and communicate with all the company infrastructure?

No, we have hard limits on what people can access. I can't access prod infra, full stop. I can't even do a prod deployment w/o OPs spinning up the deploy environment (our Sr. Support Eng. can do it as well if OPs aren't available).

We have three (main) VPNs:

• corporate net - IT administrated internal stuff; don't need for email and whatnot, but I do need it for our corporate wiki
• dev net - test infra, source code, etc
• OPs net - prod infra - few people have access (I don't)

I can't be on two at the same time, and each requires MFA. The IT-supported machines auto-connect to the corporate VPN, whereas as a dev, I only need the corporate VPN like once/year, if that, so I'm almost never connected. Joe over in accounting can't see our test infra, and I can't see theirs. If I were in charge of IT, I would have more segmentation like this across the org so a compromise at accounting can't compromise R&D, for example.

None of this has anything to do with root on my machine though. Worst case scenario, I guess I infect everyone that happens to be on the VPN at the time and has a similar, unpatched vulnerability, which means a few days of everyone reinstalling stuff. That's annoying, but we're talking a week or so of productivity loss, and that's about it. Having IT handle updates may reduce the chances of a successful attack, but it won't do much to contain a successful attack.

If one machine is compromised, you have to assume all devices that machine can talk to are also compromised, so the best course of action is to reduce interaction between devices. Instead of IT spending their time validating and rolling out updates, I'd rather they spend time reducing the potential impact of a single point of failure. Our VPN currently isn't a proper DMZ (I can access ports my coworkers open if I know their internal IP), and I'd rather they fix that than care about whether I have root access. There's almost no reason I'd ever need to connect directly to a peer's machine, so that should be a special, time-limited request, but I may need to grab a switch and bridge my machine's network if I needed to test some IOT crap on a separate net (and I need root for that).

nextcloud/libreoffice is the actual company storage for “cloud”-like functions…

Nice, we use Google Drive (dev test data) and whatever MS calls their drive (Teams recordings, most shared docs, etc). The first is managed by our internal IT group and is mostly used w/ external teams (we have two groups), and the second is managed by our corporate IT group. I hate both, but it works I guess. We use Slack for internal team communication, and Teams for corporate stuff.

an archaic 80’s language (probably why compile times suck for us in general) into Rust

That's not going to help the compile times. :)

I don't use Rust at work (wish I did), but I do use it for personal projects (I'm building a P2P Lemmy alternative), and I've been able to keep build times reasonable. We'll see what happens when SLOC increases, but I'm keeping an eye on projects like Cranelift.

I float more on the arch side of linux personally

That's fair. I used Arch for a few years, but got tired of manually intervening when updates go sideways, especially Nvidia driver updates. openSUSE Tumbleweed's openQA seemed to cut that down a bit, which is why I switched, and snapper made rollbacks painless when the odd Nvidia update borked stuff. I'm now on AMD GPUs, so update breakage has been pretty much non-existent. With some orchestration, Arch can be a solid server distro, I just personally want my desktop and servers to run the same family, and openSUSE was the only option that had rolling desktop and stable servers.

For servers, I used to use Debian, and all our infra uses either Debian or Ubuntu. If I was in charge, I'd probably migrate Ubuntu to MicroOS since we only need a container host anyway. I'm comfortable w/ apt, pacman, and zypper, and I've done my share of dpkg shenanigans as well (we did unattended Debian upgrades for an IOT project).

“even devs meet SCA”.

SCA is for payment services, no? I'm in the US, and this seems to be an EU thing I'm not very familiar with, but regardless, we don't touch ecommerce at all, we're B2B and all payments go through invoices.

The root restriction is simply so that you can’t disable the tools that prove the audit

If you're worried someone will disable your tools, why would you hire them in the first place? Also, that should be painfully obvious because you wouldn't get reporting updates, no?

We do auditing, and our devOPs team gets a weekly report from IT about any devices that aren't updated yet or aren't reporting. They also do a manual check every quarter or so to verify serials and version numbers and whatnot. I've gotten one notice from our local devOPs person, and very few of my team show up as well. The ones that do show up tend to be our UX and Product teams, and honestly, they have more access to interesting info than we devs do (i.e. they have planned features for the next 6 months, we just have the next month or so). And they need far fewer exceptions to the rules, since UX mostly just needs their design software and Product just needs office stuff and a browser.

I obviously can't speak for all devs, but in general, devs tend to be more interested in applying updates in a timely manner and keeping things secure. In fact, I think all of my devs already used a password manager and MFA before starting, which absolutely isn't the case for other positions.