Being forced to give up Emacs at work

So my company, which was acquired last year by a huge consulting firm, has been doing a huge IT audit where we’re losing admin permissions on our machines and have to request every piece of software we want installed. I added Emacs to the list of requested software and it’s been rejected with the note “insecure/unsupported development tool”. Has anyone had to deal with this kind of corporate IT bullshit before and if so what did you do? EDIT: thanks all for the advice. I’m going to be looking to get out of here ASAP rather than trying to work around or fight this bull shit. Too many good jobs out there to bother with this garbage.

You can't run software from eg. a thumb drive? If nothing else: quit and find a new job. (not joking; it's an employee's market right now.)

Emacs as flatpak/snap?

Given that most mainstream editors besides like... Notepad/nano can install, load, and execute fairly arbitrary code from an extension/plugin ecosystem, it feels like they would have a fairly hard time demonstrating that emacs was uniquely insecure in that regard. But knowing how such twisted minds work I probably wouldn't make this point to them and expect a constructive outcome. Anyway, "unsupported" is usually a fairly damning and non-negotiable stance (and tbh within their prerogatives to do so). I second the reply saying it's time to move on - someone who doesn't want their employees to each use their most effective/comfortable work style at no literal or metaphorical cost to their org or teammates is too short-sighted to put my faith in.

Start up a local container.

Had to deal with this. I asked the security team to audit the tool and they came back with an okay to use. Took a little bit but it got there.

> You can’t run software from eg. a thumb drive? I mean, yeah I probably could. But (a) they’ve forced us all back into the office and so people looking over my shoulder are probably gonna notice I’m using something different than whatever the “approved” IDE is and (b)they’re installing all this remote monitoring bullshit that might detect it. Either way if I get caught I’m probably fired.

[removed]

Go to your manager and raise a stink. They wouldn’t tell an accountant not to use Excel, even though Excel can execute arbitrary code. I recently got a message from IT saying my system settings were insecure (because macOS requires you turn off parts of SIP for dtrace(1) to work), and after escalating it two rungs up the management chain I got an exemption. And if this doesn’t work, then you’ve got proof that your workplace doesn’t value you, which is the best possible motivation to find a new gig.

Yes, I’ve worked like that for years, and I profoundly dislike the fact that some supposedly authoritative team should decide which tools all developers should use to work. Then they spend a lot of money on MIcrosoft Visual Studio licenses creating a stupid reason for everyone to use the licenses they bought so it should not have been bought for nothing. Someone is continuously being convinced by contractors or sales people into buying stupid licenses for all kinds of stuff and then forcing everyone to use it. That kind of policy is off putting, so to no surprise lots of people leave and they have problems recruiting. Now I work at a shop where you can use any OS and tools you like, as long as you are efficiently producing source code and products everyone can use, and it works just fine.

Complain, endure, or quit. In the immortal words of Don Draper, "That's what the money's for!"

If you'd like to talk about a moderation decision, please use mod-mail, so that it goes to all the moderators for a transparent discussion.

Better to find a new job and resign on your terms, than be fired? My commiserations, in any case -- that's pretty awful.

When I was looking for a new job 3 years ago the only company that didn't require people to use managed windows machines is the one that I'm now working at. However I expect that my company will follow at some point. It seems to me that this will only get worse. I think I would lose interest in tech related stuff very fast if I wasn't able to use linux+emacs. I would probably try https://github.com/emacs-lsp/lsp-gitpod but I don't know the downsides, but maybe it's an option.

WSL2 doesn't require administrative permissions to use when it's already installed. Perhaps you're lucky on that end? But seriously, look for another job, it'll only get worse. Cite "inability to use adequate tools" in your reasons for leaving.

quit. Plenty of jobs out there right now that are not micromanagery for the sake of stroking some middle management layer's ego. Probably get a much better bump in comp than staying around, too. For the record would I leave my current role if I couldn't use emacs? Maybe not, but I damn sure would if it's the kind of management that thinks banning any tool they don't explicitly support is a good idea.

At my employer, thinks are locked down super-hard along these lines. You can’t use any software whatsoever except through a request which must be approved, and there’s a very short list of things that can be approved. Basically, we get the usual MS Office / Acrobat and some internal stuff and that’s about it. All open source software is alleged to be “insecure.”

Sounds like a shithole, or one in the making. Get out. Not worth the agita.

I suppose the new company have an IT stuff known hierarchy, contacting the relevant responsible requesting motivations for the reject, clearly noting that to your knowledge you can't be as productive as you are without Emacs and being Emacs one of the oldest and still alive and kicking FLOSS project in the world it's hard to imaging why it's rejected especially if compared to $RelevantAuthorizedTool (witch very probably is a crappy bloated mass of serious vulnerabilities) do help a bit. Escalate as needed to answer, eventually going to state eventual dangerous incompetence by who reject it, with proper side investigations to know who he/she is to know how to properly confront might be needed. Personally I have a rule I can afford: I talk, but I work with proper tools, if we do not agree on them I quit, of course that's possible if you are wealthy enough and you live somewhere with a sufficiently dynamic economy, even just to be a credible menace, but it's a thing people must (re)learn: being employees does not means being slaves...

You can't win this fight. If it is a fairly big sized organisation, then you probably can't win this fight. If you can't / won't transition away from emacs then there really isn't a better option than finding a new job. I don't know where you are in the world, but if you have like 2+ years of experience, then the market is buzzing! That said, if you are otherwise really happy there, then - to me - this seems like a small thing to quit for. I don't know your field, but there are some really great IDE out there now and you can get emacs keybindings (which is at least something). Good luck whatever you end up doing 😄

Honestly? When bull**** like that happens, I set an ultimatum after which I quit. However, that advice may not be helpful if you are not in a position to easily find a comparable job.

Meh, at the point where a company installs remote monitoring software on your machine, it's time to quit either way. I know this nonsense is more common in the US, but there have to be some decent places to work still around, right?

Why? Whats the difference between just a compiled binary? Why the hell some want to move around Mb and Mb, Gb of data, often with out of date dependency instead of just using their OS? Sorry for being rude, but actual push toward containers like they were static binaries it's really disturbing for me... A simple tarball with a compiled binary plus few eventual deps equally compiled locally suffice, it's faster, lightweight, simple to keep up to date etc Snap&c serve a sole purpose: pushing commercial software, cutting the community in pieces, selling third party crap just saying "it will work on your system". They are *harmful for FLOSS* and even harmful for individual users.

If you're on Windows, you can use [scoop](https://scoop.sh) package manager to install Emacs without admin rights. If you're on MacOs, you can use [brew](https://brew.sh/) package manager to install Emacs without admin. If you're on Linux, you can use the Emacs Flatpak to install Emacs without admin. Hope this helps! I had the same problem at my work, managed to get around it since WSL was set up, so I could just use that, but I was happily using scoop before I worked out that solution.

Yeah, I'd also advise leaving if this option is on the table. It's not about Emacs, it's that such kind of restrictions just feel so arbitrary to me. Like, what else are they going to require? And generally it's not like we want to be a part of some company so much that we are ready to sacrifice the basic freedom of choosing software.

never had this forced on me, this squeeze on permissions and tools will cripple innovation. if innovation and technology is important to you, it's better to leave before you become one of them and be outdated. without real values to write in the resume. but I guess better try the diplomatic route first, although it sounds like their mind is set.

REN emacs.exe vscode.exe *happy manager*

Quit. Find another better place and quit.

Escalate through your manager. Any classification that mixes insecure and unsupported is broken, and most IT folks can support their own tools.

unacceptable. try to compile it from source using the tarball? if that doesn’t work and no other suggestion here works then bring your laptop and write code in emacs then email it or so over and paste or something equally dumb and make it known that productivity issues or inability to do xyz are because they removed the most basic fundamental tool of a developer which is the editor and if they say they approved one that’s not emacs remind them that it’s the equivalent of giving a jet pilot a helium balloon on a string

Can you ssh out? I host an instance of emacs on a cloud VM and use it through a terminal emulator. Self-administered FTW. You will likely be breaking some corporate IT regulation but if they can't tell then it's secure :)

...whilst MS Office and Acrobat are secure?!?!

You can also make a stink depending on what's used for development. If NPM is involved anywhere in the development process you'd have a _very_ strong argument that's more insecure then you using Emacs. Emacs has been open source for how many years now and how many security issues has it caused compared to something like NPM? Most language package managers aren't exactly the most security focused pieces of software anyway. Really, you can argue being able to download anything from the internet is technically insecure. Using a web browser is insecure.

Ah, the plight of the proletariat... Even when you have the "means of production", you are forced not to use your tools, but the gooey junky ones that stink of privacy-invasion. My condolences brother/sister/NB, and good luck

This place sounds strange and overly draconian. It really is an employee market right now, so please, try to find a new job.

I presume they let you use Anaconda for python? Just install your own Anaconda (doesn't require root) and then conda install emacs and then you're good to roll. The emacs binaries will be buried inside conda directories and it'll look like regular conda stuff to them.

Indeed and for anyone who feels like ‘the job I have is better than the uncertainty of finding a new one’ should think about the fact that the time of company that monitors their employees at this level only cares about the bottom line and as such will outsource you. There is no job security at a company like that

I've been on both sides of this issue. I've handled it by first discussing the issue with my manager. Most often, it's not something the manager can fix, but if you present compelling reasons then your manager will act as your champion. The next step is to escalate up the chain and have a calm, adult conversation with the security team because they are the ones that actually set policy. Make sure your manager is involved in this discussion and ask about the reasons for their decision. They may still not choose to make an exception, but at least you will come across as being professional about the issue. From the other side of the issue, the security team is tasked with the job of protecting the company against threats which is essentially a state of perpetual paranoia. Given the recent issues with NPM packages and the other unpleasantness going on in the world, their tendency will be to overreact to perceived threats. It's the nature of the job, and it's not personal. If you absolutely do not want to work under the constraints imposed, then it's time to move on, but do so in a professional manner. Leaving on bad terms will follow you the rest of your career.

You have two problems: * you're losing admin perms. * you need to run approved software only. The first one's not fixable as that battle's already lost. If you have access to a compiler, time and download capabilities, the second one's typically fairly easy to workaround by compiling it yourself as the people who do this sort of thing typically mean "install approved software only" where install is some sort of pre-packaged binary. Finally, I've seen people do this sort of thing by running local VMs.

Be proactive. I worked at a large company and ran Linux as my primary OS. I proactively hit up the head of infosec directly and said ..hey so I run linux as my OS and x,y,z tools and why. I could have just did it, but wanted to see if you could sign off so the local team knows I am good. He replied positively and I was given a green light with no issues after that. Cut out the middle managers and egos and the top folks are usually quite reasonable if you demonstrate why.

You have to ask yourself if you're willing to be a fungible cog. If not, you should probably just leave. I totally disagree with the people advising you to speak to your manager or others at the company. It is a huge consulting firm. The odds of you changing anything from the inside are slim to none, even if you win this battle there will likely be more culture clashes. So many people think that leaving (or threatening to) is going to have some kind of influence on the company. It won't. It doesn't matter though, their screwed up culture isn't your problem.

brew installs in /usr/local - you can't touch that without admin.

use it anyway until they fire you and enjoy the severance

It sounds like your work is about to be forced into recruiting. The job market for tech is hot right now. You can line up something else in about a month if you want to, and likely get a fat pay bump. Three friends and I all found new stuff in January and got salaries jumped between 30-50%.

Escalate it. If it still does not work out, it is time to leave the company.

Sounds like they’re turning this org into a hellhole. Update your CV.

I work in healthcare and machines are heavily audited. I can't install emacs directly on the system but they do allow WSL2 for some reason, so I have emacs installed on that and it works great. I tried to go the route of getting software approved but it was a bureaucratic nightmare and found it easier to use something already approved to get to emacs. I did try VS Code for a bit with all the keybinding changed and it worked OK but wasn't the same and went back to WSL2+emacs.

I would quit if I had to use VS Studio full time. It's so bad that I doubt the original developers used it, else they would have put some effort into making it usable.

I wonder if anyone has ever built a JIT in VBA so you can run arbitrary software in MS Office.

Someone is going to notice an outgoing SSH session and probably get OP fired.

As much as I love and rely on emacs, changing jobs seems a bit unreasonable

Makes sense for the firm to do that because they can probably get a kickback from Microsoft.

Ugh....this really is the kind of micromanagement I would resign over.

Yeah, if it's a big company I think there's little to no chance.

I got a security audit popup for trying to run NPM as an administrator while running Visual Studio. Which brings up two questions: why is VS using NPM in the background, and why does VS require running as an administrator to do ASP.Net development? Installing Emacs did not require Admin rights, and works fine, however.

I might just for Emacs, if I don't care particularly for my job, but the reason I really recommend it is that such control freak behavior usually doesn't stop at the first instance. It's usually a sign that management going on a power trip is only just starting. I've seen it before when places I worked for got bought out, or new managers hired.

I agree. OP: I'd guess if they'll have that level of control over your work environment, you'll have more to complain about in the near future. These seem to be control freaks, and they do ***not*** understand security at all. And if I were you and I decided to quit in that situation, I'd tell my manager exactly why I did so.

[deleted]

Yeah, emacs isn't the reason, it's just an indicator of deep issues that haven't surfaced, yet.

>From the other side of the issue, the security team is tasked with the job of protecting the company against threats which is essentially a state of perpetual paranoia The security team is really mistaken. If a developer's machine can compromise anything relevant, then the company ***really*** has a problem, and it's ***not*** that the tools are not standardized.

I mean the obvious solution here is to look for another job while continuing to work their current one

They might run a hash on the exe and discover that it’s not vscode. ps: I mean certutil in windows ; maybe an antivirus already does that

Installing, in Windows, mostly means copying in C:/ProgramFiles or the like, and for that administrative rights are needed. But you can easily keep Emacs somewhere else, in a location your account has write access to. You can do the same with a lot of programs. You might like Scoop https://scoop.sh/

could be, at least that would demonstrate a serious will and know-how on the other camp :)

If you have file space of your own, install it there.

Use Docker and create a minimal image with Emacs and your dependencies, that's how I run it nowadays.

TBH, there also isn't a culture of people downloading and executing Excel plugins that can do arbitrary network/disk access. People who use Excel generally only run Microsoft code. That being said, afaik VScode extensions aren't sandboxed either.

Many companies seem to fail to comprehend that desperation never leads to success.

Why do you need admin rights for Emacs?

It's not an editor, it's a lisp interpreter. Tell them it's a lisp interpreter that you use for code generation.

Definitely quit, with inflation and a shortage of experience SWEs, you can literally pick your job right now. Please don't play their game. Quitting is not only going to get you Emacs, but will 100% get you more money right now. Do it.

VS for ASP.net might have typescript dependencies which would need NPM? (Just guessing about this) EMACS has a package manager now but it doesn’t automatically make an outbound network connection to download ….

I worked very briefly at a big company in 2005 where they were telling me I had to use IE6 instead of Firefox for "security reasons" which made it pretty clear they had no idea what the hell they were talking about. I didn't last two weeks there.

I agree that NPM is a bigger security risk than Emacs. But to be honest, MELPA terrifies me quite a bit. It's unfortunate that so many useful packages are on there though.

This is a nightmare, wow. I'm sorry. This may not be good advice for you personally, but I'd immediately begin looking for another job. I can't fathom working in that sort of environment. I much prefer to do software dev at non-techy places. I'm currently employed at a souvenir manufacturing company, and they leave me to my own devices. Full access to my own machine, allowed to install and configure my own OS, and I don't have daily standups. They just come to me with what they need done, and I get it done. And due to the non-tech aspect of the company, the primary system I'm responsible for maintaining isn't bloated with all the latest trendy frameworks and libraries, which is a plus. Basically, my recommendation to people these days is: go do IT work at companies where tech/software isn't the primary product. They're generally much less stingy, and have a funner and less fake environment.

Yeah, I assume Emacs can be run as a portable app on Windows. I know Atom was able to be run portably without admin privileges.

That argument doesn't really hold up though. Just because one tool you use has security risks doesn't mean you should throw the whole idea of security out the window and adopt an anything goes policy. Even going beyond that if they do use NPM it is almost certainly used to build one or more of the companies products, without it they have to discontinue or at least pretty drastically overhaul the product whereas Emacs (or any other editor/IDE) can almost certainly be replaced without any impact on their ability to deliver their product (excluding whatever productivity loss the dev having to switch incurs of course).

Some good advice here and some terrible, yes push it up the line and see if that helps but people saying you should quit your job over this are not doing you any favours. The reality is that being overly attached to any dev tool is not a good thing for you as a developer. Don't define yourself as the emacs guy or put yourself in a position where you will choose or reject a job based on what dev tools they use. You are just putting unnecessary limits on yourself and your opportunities if you do so. Maybe the changes means that this ends up not being a company you want to work for, or maybe it's just teething issues that will resolve, who knows, but to let something as relatively minor as your ability to use Emacs have such a control over your career is not good for you.

I once terminated my employment because they would not allow me to use goto in C. I began writing a wrapper to convert goto to a larger if condition style handling, but I thought this was not a great long term solution. This was writing kernel code. Which as standard practice -heavily- uses goto in error handling.

Not if the browser/ssh connection is on the approved software list!

I have a few questions. 1) How do you edit your files in /home/ do you export it into the container ? Is there a better way ? (tramp ?) 2) How did you get emacsclient working to your instance inside the container ?

In fairness, I don't think anyone was suggesting that they quit their job without having already secured a better one. I think YMMV as to what effect your tools have on your work. I had to give up my window manager for a while due to an incompatibility with my work hardware (which is more minor than changing text editors, if you spend most of your time in your text editor), and that still affected me negatively -- it's not that I was *very* much slower doing things; but there was daily friction and irritation on account of the default WM's shortcomings that I hadn't been experiencing previously. I spent time trying to configure it to behave better, but there was only so much I could do. When I finally found a fix and could go back to my familiar tool, I was measurably happier. Emacs users are quite likely to have spent time making their tools Just Right for them, which is probably why so many people here can't imagine working somewhere that prohibited its use, because not using it takes away the tool they've spent time making their own, and introduces all kinds of friction and irritation. > The reality is that being overly attached to any dev tool is not a good thing for you as a developer. Don't define yourself as the emacs guy or put yourself in a position where you will choose or reject a job based on what dev tools they use. You are just putting unnecessary limits on yourself and your opportunities if you do so. That's totally fair advice, but at the same time I think lots of people would happily choose to ignore it.

Look, being able to use many different tools is certainly a benefit, but you should be allowed to use tools that make you the most productive. I wouldn't hire a contractor and demand that they only use flat-head screwdrivers no matter what the shape of the screw is—sure, it may actually be able to get the job done eventually, but there are better tools for the job. I've tried probably a dozen different editors over the years (more than 20 years!) of programming, and I've always come back to emacs. A lot of it is muscle memory, but there are things that are just difficult to do in other editors. Emacs isn't exactly some sort of weird piece of malware, it's a decades-old text editor.

Fair enough. Isn't MELPA at least _minorly_ audited, though?

I'm not saying the company is making the right decision here, preventing devs from using tools that make them productive is most likely a bad idea. I'm just saying that it is not good for a developer to become overly attached to any tool, even if it is as amazing as Emacs. As for your contractor analogy, it's quite common in contracting companies to standardise on brands of tools used etc. If everyone has DeWalt tools then all the chargers, battery packs etc work together and anyone can easily take up any tool and be productive. Yes, you make a tradeoff that sometimes another brand of tool might be better, or someone might prefer it but sometimes having everyone using the same tools is an advantage.

> Just because one tool you use has security risks doesn't mean you should throw the whole idea of security out the window and adopt an anything goes policy. Yes but it does bring to question how does a company choose what security risks are allowed. > Emacs (or any other editor/IDE) can almost certainly be replaced without any impact on their ability to deliver their product (excluding whatever productivity loss the dev having to switch incurs of course). And that's where you have to make a case that use of whatever tool you want to use. You're making a case to a operations manager or it manager. Not the CEO and/or CFO.

Uh, OK. I've never had a problem asking for a particular text editor or IDE. I mean never. This sounds really odd. I don't know who your employer is, but it sounds like they don't have a clue when it comes to writing and developing software.

Thanks for saying this. GNU Emacs for Windows can installed and run entirely without admin rights, from an unprivileged location. You only need the ability to write to a directory. Download the [precompiled Windows binaries](https://mirrors.kernel.org/gnu/emacs/windows/emacs-27/) from a GNU mirror, create an empty directory in C:\\Users\\Public\\Documents, unzip the file into that directory and run it from there. You will need to modify some environment variables (PATH, HOME, INFOPATH, TZ) or create an initialization batch file which sets these variables up before calling **runemacs.exe**. As an alternative, if you are approved and allowed to install [Cygwin](https://cygwin.com/), that is a feasible solution. Cygwin's setup package has an option to install Emacs in the usual locations.

Tbh I havent used vs studio (currently just a cs student and prof just lets you use whatever, although he recommends vs studio. I use emacs ofc). What is so unusable about it?

Not really. There's a review process for adding packages the first time, but any updates are not reviewed. Even then, I think the initial review is just for style issues.

It’s time to pack up and go. I assure you this will be the least of your troubles.

Welcome to Boeing. ;) These consulting firms are not responsible for outcomes, so fuck them - their inputs are mere data points but are treated as God speak. Normally consultants are hired to: 1) Reinforce predetermined outcomes, 2) Meet some compliance standard that has no concept productivity impact (i.e., learn to live by check boxes), and 3) Some Exec's mechanics to climb the ladder and who won't be responsible for the outcome, assuming there are anything but predetermined measurable metrics. \#3 is the most predominate. My opinion: 1) Struggle with the system for some time while it is in place, 2) Adapt, and/or 3) Don't give a shit as you're looking to leave.

Hm, well there are many things to dislike, and many of them apply to Windows itself too, as well as most of Microsoft’s other products. Apart from it being proprietary software distributed in binary, it’s very bloated and slow. You can’t be sure it does not track you, like they do with Windows, Edge etc, as you have no way of verifying what the program does. Also, you are not truly the user of it, as you are not allowed to alter it in any way you want. With Emacs, you are encouraged to do so, as the lisp engine it runs on is exposed to you in real time, so you can even modify it while it’s running. Not only is it easy to do so, Emacs also has a software license which allows you to run, study, share and modify the software - this is unthinkable with proprietary products like Visual Studio.

Quit this company.

From the brew docs: >This script installs Homebrew to its preferred prefix (/usr/local for macOS Intel, /opt/homebrew for Apple Silicon and /home/linuxbrew/.linuxbrew for Linux) so that you don’t need sudo when you brew install. It actually doesn't even allow you to use sudo, if you try sudo brew, it will warn you not to use sudo and exit.

1) just mount your home as a volume inside the home of the image. 2) The entry point of the image should be an emacsserver command with the parameters you want.You should provide DISPLAY env. 3) Then just run a docker exec <emacsserver-container> with a emacsclient command to attach to the server. That's the concept, it's a question of try and error until you got it running. I recommend no to mount your home until you are sure it is working properly, first try with a test directory with test files. I do not use Emacs to edit paths that are not inside my home dir, so for me this works. If you just need a plain Emacs server I recommend using Alpine as a base. I personally have a Debian 11 slim.

Quit this job

Install VirtualBox and then run Emacs in virtual machine (OS is Linux, of course).

Once I leave a company after security team allow only Ubuntu installation. There are some many nice companies, who cares about results not tools. Why do you need to care about somebody's paranoia?

Damn. Feel like that could and should be changed for the better.

My company has the same policy WRT laptops. It's a complicated issue because we work in life sciences and have to pass audits so I get it. As a workaround they setup an Azure windows VM with full admin access that I can install anything I want on. Fair compromise. If they wont accommodate you somehow then the writing is on the wall... leave

If you are smart enough to use and like emacs then you don't need to work for them. You can either work for a cool startup where you decide about everything, or become a very well paid contractor who also chooses his tools. Life is too short and to beautiful to waste it on this corporate bullshit

> The reality is that being overly attached to any dev tool is not a good thing for you as a developer. If you have 1000+ hours of time in your emacs config with countless workflows automated and "you-hacks" like "reminder to take a break every 20m in $annoyingCodebase" that's not so easy to do. Nor is it clear it's the sensible thing to do.

Excel spreadsheets can have VBA scripts embedded in them. These scripts can do absolutely anything. There is no sandbox. I once used such a script to make an Excel spreadsheet that served as the UI to a JSON RPC webapp.

Exactly, this is just the situation I was in. Had a fine position, made decent money, learned plenty of stuff but knew I was 100% expendable so I always had my eyes and ears open for a fit at a company I felt better about being at.

From my own experience with rogue devs, a rogue developer is like having a malicious hacker on the inside. I'm not saying that the case here, but that is the reality from the security perspective. Is it overwrought? For the most part yes, but there have apparently been enough of those incidents that it's not something that can be hand-waved away. As I mentioned, I see both sides of the issue, and having been on both sides I've usually found that staying professional and being willing to openly discuss the issue generally gives the best result. I will also observe that it is also important to understand that the people paying your paycheck are the ones that get to make the rules, so it is essential to be prepared to negotiate for what you want, realizing that you may still not get what you want. It's not fun, and often not fair, but that's the reality of working for a company that you don't own. 🤷‍♂️

> actual push toward containers like they were static binaries it's really disturbing for me... A simple tarball with a compiled binary plus few eventual deps equally compiled locally suffice, it's faster, lightweight, simple to keep up to date etc > > Snap&c serve a sole purpose Container technology has two critical pieces: the container image format and the container runtime, serving two purposes: shipping software and sandboxing it, respectively. A container image is indeed little more than a glorified tarball. However, you seem to be glossing over the more interesting and (from a security standpoint especially) more important part: the container runtime, which sandboxes containers through Linux kernel namespaces, control groups, and SELinux policy, using bind mounts as needed to grant selective access to parts of the host filesystem. In this way, container technology mitigates security risks and enables users (and their IT departments) to have greater confidence that the contained software cannot cause unforeseen problems on the host system. Done right, this is beneficial for users and for FLOSS.

Sorry for the delay, but I disagree: yes, containers these days are sold as glorified tarballs but they aren't. There is no absurd reason for witch I have to download as almost-entire pre-deployed distro just to run few bits of code that can perfectly run in my own environment. Classic desktops, modern Emacs state a very clear thing: an OS MUST BE a single application, easy to bend, mold, used by the end users, no constraints at all should be there. That's the power of IT. Containers are the continuation of classic IBM model, after the GAFAM model who steal part of Xerox tech bent in way that live some crumbs to the user, while granting benefits to the vendor. Such design is the antitheses of FLOSS philosophy. Also, so far containers have completely failed to prove they mitigate security issues, actually they are just adding big attack surface, gazillion of unpatched vulnerabilities and a FALSE sense of security with holes here and there "just to be usable". The safety part is a classic PR lie too many eat without thinking. As a sysadmin I can't absolutely trust third parties containers nor I can accept fellows admins under my responsibility who trust them "because they are safe being partially isolated". That's NOTHING done right in containers, except the business push to annihilate the last part of FLOSS community now transformed in free workers... Consider just the fact that you can't deploy containers without an infra and such infra must sustain their overhead. Consider that such infra is normally now neglected since it's mostly on someone else computer (cloud, or default-install "endpoints", nice name for very expensive modern dumb terminal once desktops), images are the same, full of vulnerabilities because the author of a small chat client do not care about OpenSSL patching we/she even do not know much and no one else care "because of containers", just remember https://xkcd.com/2347/ and classic movies with a hyper-armored door with a super-safe lock, mounted on a fragile wall. Modern systems themselves are not well done, they are just crap. A good system is the classic single-application easy to be mold, easy to maintain that does not demand a gazillion of SLoC and compilation and packaging etc because it's just a damn single app, easy to change even at runtime. A good system is a system that serve us users, not it's vendor, where the user is at the center, not the infra, where anything can still work if something else does not. Just see Plan 9 "really everything is a file": why we need countless protocols to talk with various network software? In Plan 9 model I can read mails just importing the inbox filesystem. I can post on a social network just reading and saving files in the same way etc. Oh "that's not efficient". Really? It's not efficient having a gazillion SLoC less and doing far more far more easy than craft countless layer of bloated code? Is more efficient a car that's easy to repair and adapt or one that needed to be demolish if you just have a flat due to a nail?

emacs was banned in various places around DEC in the 80's-90's. It was too much of a burden on DEC's giant top-of-the-line VAX clusters, which says something about DEC's hardware. Where is DEC now?