This is exactly why no code / low code solutions don’t really work. At the end of the day, there is irreducible technical complexity.

I feel like I have have heard this exact statement about model FooBar X.Y about a half dozen times over the last couple of years.

I have never heard of shadow IT. What is that?

It's when the users start taking care of IT issues themselves. Maybe the name comes from the Shadow Cabinet in England?

Where it might not be obvious is that IT in this context is not just pulling wires and approving tickets, but is "information technology" in the broader sense of using computers to solve problems. This could mean creating custom apps, databases, etc. A huge amount of this goes on in most businesses. Solutions can range from trivial to massive and mission-critical.

I think the term is mainly just because it tends not to be very visible/legible to the organization as a whole (and that's probably the main risk of it: either someone leaves and a whole section of the IT infrastructure collapses, or someone sets up something horrifically insecure and the company gets pwned). Especially because most IT departments hate it so there's a strong incentive to keep it quiet (I personally think IT organizations should consider shadow IT a failing of themselves and seek out ways to collaborate with those setting it up or figure out what is lacking in the service they provide to the rest of the company that means they get passed over).

That's quite possible. I've done a certain amount of it myself. A couple of programs that I wrote for the factory 15+ years ago are being used continually for critical adjustment and testing of subassemblies. All told it's a few thousand lines of Visual Basic. Not "clean code" but carefully documented with a complete theory of operation that could be used as a spec for a professionally written version.

My view is that it's not a failing, any more than "software development can't be estimated" is, but a fact of life. Every complex organization faces the dilemma of big versus little projects, and ends up having to draw the line somewhere. It makes the most sense for the business, and for developer careers, to focus on the biggest, most visible projects.

The little projects get conducted in shadow mode. Perhaps a benefit of Excel is a kind of social compromise, where it signals that you're not trying to do IT work, and IT accepts that it's not threatening.

There's a risk, but I think it's minimal. Risk is probability times impact, measured in dollars. The biggest risks come from the biggest projects, just because the potential impact is big. Virtually all of the project failures that threaten businesses come from big projects that are carried out by good engineers using all of the proper methods.

It's where you have processes etc set up to manage your IT infra, but these very processes often make it impossible / too time consuming to use anything.

The team that needs it ends up managing things itself without central IT support (or visibility, or security etc..)

Think being given a locked down laptop and no admin access. Either get IT to give you admin access or buy another laptop that isn't visible to IT and let's you install whatever you need to get your job done.

The latter is often quicker and easier.

What sorts of techniques can be used to deal with those issues?

It’s so much easier to sell yourself when you write solid code

If you don’t write solid code, it’s so much more important to be better at selling yourself than those who do.

Note the projects that use that software, also note metrics like API calls received, failure recoveries, uptime, etc and put that in a promo packet

Thanks, I genuinely appreciate the advice!

Exactly. I think it’s pretty clear that software engineering is an “intelligence complete” problem. If you can automatically solve SWE than you can automatically solve pretty much all knowledge work.

A lot of modern corporate work is bullshit work.

I don't think it is too outrageous to believe that LLMs can do a lot of what all those armies of corporate bureaucrats do.

The difference is that unlike SWEs, the people doing all that bullshit work are much better at networking, so they will (collectively) find a reason why they shouldn't be replaced with AI and push it through.

SWEs could do so as well, if only we were unionized.

Gotta agree that you have a point here, a pretty strong one indeed.

All of those things are great and should be afforded to every Person. In many places, they are.

Out of curiosity (not accusation, I promise) how did you make it?

What kind of obscure insecure defaults are there?

Check out the Microsoft baseline security guidelines for Windows 11. It's about 400 entries. 400 settings that Microsoft themselves recommend changing from the defaults to achieve a baseline security.

Why does windows 11 show stock values in the task bar by default? Why does it show ads, games and yellow press headlines when you click on it? On the enterprise edition! Xbox services are installed and running by default. Why?

Changing the default would cost sales and increase support costs.

Direct Send was my favorite. Direct Send allows devices to send unauthenticated email to internal recipients using your organization’s domain, which can expose you to internal emails for phishing etc. It bypasses user authentication, making sender identity difficult to verify or audit. For all orgs made before mid 2025 it was enabled by default.

I saw a great Blackhat talk this year about Entra misconfiguration that got Microsoft's own sensitive internal services owned by a researcher, one of them owned by their security team. After the report they reconfigure their services, didn't pay a bounty and considered the problems solved. What about their customers making the same config errors as the Microsoft team... no changes planned.

There's much much more...

Everything on by default in general has plagued them, because they don't want users to complain it doesn't work.

One not-so-obscure problem is how hard it is to only elevate yourself to admin when you need it (and run as a regular user the other time).

Essentially you need to pay double license for admin users so they can have two logins; and it's a pain to quickly elevate privilege to do day to day admin tasks.

So if your friendly domain admin clicks the wrong link, your entire network is owned.

Obscure from a typical user's POV: the fact that file extensions are not being shown by default. This makes it possible for the user to click on a file that has the extension and the icon of a picture (imbedded inside), but turns out to be an executable file.

They've apparently had a corporate philosophy of obfuscating the underlying system from the end user and deliberately inhibiting their ability to learn how it fits together since at least the early 2000's.

I feel like the current ignorance of the average computer user was a deliberate outcome they've been working towards for more than 20 years. As someone who has been using computers since the late 80's, I find their current offerings harder to use than ever.