Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
Search - "security disaster"
-
!!rant
When I worked at a previous job, they only gave out decent titles (and salaries) to upper management. Everyone else... well... I was the Domain/Sysadmin, responsible for the domain and both DCs, upgrading the physical network (plus recabling it: the MDF was a *disaster*), as well as all backups, migrations, printers, servers, and workstations/lappys in the building, plus pushing software, antivirus, updates, security policies, etc. I had complete access to everything, and ofc was responsible for everything. Nothing on my network caused anyone (else) any trouble except one particular printer I wasn't able to replace. Also, nothing new appeared on my network without me noticing and tracking it down.
But my official title? "IT Assistant".
I made $11/hr.
Worth it? Take a flying leap into an overflowing outhouse during the height of a Vegas summer if you even begin to think so.
I eventually managed to switch to a developer position, and (after several attempts) got a ~$5/hr raise. The girl they replaced me with in IT with some ditz who had never installed an OS before, didn't know what the BIOS was, and couldn't figure out why a monitor... plugged into itself... wasn't working. Things went downhill from there.10 -
*places an order on OnePlus' website for that OP6T*
Alright, payment.. with my bpaid card that I ranted about earlier, because apparently the fuckers accept only credit cards. External payment portal, card's got a chip.. well that's gotta be the same payment process as the usual Bancontact purchases then, right? Where you plug your card into your Digipass card reader, get a start code from the website, type that in, amount to be paid, PIN code, and then it spits out another code that you give to the payment portal.
Except it isn't. That CVC thing is apparently the only thing that stands between you using your card and someone else doing the same with your card information. Not even the card itself! Why the FUCK do we even have PIN codes then?! This is even worse than the magstripe and the skimming issues related to it (the magstripe essentially just blurts out your card information to whatever wants to have it, so demagnetize it and don't use the payment terminals who refuse your card on grounds of not being able to read the magstripe afterwards. Your chip should be responsible for that.. but I digress). Credit cards with chips in it that aren't even used. That's what you Americans use? Seriously?!
At this rate, you can keep your fucking credit cards.10 -
I'm halfway in on a six-month disaster contract where I'm converting a massive site written over 7~8 years to a new system. Manager has had us restart about 4 times and there are other departments who want to take over. The deadline is so tight that I've stuck with the original plan and kept my code flexible to be changed if the manager wants to go with the other teams' ideas. ("Okay, manager: here's a clone, tell the other team to prove that works") The lead dev, to my horror, didn't write any code and was let go in November.
Manager hired a new dev part-time whose commitment is on something entirely separate that is required in order for the deadline to be pushed to Summer. (new thing for old thing)
New dev has an attitude, basically wants to start over, and is already acting like I'm his subordinate, very patronizing, very dodgy when asked to explain a strong opinion (THIS IS A SECURITY PROBLEM!!!1). I really have no idea what my manager promised to him. Also found out that manager hired an agency to create a roadmap of the project (WHY?!!! WHY NOW?!). I've been burned once already with the previous lead, and I'm not wild about working with yet another person who wants to burn the whole thing to the ground and start completely over, especially not someone who wants to engage in a dick-measuring contest.
Do you guys have any advice? I mean, other than quitting? I'm going to see this through, but I'm burned out.3 -
"The Phoenix project" alternative ending:
Bill Palmer manages to avert disaster with heroic efforts, working 18 hours per day for weeks.
His wife files for divorce. He starts to sleep at office, next to the servers room.
At the last moment a huge hacker attack almost destroys everything, but he finally manages to announce that Phoenix is ready on time, security auditing passed and any kind of great improvements.
Steve, the CEO, calls him and says: "are you crazy? we put you on an impossible project with short notice to make you fail! All our investors have been secretly short selling our stocks, so now they are waiting a big failure to cash in. We also paid korean hackers to bring you on your knees. But you are really stubborn! "
All Phoenix Project is rolled back, huge shit happens, stocks fall, investors ripe great benefits. All IT is outsourced to an external company (owned by members of the board)
Bill is fired. His reputation tainted by the failure, he can't find job anymore. his technical skills and knowledge are out of date.
As he didn't have time to take care of divorce he has lost also all his personal wealth.
He writes a book about his experience, well, actually a rant, but the company sues him forcing him to pay more money.
In the final scene, police arrests him, drunk while trying to burn a server farm with matches. -
Anti-features need to be fought with fire (metaphorically speaking).
This means they must be eliminated, not just made optional.
Why? Because an optional anti-feature is just one step away from a mandatory anti-feature.
For example, "secure" booting: https://youtu.be/vvaWrmS3Vg4?t=750 (Jody Bruchon)
Another example are disguised remote kill switches, such as add-on signing ( https://digdeeper.club/articles/... ). It started as optional and people were able to opt out, and everyone accepted it because no one expected what would come next.
All that was left was removing the ability to opt out, and then Mozilla has control over which extensions users are allowed to use.
For years, this feature sat dormant and users did not know of its existence. But in early May 2019, the metaphorical thread snapped and an expired certificate remotely disabled all extensions, wasting millions of man-hours of productivity.
From the digdeeper.club article:
"The funny thing is, the whole point of the extension prison was allegedly to increase security - and yet today, all security addons got disabled because of it! Shows how freedom always has to trump over security or it ends up in a disaster like this."
Evil needs to be nipped in the bud before it can flourish.2 -
Microsoft is responsible for protecting the Office 365 physical and virtual infrastructure and ensuring availability. Although Microsoft addresses certain security threats, it cannot prevent all malicious threats. Businesses are responsible for protecting their data. This means that if a business’s Office 365 data is compromised or corrupted, it is not Microsoft’s job to restore the data outside of the Software Licensing Terms. To protect data, businesses need to make sure they have office 365 disaster recovery and recovery plans in place2