You must log in or register to comment.
Everyday my misnathropy is justified
I majored in Anthropology in college. I should have done Misanthropology.
Print the fucking t-shirt man. I’ll buy one for every day of the week.
Every day I wake up I thank God I’m not an MBA 🙏
“This fucking paycheck! What am I going to do with all this money?”
It’s not more secure, it’s so they can offload blame and have people to sue if/when something ugly happens. Liability control, essentially.
We had to pay for fucking Docker container licenses at my last job because we needed an escalation to the vendor in case our SMEs couldnt handle things (they could), and so we had a vendor to blame if something out of our control happened. And that happened: we sued Mirantis when shit broke.
Ever hear how the suit turned out, generally?
This pisses me off
Don’t forget your new 32 character/symbol/number/nordic rune passwords that will need to be changed every 17 days.
I hate sites that make me constantly change passwords. it’s been shown time and time again that making users change passwords often decreases security by a pretty large factor, and yet a lot of sites still do it
Interesting, stopped seeing this a while back. Forced change after the inevitable hack though of course
Our workplace did that. You had to change every month and you weren’t allowed to just add a digit. It meant that people started writing their passwords on post-its stuck to the monitor.
Mind you, back in the 90s your password was the same as your username. It was very handy, because if someone went home leaving a document locked, you could just log in and unlock it. Our first “proper” IT professional was horrified.
And don’t forget required 2-factor authentication, in an age where that becomes 1-factor authentication as soon as someone has your phone, because both factors are accessible there!
2FA is utterly worthless in the age of smartphones, and whenever my employer tries to implement it, I refuse and tell them that, if they want me to do 2FA, they can either provide me with a work phone, or they can give me a USB key that is just going to sit in my desk drawer.
which still requires someone to swipe the phone and the owner not recognizing it long enough to do a remote wipe. I am not someone who hangs on the smartphone 8 hours per day, and even i would realize my phone is gone within 15 - 30 minutes, giving an attacker a pretty small time window to act.
e: and they have to break into the phone as well - if it’s updated, that might buy more than enough time
My last boss got rid of the pfSense routers because “open source is not secure”. I argued that pfSense has been vetted over and over and over again. Nope. “Everyone can see the source code.” That’s the fucking point!
TBF, pfSense isn’t the fastest routing, but at our small company is was more than sufficient.
For a small to medium sized business pfsense is the only solution that makes sense. The only requirement is that you have a actual sysadmin on staff and not a vendor jockey.
OPNsense is also a viable alternative.
Tried that for awhile at home, just didn’t seem as robust. Also, you can get Netgate hardware if the company doesn’t want a 10-yo Dell running the edge.
I’ve had opnsense running for 7 years without a single issue. It might be the most reliable part of my whole setup.
There is an entire sub-industry and probably thousands of jobs being propped up by this stupid way of thinking about software. I can’t be mad at it because it pays the bills for a few of my friends…
I could really see companies just fork open source and give it a tweak like UI or new switches…
Terrible.
At one point my company made us buy Eclipse from a vendor because free software was not allowed. It had no tweaks or support, just out of date Eclipse that I had to wait for purchasing to get
I could really see companies just fork open source and give it a tweak like UI or new switches…
They should not be able to do that if it comes under non commercial licence
Won’t stop some people.
Vim? Oh wow. I’d be looking into a USB Keyboard that types the entire source code of vim into the machine, assuming there isn’t an easier option.
Worked for a company that had a similar policy against free software, but simultaneously encouraged employees to use open-source software to save money. I don’t think upper management was talking to the IT department.
Nice. My response is my 2-week’s notice.
It’s “more secure” because there’s a specific company to blame when it goes wrong.
Security through liability
The bigger you get the more this is a thing actually.
My old boss called that “one neck to choke”.
Yeah, i worked briefly at multinational japanese motor company and this was their logic. I was hired as a software developer contractor and HQ had rules stating, no open source software, no free software and the one that puzzled me the most no in house executables (WHY THE FUCK DID THEY HIRE ME?)
How were you supposed to test your software if you weren’t allowed to create an executable?
insert thats the neat part meme
Eventually it was decided I would write Javascript on a web page I made. Skills I never declaired having I told them I was a java dev.
Javascript is a part of Java, duh!
You had to go to the balcony to test it.
Honda?
Nope.
I am becoming increasingly more appreciative of the fact that I have root access to “my” company provided work device.
My boss went so far as to buy Macs because we have “special needs” (we don’t) because otherwise we’d be forced to use the corporate locked down crap. I’m not a big fan of macos (prefer Linux), but root access sure is nice.
I had to move to a Mac because of iOS development. Now I’m stuck with a Mac because the fucking thing refuses to break.
Wait till they learn about Jamf Pro and Mosyle 😜 (Well… granted they also have to deploy it correctly after…)
They did make us install Crowdstrike after 3-ish years of no spyware. We still have root access, they can just see every time I update my packages.
“If you’re not paying for the product, then you are the product.”
The phrase has its uses, but shit like this is what happens when it’s taken to the extreme.
Often times when you pay for the product, you are still the product.
I’m the product in the sense that poo is the product of the intestines.
That is just a fact at this point
The simple exception is free software (free as in freedom). It’s really not that complicated.
Digital security education in schools actually give people brain tumour ffs
this is supposed to be more secure because it costs money
It makes blaming someone really easy though and that’s all that matters in a corporate world.
This is legitimately it. The same reason corporations often pay for Linux (e.g. RHEL)—the people in charge want to be able to pick up a phone and harass someone until they fix their problem. They simply can’t fathom any alternative approach to managing dependencies.
Not just pick up the phone and harass someone but to also have someone to press a lawsuit against if things go really wrong. With free software the liability typically ends at the user which means all they can do is fire the employee and eat the loss. Suppose now corporate paid for it, well now there is a contract and a party that can be sued.
As if the Eulas don’t make it all arbitration?
What software company allows liability for mistakes in a EULA?
Most do, but limited to the amount of the contract.
So corporations are just The Gang in It’s Always Sunny In Philadelphia?
The greentext reminds me of this FAQ entry: https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-vendor
A.9.17 As one of our existing software vendors, can you just fill in this questionnaire for us?
We periodically receive requests like this, from organisations which have apparently sent out a form letter to everyone listed in their big spreadsheet of ‘software vendors’ requiring them all to answer some long list of questions […]
We don’t make a habit of responding in full to these questionnaires, because we are not a software vendor.
A software vendor is a company to which you are paying lots of money in return for some software. They know who you are, and they know you’re paying them money; so they have an incentive to fill in your forms and questionnaires […] because they want to keep being paid.
[…]
If you work for an organisation which you think might be at risk of making this mistake, we urge you to reorganise your list of software suppliers so that it clearly distinguishes paid vendors who know about you from free software developers who don’t have any idea who you are. Then, only send out these mass mailings to the former.
I read only part of the URL and thought this was about puzzles. Never knew the guy made Putty as well
Would be really funny if they still get fucked over because of some fine print in the disclaimer
Or maybe the vendor goes with “take the money and run”.
My previous employer was bought by a huge company. I liked it in the small company, because I had freedom to do what was needed without much questions, and I was trusted to make the relevant decisions.
When we came under the big corpo, we got an email instructing us to list all the software we used/needed, so that it could be added to the whitelist that big corpo worked with. Anything not in the whitelist simply couldn’t run.
I gave them the list, but spoke to my on-shore It guy that out in the field we often needed to install something that we didn’t need before on short notice, and waiting for a ticket to be resolved for an administrative matter had the potential to stop production.
They found it easier just to make an exception for my work PC. I just had to promise not to VPN in to the office while running “weird” stuff, otherwise the higher ups would get upset.
That’s fine. I had my own VPN for only the stuff I needed anyway. I VPNed into offshore production systems on a daily basis. I needed to VPN I to the office once or twice. Plus in my book, the “main” VPN client is what I consider weird software. My shit was basically a wrapper around openvpn.
EDIT: To be fair, the huge corpo employer wasn’t unreasonable. It was just so large with so many employees that strct security implementations were needed for IT to have some sort of control. I was technically also IT, but I only dealt with field equipment, so that IT could focus on “normal” stuff. They trusted me to handle my end, they handled theirs, and we usually cooperated fairly well when our systems “met”.
“we need this NOW”
> Package I install is immediately black listed by IT, I submit a high priority ticket and I don’t hear from them for days, maybe weeks
Like what the fuck can I do
“Yes, but does one of the existing whitelisted executables fulfill the same function?”
“Have you tried using MS Excel instead?”
*Looks at industrial robotics with a proprietary TPU that needs a firmware update.*
“Yes”
