Why didn’t I think of this?
  • dual_sport_dork 🐧🗡️@lemmy.worldEnglish
    3154·
    9 months ago

    I did a similar thing at a place I worked at. In order to go over the heads of insane management and actually get work done, rather than just have sugar cubes counted at me all day, I created an administrator account with the username of  .

    Not blank. The character " ".

    What, you can’t see it? It’s a non-breaking space. You can type one (on a Windows machine) by holding Alt and pressing 0160 on your number pad.

    A shocking amount of “enterprise” software is not equipped to handle a non-breaking space, and will not detect it as a naughty character nor treat it as whitespace – which is probably what should happen. So what you get is an invisible user, which is also helpfully sorted to the bottom of lists where no one will notice it, because its numerical index in character space is well below all the typical letters and numbers that’ll be used for user account names. Does your software require a user name of greater-than-one character length? No problem, just type in a whole bunch of them.

    Non breaking spaces can also mess with the formatting of systems with user-facing text input that’ll regurgitate it later. Like, oh, forums. Or comment threads. Like this one. Even those that are “smart” and attempt to collapse repeated whitespaces into a single line break.

    For instance.

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    Yeah, that sort of thing.

    • Punkie@lemmy.worldEnglish
      93·
      9 months ago

      I was burned afoul by a former admin who, instead of diagnosing why a mail service was failing, labeled a script as a /etc/cron.d file entry as “…” (three dots) which, unless you were careful, you’d never notice in an "ls " listing casually. The cron job ran a script with a similar name which he ran once every 5 minutes. It would launch the mail service, but simultaneous services were not allowed to run on the same box, so if it was running, nothing would happen, although this later explained hundreds of “[program] service is already running” errors in our logs. It was every 5 minutes because our solarwinds check would only notice if the service had been down for 5 minutes. The reason why the service was crashing was later fixed in a patch, but nobody knew about this little “helper” script for years.

      Until one day, we had a service failover from primary to backup. Normally, we had two mail servers servers behind a load balancer. It would serve only the IP that was reporting as up. Before, we manually disabled the other network port, but this time, that step was forgotten, so BOTH IPs were listening. We shut down the primary mail service, but after 5 minutes, it came back up. The mail software would sync all the mail from one server to the other (like primary to backup, or reversed, but one way only). With both up, the load balancer just sent traffic to a random one.

      So now, both IPs received and sent mail, along with web interface users could use. But now, with mail going to both, it created mass confusion, and the mailbox sync was copying from backup to primary. Mail would appear and disappear randomly, and if it disappeared, it was because backup was syncing to primary. It was slow, and the first people to notice were the scant IMAP customers over the next several days. Those customers were always complaining because they had old and cranky systems, and our weekend customer service just told them to wait until Monday. But then more and more POP3 customers started to notice, and after 5 days had passed, we figured out what had happened. And we only did Netbackups every week, so now thousands of legitimate emails were lost for good over 3000 customers. A lot of them were lawyers.

      Oof.

      • Kid_Thunder@kbin.social
        421·
        9 months ago

        I was shadow IT for a project and asked IT to design this special unconventional thing which of course they wouldn’t. So I made this little embedded linux device to take care of it. Gave them the design and steps I made and all that. They were like “nah” so I told them to give me admin on their file server and switch and I’d just do it myself. So they did (lol?).

        I had to create a service account, so instead of just having the system account do it on their file server because I figured that wouldn’t be OK. I asked them how do I properly get a service account approved and they passed me to Cyber who had me submit a user request. It got denied because it didn’t have a signed user agreement or a Sec+ or similar cert…

        So I created a word doc that said “I am not a real person and therefore cannot sign any contracts. I am just software man.” and exported it to PDF and named it the same name of the agreement file name. Did the same for the cert. They approved it.

        Then nobody ever created the account because IT’s helpdesk couldn’t figure out how to do it. I think it was more that they probably didn’t have an OU structure properly set up so they wanted some architect or something to weigh in.

        Anyway, I just let System do it because, well I had been waiting months at that point. The service account probably still doesn’t exist in AD. They then took my admin privs away and got credit from upper management for solving this odd problem that my stuff took care of.

        Eventually they needed a more robust solution and also in a few more places since it worked well but they started slamming it a bit too hard with data. They wanted to just keep giving me specific rights and then take them away when I was done but also submit paperwork every single time to them to do it.

        Apparently, I burnt bridges when I said “nah” as a Reply to All when they told me that. But who cares to have a bridge to nowhere anyway? As far as I know (since I still occasionally get a technical question about it) my little guy is still chugging away today, though I’ve moved on since then.

      • wahming@monyet.ccEnglish
        274·
        9 months ago

        A lot of them were lawyers.

        I’m not seeing the downside here

    • Moose@moose.bestEnglish
      65·
      9 months ago

      I enjoy that the character that can break a lot of things is called the “non-breaking space”.

    • yamanii@lemmy.worldEnglish
      20·
      9 months ago

      I only know about it because it was a popular way to make an invisible folder no the desktop, teens loved it for stuff.

    • driving_crooner@lemmy.eco.brEnglish
      121·
      9 months ago

      I did a lot of web scrapping this week at work and it’s looks like that character is used a lot on XPaths and CSS selectors. I only noticed it because VS Code put a yellow box around the character and give you a warning that that character is not a whitespace.

    • Guest_User@lemmy.worldEnglish
      8·
      9 months ago

      Where did you make the admin account if you don’t mind me asking. You saying you made a local admin account or maybe an admin account in AD?

    • lowleveldata@programming.devEnglish
      6·
      9 months ago

      That’s interesting but what I really want to know is what kind of evil things you did with the invisible superpower

    • Bassman1805@lemmy.worldEnglish
      61·
      9 months ago

      Connect for Lemmy renders these as  

      So it’s at least acknowledging that there’s something there.

    • muntedcrocodile@lemmy.worldEnglish
      31·
      9 months ago

      Its rendering as a spacw for me on eternity lol. U can also put it in the middle of words to make word count heigher than it should be lol.

      • PlutoniumAcid@lemmy.worldEnglish
        5·
        9 months ago

        It is a space, so it’s correct that it shows up. Non-breaking means that something like line wrap won’t happen.

        Putting it in the middle of a word will show up. That trick must’ve been a different character.

  • jjjalljs@ttrpg.networkEnglish
    1676·
    9 months ago

    There was a brief period at an old job where people thought it was hilarious to change their name to other people in slack (or maybe hipchat? whatever we used at the time). Like, change your name to the team lead and be like “I smell like butts.” Funny! HILARIOUS.

    Until I asked 'What are you going to do when someone messages you instead of the person whose name you took with “I’m so sorry about your miscarriage. You can take off as much time as you need” or something else really private.

    “Oh. I didn’t think of that.”

    No shit.

    Yes, I am a kill joy.

  • slaacaa@lemmy.worldEnglish
    706·
    9 months ago

    We use MS Teams, and even if there’s so much shit you can throw at it for valid reasons (e.g. not working with AirPods Pro 2, wtf?) this could never happen, as our single MS Office account is linked throughout all the software/services we use (and of course you can’t change your name).

    I don’t undertsand why a corporation would give up this kind of central account control and use a service, where - based on the article - most likely a poor IT admin guy has to manually search for the username of a leaving employee.

    • Evotech@lemmy.worldEnglish
      27·
      9 months ago

      It would’ve been connected to his email… You just need good offboarding routines

    • soggy_kitty@sopuli.xyzEnglish
      221·
      9 months ago

      Ignorance and/or incompetence.

      Thats your answer to “I don’t understand why”

    • Toribor@corndog.socialEnglish
      15·
      9 months ago

      Slack Business/Enterprise supports SAML single sign-on. At any scale larger than a single team or two this is probably the better way of handling it, then the account gets disabled as soon as it’s disabled in the identity provider. Otherwise if I remember right Slack accounts are tied to the email address and users can set their own display names. I used to administrate Slack for ~60 users but now we’re on Teams.

    • corsicanguppy@lemmy.caEnglish
      10·
      9 months ago

      a poor IT admin guy has to manually search for the username of a leaving employee.

      Your comment suggests you think IT Admins are told about departing employees, timely or at all.

      HR doesn’t trust Staff with that knowledge, even if that Staff member needs to disable an account because we must act quickly to protect the company against the same horrible criminals who enjoyed free reign and ultimate trust as the paragons of virtue they were the MOMENT before they were fired.

      • Rakonat@lemmy.worldEnglish
        6·
        9 months ago

        I don’t even work in that sector and HR is the exact same here. Employee did something horribly egregious that got them fired? You’re lucky if their supervisor was informed to take them off the schedule. No reason given, just they no longer work here. Did they quit? They no longer work here. Did they get fired? They no longer work here. Can I tell my staff what they did wrong so they don’t get fired on short notice? They no longer work here, but you can’t tell your staff. WHY THE FUCK NOT?!

      • Nuggsy@lemmy.worldEnglish
        4·
        9 months ago

        I’m thankful our HR gave us notice when I was in Desktop Support.

        The rare occasion we received short notice from HR or the general exec of our tech division was due to an immediate termination, and that was usually due to people not passing probation, or for egregious behaviour like sending 100s of GB to their personal email after they resigned and we’re in their notice period.

        Or we once had a guy who was completely off the rails… we don’t know what happened exactly, but a user called up and he was having a manic episode and was convinced someone hacked his account/phone and was listening to him.

        We raised it as a concern and a few weeks (maybe a month or so later) we were asked to terminate his account.

        I heard he had stopped taking his meds. Hope he’s alright now… he was a nice fellow usually.

    • douglasg14b@lemmy.worldEnglish
      9·
      9 months ago

      Our enterprise has all of that automated, who’s searching for names manually in any business of nontrivial size…?

      This can, and should, be scripted.

      • cuppaconcrete@aussie.zoneEnglish
        5·
        9 months ago

        Exactly, most services can be tied into a central authentication system/SSO and can automatically be disabled upon disabling an SSO user.

    • fartsparkles@sh.itjust.worksEnglish
      341·
      9 months ago

      I’m honestly baffled this is a thing (but appreciate learning the condemning phrasing of “SSO Tax”).

      We implemented federated auth support for Entra, ADFS, and OIDC straight out the gate in our project. It’s just a base platform feature, regardless of tier. Charging for it would be like charging for MFA/2FA. I mean, it’s great for us. I’d prefer if everyone used the feature. What the utter fuck are some vendors thinking?

      • Shadow@lemmy.caEnglish
        191·
        9 months ago

        Tell me about it. Github goes from $4 to $21 per user per month, and the only feature I want is sso.

      • RecallMadness@lemmy.nzEnglish
        13·
        9 months ago

        I suspect it’s a cost/capability/requirements thing.

        The larger the corporation, the more likely they’re going to have SSO as a minimum requirement. The more inflexible your customers are, the more you can charge.

        • rolaulten@startrek.websiteEnglish
          3·
          9 months ago

          That’s more or less it.

          For example, I’ve got somewhere around 700 users. If we don’t have SSO (SAML preferred, oauth as a fall back, and good whiskey is required for ldap/ad) whatever your attempting to buy won’t pass review. Now Timmy the sales drone knows that, and so does their leadership - hence the SSO tax.

        • fartsparkles@sh.itjust.worksEnglish
          11·
          9 months ago

          Entra’s free tier offers federated / SSO so basically every company with an MS license (which is an overwhelming majority, in my experience) can do SSO if they wanted to.

    • scarabic@lemmy.worldEnglish
      14·
      9 months ago

      This very thread shows how SSO is a security feature and has value. They’re charging for something that has value. Thats a price, not a tax.

  • ipkpjersi@lemmy.mlEnglish
    40·
    9 months ago

    That’s why companies use SSO, so when they lay off someone, they just have to disable one account.

    • Fullest@sh.itjust.worksEnglish
      8·
      9 months ago

      Not necessarily to justify Gizmodo in this instance, but Slack does paywall their SSO feature behind their Business+ Plan, which seems to currently run $12.50/mo/user, which is about a 70% increase from their next pricing tier. See: https://slack.com/pricing

      Given the price difference I wouldn’t be surprised if they didn’t want to pay for that.

      • ytorf@lemmy.worldEnglish
        4·
        9 months ago

        Wild ride scrolling through the percentage markups and thinking you found the peak at Cloudflare only to see Coursera looming over it

    • Cort@lemmy.worldEnglish
      8·
      9 months ago

      Also easier than resetting passwords for 15 different sites and accounts because a user lost their post-it note

  • elbucho@lemmy.worldEnglish
    27·
    9 months ago

    Oh hey - catturd2; isn’t that that sycophantic piece of shit who fawns all over Elon Musk every chance he gets? Maybe it’s a different catturd2 on bluesky.

    Edit: Actually, yeah; it does look like it’s a different person entirely:

  • BehindTheBarrier@programming.devEnglish
    16·
    9 months ago

    Our company did a thing like this, focusing on the manager and above. They got password and authenticator codes out of them and admin access to the slack…

    Good method to have users learn about critical thinking.

  • Paragone@lemmy.worldEnglish
    102·
    9 months ago

    This should be under BOFH, for Bastard Operator From Hell, the Register concept…

    yEEEks, people…

  • edric@lemm.eeEnglish
    7·
    9 months ago

    Centralized identity and federation with proper account deactivation/termination procedures folks.