"I don't want to have to come in on a weekend if there is a problem
fair enough
, so I bridged across the firewall with an IP KVM, exposing it directly to the Internet"
ahhhhhggghh!!! Yeah, I'm sure that runs a perfectly secure IP stack.
Now, if the guy had implemented a 2-factor OpenVPN server so he could get to his IPKVM device, I might say you should cut him some slack.
That same stunt, by the way, was somehow a 'Firewall problem' since he assigned it the same address at the firewall's public primary address...
0-o Doesn't he have some business matters to attend to?
If I can get my boss to keep his hands off, or at the very least involve me when he has a 'brilliant' idea, life won't be too bad.
Appeal to his desires. Does he want more time at home with the kids? Does he have Important Meetings to go to? Whatever it takes to make him feel good about giving you the projects. You might have to do a bit more for a little while, but you'll get him trained soon enough with enough positive reinforcement. Even consider that he's trying to spare you some of the load, even if it's not a very good idea.
Yes indeed, the kind that has never once inflated away to worthlessness.
Present rate is 98% depreciation per century.
But, if you disagree, I'd be happy to trade my 12 year old car for, oh let's say, 100,000 of those worthless, electronically-stored dollars?
Old cars make for bad money. They depreciate at an even worse rate.
But if you have a car that's worth 100,000 FRN's today and somebody willing to trade that car for a stable money (e.g. gold), I'd gladly engage in that 3-way trade because I'll be far ahead of both of you in a decade.
They all have root access still:-( A political fight I'm not yet prepared to have. I was able to take it away on the web servers, at least, and that's the only thing our developers touch, so life is a bit better.
A fine baby step is to move everybody over to sudo. If you can get buy-in that everybody will track changes with git, then you have somebody to blame and can build a case if they break it. With sudo you have a record of who was mucking (in your/var/log/secure).
If they're perfectly reasonable/responsible and you can track changes, it's not such a problem, really, unless you're worried that they're secret agents meaning to break your stuff. I typically only see frustrating carelessness where people can get away with it.
I'm not sure you're a typical use case. Besides, I'm a heavy data user, and a heavy voice user.
Which is itself not a typical use case. My daughter has a cell phone plan which is fifty cents a month plus usage. I bought her a refurbished LG nv2 for $60. This is fine for probably fifty million American users who rarely use their cell phones but have them for the occasional call plus emergency.
Anybody who can get away with less than half a gig of data a month shouldn't be paying a bill more than $55 unless they want to pay off an expensive smartphone over time with a loan from their phone company.
Unless you can predict when something will fail (as in - the database uses 16-bit indexing, so when we hit 65,536 orders the database will crash), it's much more effective to leave things alone.
You're advocating incurring short-term benefits at the expense of the long term problems.
This guy probably has dependencies that will take days to figure out are even there and "when everything is down" is the wrong time to begin that discovery process.
In addition, he won't ever be able to scale or add new capabilities in the current state.
Only if his goal is to collect a paycheck for a short period of time and get out should he engage in that sort of Wall St/Congress 'thinking'.
The point is that if you trust your cell phone to be a 2nd authentication factor for your banking, you've contracted out your security to [the dumbest customer service rep at] your mobile carrier.
Also, being broke is probably a pretty good strategy for avoiding these kinds of problems.
but memory sizes of 4GB are still quite common, and haven't changed all that much in 5 years
Really? 5 years ago, 2GB of RAM was pretty generous on a standard-issue machine.
Meanwhile, Firefox 8 is 1.3GB resident with 8 tabs loaded on my machine. The first machine I ran Firefox on was a Mac with 128MB of RAM and I regularly had 20 tabs open. And this is pretty much just Firefox + NoScript.
They had to come up with a system to do it on. It is called UNIX!
You can pick up the rest of that story with a video I made of Doug McIlroy giving a history-of-Unix talk to my LUG. (Doug managed the lab, kept the managers away from Thompson and Ritchie, and came up with pipes).
And for all the CG in the Transformers movies, I found it the same way. ITS CG, WHY IS THE CAMERA SHAKING SO MUCH, YOU HAVE COMPLETE CONTROL. And then cut, cut, cut, cut, cut, so many fast cuts, who knows what is going on.
The excuse is that a real camera would shake about in a robot battle.
In reality, if you make all your CG dark, fast, blurry, and cut every 3 seconds, you can get away with cheap, un-detailed models and your movements and physics doesn't have to be that good. Choreography can be minimal, and you don't have to worry about having any creativity.
But people pay anyway and Michael Bay is laughing all the way to the bank. Except he doesn't make any money on people like me who say the first one, thought it was crap for this reason, and haven't seen any more. But I'm not a 14-year old boy anymore, so he probably doesn't care.
Otherwise a commercial mail service would hog the high spots to itself and leave rural areas out in the cold.
I get UPS and Fedex package delivery to my house. My post office makes me drive 10 miles round-trip to get the package. And that's only because I begged them to drop it off at the closer post office they drive by anyway, rather than making me drive 20 miles round trip to 'my' post office.
Oh, and they're closed for lunch from 11:30 to 1PM every day.
Yes, there are some advantages to using SQL database, like I said.. But I highly doubt "huge speed advantage" is one of them, unless you compare to a really badly set up system.
Yeah, like Thunderbird still using Mork databases after a decade of sharp-poke-in-the-eye performance.
Visa? Quite possibly. From what I've dealt with that side of things they seem fairly clued in on things, and always interested in not losing money. Imagine that:P
I hope things have gotten better recently. In the past I've seen their auditors insist I switch systems from using md5 password hashes to using crypt (I refused).
Yes, but it's been dormant for 10 years. I have a Dish Network package now ('Dish Family').
Where do you put that thing??
The Dish Network dish is on a pole near the house, the BUD is back along a logging road that goes up to the forest. It's yours for the taking if you want to make a solar death ray.
But are they interested enough to give this guy a written offer of legal protection for disclosing the vulnerability?
His smallest downside seems to be just going away and never mentioning it again. If the Industry is smart enough to not allow that to be the outcome, kudos to them (but color me pleasantly surprised).
People will just put up with it. I mean, who really complained about the absurdly expensive data plans and two year contracts to have smart phones? Anyone raise a stink over cable/satellite fees? How's that A La Cart bill coming along?
I buy refurbished cell phones, use a Page Plus Cellular prepaid service, and pay $23/mo for satellite service, including a-la-carte PBS.
Perhaps you could be more clear about your complaints?
does the U.S. senate really have the authority to change in employment contracts for the worse?
No, the US Congress is constrained to a narrow set of defined powers by the US Constitution. We, the People from which their just power derives, only granted them those narrow powers, to keep them from running amok in society (like interfering in private contracts and whatnot).
But, we also gave them a monopoly on violence, so they just shit on that Constitution daily and interpret it as the WTFPL.
Slashdot Mirror
"I don't want to have to come in on a weekend if there is a problem
fair enough
, so I bridged across the firewall with an IP KVM, exposing it directly to the Internet"
ahhhhhggghh!!! Yeah, I'm sure that runs a perfectly secure IP stack.
Now, if the guy had implemented a 2-factor OpenVPN server so he could get to his IPKVM device, I might say you should cut him some slack.
That same stunt, by the way, was somehow a 'Firewall problem' since he assigned it the same address at the firewall's public primary address...
0-o Doesn't he have some business matters to attend to?
If I can get my boss to keep his hands off, or at the very least involve me when he has a 'brilliant' idea, life won't be too bad.
Appeal to his desires. Does he want more time at home with the kids? Does he have Important Meetings to go to? Whatever it takes to make him feel good about giving you the projects. You might have to do a bit more for a little while, but you'll get him trained soon enough with enough positive reinforcement. Even consider that he's trying to spare you some of the load, even if it's not a very good idea.
Yes indeed, the kind that has never once inflated away to worthlessness.
Present rate is 98% depreciation per century.
But, if you disagree, I'd be happy to trade my 12 year old car for, oh let's say, 100,000 of those worthless, electronically-stored dollars?
Old cars make for bad money. They depreciate at an even worse rate.
But if you have a car that's worth 100,000 FRN's today and somebody willing to trade that car for a stable money (e.g. gold), I'd gladly engage in that 3-way trade because I'll be far ahead of both of you in a decade.
But the auditor didn't really have a choice as the Visa requirements specified that all passwords had to be encrypted. Hashing isn't encrypted.
This all predated glibc-2.7 anyhow.
They all have root access still :-( A political fight I'm not yet prepared to have. I was able to take it away on the web servers, at least, and that's the only thing our developers touch, so life is a bit better.
A fine baby step is to move everybody over to sudo. If you can get buy-in that everybody will track changes with git, then you have somebody to blame and can build a case if they break it. With sudo you have a record of who was mucking (in your /var/log/secure).
If they're perfectly reasonable/responsible and you can track changes, it's not such a problem, really, unless you're worried that they're secret agents meaning to break your stuff. I typically only see frustrating carelessness where people can get away with it.
It sounded more like straight-up ignorance to me.
I'm not sure you're a typical use case. Besides, I'm a heavy data user, and a heavy voice user.
Which is itself not a typical use case. My daughter has a cell phone plan which is fifty cents a month plus usage. I bought her a refurbished LG nv2 for $60. This is fine for probably fifty million American users who rarely use their cell phones but have them for the occasional call plus emergency.
Anybody who can get away with less than half a gig of data a month shouldn't be paying a bill more than $55 unless they want to pay off an expensive smartphone over time with a loan from their phone company.
Unless you can predict when something will fail (as in - the database uses 16-bit indexing, so when we hit 65,536 orders the database will crash), it's much more effective to leave things alone.
You're advocating incurring short-term benefits at the expense of the long term problems.
This guy probably has dependencies that will take days to figure out are even there and "when everything is down" is the wrong time to begin that discovery process.
In addition, he won't ever be able to scale or add new capabilities in the current state.
Only if his goal is to collect a paycheck for a short period of time and get out should he engage in that sort of Wall St/Congress 'thinking'.
The point is that if you trust your cell phone to be a 2nd authentication factor for your banking, you've contracted out your security to [the dumbest customer service rep at] your mobile carrier.
Also, being broke is probably a pretty good strategy for avoiding these kinds of problems.
Money stored electronically at the bank is one of the classic counterexamples to the belief that all property is (or should be) tangible
You mean the kind that gets inflated away to worthlessness?
coincidence or what?
Don't forget - they also have geologists on trial for failing to predict the earthquake a few years ago. The Universe is merely seeking equilibrium.
but memory sizes of 4GB are still quite common, and haven't changed all that much in 5 years
Really? 5 years ago, 2GB of RAM was pretty generous on a standard-issue machine.
Meanwhile, Firefox 8 is 1.3GB resident with 8 tabs loaded on my machine. The first machine I ran Firefox on was a Mac with 128MB of RAM and I regularly had 20 tabs open. And this is pretty much just Firefox + NoScript.
They had to come up with a system to do it on. It is called UNIX!
You can pick up the rest of that story with a video I made of Doug McIlroy giving a history-of-Unix talk to my LUG. (Doug managed the lab, kept the managers away from Thompson and Ritchie, and came up with pipes).
And for all the CG in the Transformers movies, I found it the same way. ITS CG, WHY IS THE CAMERA SHAKING SO MUCH, YOU HAVE COMPLETE CONTROL. And then cut, cut, cut, cut, cut, so many fast cuts, who knows what is going on.
The excuse is that a real camera would shake about in a robot battle.
In reality, if you make all your CG dark, fast, blurry, and cut every 3 seconds, you can get away with cheap, un-detailed models and your movements and physics doesn't have to be that good. Choreography can be minimal, and you don't have to worry about having any creativity.
But people pay anyway and Michael Bay is laughing all the way to the bank. Except he doesn't make any money on people like me who say the first one, thought it was crap for this reason, and haven't seen any more. But I'm not a 14-year old boy anymore, so he probably doesn't care.
However they just couldn't believe it was fake
I suppose it's a good thing that everybody's not an economist. Your friends vote though...
near-impossible pension funding mandate
Are the funding requirements in excess of their obligations?
Actually, 0% of the USPS funding is through taxes.
Except for the few billion dollars worth of mail trucks Congress bought them a few years back.
Otherwise a commercial mail service would hog the high spots to itself and leave rural areas out in the cold.
I get UPS and Fedex package delivery to my house. My post office makes me drive 10 miles round-trip to get the package. And that's only because I begged them to drop it off at the closer post office they drive by anyway, rather than making me drive 20 miles round trip to 'my' post office.
Oh, and they're closed for lunch from 11:30 to 1PM every day.
Oh, you want running water way out there? I dont want to pay for it even though you help pay for my schools, my roads, my police, and my firefighters.
Keep your creepy water lines away from my property - my well is perfectly well maintained, monitored, and free of 'necessary' chemicals.
Yes, there are some advantages to using SQL database, like I said.. But I highly doubt "huge speed advantage" is one of them, unless you compare to a really badly set up system.
Yeah, like Thunderbird still using Mork databases after a decade of sharp-poke-in-the-eye performance.
Visa? Quite possibly. From what I've dealt with that side of things they seem fairly clued in on things, and always interested in not losing money. Imagine that :P
I hope things have gotten better recently. In the past I've seen their auditors insist I switch systems from using md5 password hashes to using crypt (I refused).
So, you have a BUD? [wikipedia.org]
Yes, but it's been dormant for 10 years. I have a Dish Network package now ('Dish Family').
Where do you put that thing??
The Dish Network dish is on a pole near the house, the BUD is back along a logging road that goes up to the forest. It's yours for the taking if you want to make a solar death ray.
should be -> are :)
But are they interested enough to give this guy a written offer of legal protection for disclosing the vulnerability?
His smallest downside seems to be just going away and never mentioning it again. If the Industry is smart enough to not allow that to be the outcome, kudos to them (but color me pleasantly surprised).
The two I got were indistinguishable from new. I think 'refurbished' has come to mean re-used circuit board, new plastics.
People will just put up with it. I mean, who really complained about the absurdly expensive data plans and two year contracts to have smart phones? Anyone raise a stink over cable/satellite fees? How's that A La Cart bill coming along?
I buy refurbished cell phones, use a Page Plus Cellular prepaid service, and pay $23/mo for satellite service, including a-la-carte PBS.
Perhaps you could be more clear about your complaints?
does the U.S. senate really have the authority to change in employment contracts for the worse?
No, the US Congress is constrained to a narrow set of defined powers by the US Constitution. We, the People from which their just power derives, only granted them those narrow powers, to keep them from running amok in society (like interfering in private contracts and whatnot).
But, we also gave them a monopoly on violence, so they just shit on that Constitution daily and interpret it as the WTFPL.