and FTP is outright barred - even though one time it was the only way for a client to send me files IT wouldn't do it
I've had a user attempt to tell me that an anonymous FTP server with upload was absolutely necessary for a collaboration with someone on the outside. I literally laughed out loud right when he asked, and explained why it was a bad idea. If that was what you were asking for (or almost as bad or potentially worse, passworded FTP server), then I fully support your IT staff. SFTP within a chroot on a temporary VM might have been a good compromise though.
If you were asking for an FTP client, it seems kind of strange that you couldn't DL via anon FTP with a browser (was FTP port blocked?). I can almost see why FTP would be restricted: To prevent someone from accidentally typing their WORK username/password over the clear to a non-work FTP server. That's a silly scenario though. Also, if your client had the FTP server, then why couldn't they put the file on HTTP[S] instead?
I have seen that "lockdown" so many times, and it never works. There are no technical solutions to personnel problems.
The technical solutions do have one benefit. Equating this to physical security: If a customer walks into an unlocked "employees only" area, security should assume the gaff was inadvertent, and must act with courtesy. However, if a customer is seen wandering around in a locked "employees only" area, less courtesy need be applied. If there is an "airlock" with a security guard, and a two-man guard escort policy, "lost" customers can be tasered on sight.
In other words, the technical solutions are there to make sure that data theft _is_ espionage, and can be prosecuted as such if discovered. It's not intended to stop the theft, or possibly even detect it occurring.
Free speech is not a right in China, no matter how much we think everyone should have it, it just isn't.
Rights are not given by the state, they are recognized. You should have said:
Free speech is not a recognized right in China, no matter how much we think everyone should have it, China attempts to control speech.
One of my first gigs, the Rock Star Developers had admin rights. They'd pretty much do whatever they friggin wanted. And guess who got to blame when they screwed up? Yup, the sysadmin. Namely, me.
They'd go in and reboot servers - servers with 100 people logged in and working on stuff - because they thought their database was out of memory. Not tell anyone, nothing. One time they enabled an rsync script that pretty much overwrote a week's worth of work. And who got blamed? The sysadmin, for not making it impossible for that script to work anymore. Or something. It was crazy.
So basically, yes, it's an accountability thing. If I'm responsible for these machines, then I'm in charge. Period.
What has that got to do with LOCAL admin rights?
Depends on what you mean by local. Local admin rights on their own desktop or local admin rights on a specific server. I've had to give both, and devs tend to screw both up. I don't care about their desktops, they're a quick reimage. I care about the servers though. Those are multi-user systems and all users should be non-admin except for IT staff. Those machines become "I officially don't touch this" machines. Like Sgt. Schultz, I know nothink. Nothink!
for/f %X in ( ' type computerlist.txt ' ) do cmd/c start cmd/k psexec.exe \\%X -c ThingToRunOnRemoteMachines.bat
Or just "psexec.exe @computerlist.txt [other arguments] ThingToRunOnRemoteMachines.bat", which accomplishes the same thing.
Sort of, but the "start cmd/k" part opens a new cmd window for every computer. I should have posted a warning since 100's of computers could cause a few problems. There's a way to sleep/pause every X times you've gone through, but I don't have access to one of those scripts at the moment. The/k keeps the cmd window open so the results can be seen. The main reason to do this instead of the built-in "@" with psexec is if you've got only half of the computers online, psexec will take a long time trying to connect to all of the offline machines sequentially, whereas this allows concurrent running.
I wish I knew... I've been asking for a few years now.
generally it's not a big deal but a Exchange/PDC upgrade earlier this year frazzled my nerves with having to touch ever machine individually to update shares/printers.
Search microsoft's site for sysinternals and/or pstools. Use psexec.exe to run batch files running reg.exe on all of the machines. It will save you a lot of time, especially if you do it like: for/f %X in ( ' type computerlist.txt ' ) do cmd/c start cmd/k psexec.exe \\%X -c ThingToRunOnRemoteMachines.bat
I read this and I almost immediately thought "propaganda." Why? A appeal to fear based on a insignificant and easily fixable event
You live in Florida, don't you? This is the problem. Side with snow thinks it's a stop-sign scenario where the light is out, while side without snow sees green. Side without snow pulls out into traffic, pulling out slowly (icy road), side without snow can't stop in time (icy road), because they didn't expect someone to pull out on "red". Local municipalities won't fix this until we make a big stink.
different street lights are differently distinguishable.
If they didn't look different, you wouldn't be able to distinguish them.
They could taste different. Just be glad they aren't traffic lights in India, where they have many different different types of ways to not recognize traffic lights at all.
So, further separation of HD from the rest of IT makes no difference? I made a bad mistake upon graduation from college: I accepted an entry level IT job. There was no chance for advancement in that company, despite the fact that I did have the skills. There was too much separation even though we worked loosely with the other groups. I had to leave to double my salary. So did every one of my coworkers. At that place, we were dressed like everyone else, and ate lunch with other groups on occasion. The psychological barrier of a "lesser" uniform would only compound that.
Don't forget, you're not the one doing the hiring (unless you are, somehow), in a large company, you first have to get past HR filters, then you have to go through management, then you *might* get management to ask your potential coworkers if they know you or your skills. HR notices stupid things like dress codes and uniforms and they consider them important. Who gets dress codes? Professionals. Who gets uniforms? The groundskeepers, the janitors, the kitchen staff, and now the helpdesk.
I work for a software company with 500 people. We aren't allowed to do IT stuff (for good reason) just because we work in the software industry. We aren't IT, we are developers, testers, trainers, SEs, PEs, PMs, etc. etc. Therefore, we have a staff of about 25 IT guys who do all the IT work.
That's only 20 computers per IT guy (40 if two computers per person). Do they manage them all by hand? A few free tools and a properly educated IT professional and you'd need only 3-4 people (two could do it, but it's nice to have backup people and people for planning and growth).
Maybe you've got hundreds of servers you don't know about?
With only 500 computers, I could make a setup to reimage all 500 every night fairly easily, just by my lonesome. I agree with GP. That company doesn't need uniforms, they need to cut some dead weight.
As much as I appreciate the ease of having a uniform from my days in the military, they have no business in the professional IT world unless you are customer facing.
"The other departments in this company are our customers. We bill them inter-departmentally for our hours. Don't forget to tell them that they need a regular defrag every other week at $40 each. And sell those extended warranties!"/PHB-speak
When your skills outgrow the help desk - and they should - consider losing the uniform as a perk of advancement.
If you wear an unprofessional looking uniform (read: branded for your department), you reinforce the idea that you belong there. There will be no advancement into other groups even within IT at that company. If you want the helpdesk to start dressing nicer, tell them to start dressing nicer. Business casual is the dress code for workstation flunkies in about half of the places out there.
I'd rather go to 1890 and get me a couple of shares of GOGH.
Vincent van, that is.
Why not back to ??? B.C. and buy patents from GOG, maker of wheel and other simple machines. Apply Sonny Bononomics in Congress for patents at life +X millenia, and everyone will have to license anything round that turns on an axle.
The "Security Theatre" is just a new opening for corrupt politicans and power-hungry individuals to remove more freedom from people.
Benjamin Franklin said it best when he said "Any society that would give up a little liberty to gain a little security will deserve neither and lose both."
We can't give up even just a little liberty to gain security against corrupt politicians?
On September 10, 2001, Donald Rumsfeld was giving a press conference about how $2B was missing from the Pentagon.
On September 10, 2001, the WTC security contract with Securacom ended. Marvin Bush, W's brother, was a principle in the company, and also sat on the Board of directors of KuwAm, an Kuwaiti-American investment firm which financially backed Securacom.
...and Earth has 4 corner simultaneous 4-day TIME CUBE in only 24 hour rotation. Care to connect more dots, Gene?
Give them something to lose or care about. When you have nothing you have nothing to lose.
And when everything is given to you, you don't care about it either. The underwear bomber was the son of a wealthy banker. Bin Laden is/was... the son of a reasonably wealthy construction magnate. Without working for something, you feel no claim to it.
Slashdot Mirror
and FTP is outright barred - even though one time it was the only way for a client to send me files IT wouldn't do it
I've had a user attempt to tell me that an anonymous FTP server with upload was absolutely necessary for a collaboration with someone on the outside. I literally laughed out loud right when he asked, and explained why it was a bad idea. If that was what you were asking for (or almost as bad or potentially worse, passworded FTP server), then I fully support your IT staff. SFTP within a chroot on a temporary VM might have been a good compromise though.
If you were asking for an FTP client, it seems kind of strange that you couldn't DL via anon FTP with a browser (was FTP port blocked?). I can almost see why FTP would be restricted: To prevent someone from accidentally typing their WORK username/password over the clear to a non-work FTP server. That's a silly scenario though. Also, if your client had the FTP server, then why couldn't they put the file on HTTP[S] instead?
I developed an http over e-mail application that seems to be working quite nicely.
I thought RMS didn't have time to post to /.
I have seen that "lockdown" so many times, and it never works. There are no technical solutions to personnel problems.
The technical solutions do have one benefit. Equating this to physical security: If a customer walks into an unlocked "employees only" area, security should assume the gaff was inadvertent, and must act with courtesy. However, if a customer is seen wandering around in a locked "employees only" area, less courtesy need be applied. If there is an "airlock" with a security guard, and a two-man guard escort policy, "lost" customers can be tasered on sight.
In other words, the technical solutions are there to make sure that data theft _is_ espionage, and can be prosecuted as such if discovered. It's not intended to stop the theft, or possibly even detect it occurring.
Canada wouldn't create a wood shortage if they announced that they will no longer sell logs but instead sell only kiln-dried boards.
Kiln-dried boards don't roll down stairs, alone or in pairs. They might be great for a snack though.
Free speech is not a right in China, no matter how much we think everyone should have it, it just isn't.
Rights are not given by the state, they are recognized. You should have said:
Free speech is not a recognized right in China, no matter how much we think everyone should have it, China attempts to control speech.
HELL no.
One of my first gigs, the Rock Star Developers had admin rights. They'd pretty much do whatever they friggin wanted. And guess who got to blame when they screwed up? Yup, the sysadmin. Namely, me.
They'd go in and reboot servers - servers with 100 people logged in and working on stuff - because they thought their database was out of memory. Not tell anyone, nothing. One time they enabled an rsync script that pretty much overwrote a week's worth of work. And who got blamed? The sysadmin, for not making it impossible for that script to work anymore. Or something. It was crazy.
So basically, yes, it's an accountability thing. If I'm responsible for these machines, then I'm in charge. Period.
What has that got to do with LOCAL admin rights?
Depends on what you mean by local. Local admin rights on their own desktop or local admin rights on a specific server. I've had to give both, and devs tend to screw both up. I don't care about their desktops, they're a quick reimage. I care about the servers though. Those are multi-user systems and all users should be non-admin except for IT staff. Those machines become "I officially don't touch this" machines. Like Sgt. Schultz, I know nothink. Nothink!
The scientific process is bullet proof. The folks who "do science" not necessarily so.
What exactly are you advocating?
But I drank Red Bull and WINGS GREW ON MY BACK. Your mileage may vary.
for /f %X in ( ' type computerlist.txt ' ) do cmd /c start cmd /k psexec.exe \\%X -c ThingToRunOnRemoteMachines.bat
Or just "psexec.exe @computerlist.txt [other arguments] ThingToRunOnRemoteMachines.bat", which accomplishes the same thing.
Sort of, but the "start cmd /k" part opens a new cmd window for every computer. I should have posted a warning since 100's of computers could cause a few problems. There's a way to sleep/pause every X times you've gone through, but I don't have access to one of those scripts at the moment. The /k keeps the cmd window open so the results can be seen. The main reason to do this instead of the built-in "@" with psexec is if you've got only half of the computers online, psexec will take a long time trying to connect to all of the offline machines sequentially, whereas this allows concurrent running.
unless the researchers were taking ginkgo to improve their memory and cognitive skills? They probably made a lot of mental mistakes...
8000 users, but how many computers? I'm betting it's close to only 200 computers, and they're all totally locked down and the same image.
I wish I knew... I've been asking for a few years now. generally it's not a big deal but a Exchange/PDC upgrade earlier this year frazzled my nerves with having to touch ever machine individually to update shares/printers.
Search microsoft's site for sysinternals and/or pstools. Use psexec.exe to run batch files running reg.exe on all of the machines. It will save you a lot of time, especially if you do it like: /f %X in ( ' type computerlist.txt ' ) do cmd /c start cmd /k psexec.exe \\%X -c ThingToRunOnRemoteMachines.bat
for
Google doesn't have any relevant hits for this phrase (except this article).
Someone who uses the sneakernet to work on a box instead of better tools like SSH/pstools/RDP/ARD/GPO
I read this and I almost immediately thought "propaganda." Why? A appeal to fear based on a insignificant and easily fixable event
You live in Florida, don't you? This is the problem. Side with snow thinks it's a stop-sign scenario where the light is out, while side without snow sees green. Side without snow pulls out into traffic, pulling out slowly (icy road), side without snow can't stop in time (icy road), because they didn't expect someone to pull out on "red". Local municipalities won't fix this until we make a big stink.
different street lights are differently distinguishable.
If they didn't look different, you wouldn't be able to distinguish them.
They could taste different. Just be glad they aren't traffic lights in India, where they have many different different types of ways to not recognize traffic lights at all.
So, if you lose energy efficiency by adding heating coils, the "brighter (safer)" and "longer lasting" don't give enough reason to buy?
So, further separation of HD from the rest of IT makes no difference? I made a bad mistake upon graduation from college: I accepted an entry level IT job. There was no chance for advancement in that company, despite the fact that I did have the skills. There was too much separation even though we worked loosely with the other groups. I had to leave to double my salary. So did every one of my coworkers. At that place, we were dressed like everyone else, and ate lunch with other groups on occasion. The psychological barrier of a "lesser" uniform would only compound that.
Don't forget, you're not the one doing the hiring (unless you are, somehow), in a large company, you first have to get past HR filters, then you have to go through management, then you *might* get management to ask your potential coworkers if they know you or your skills. HR notices stupid things like dress codes and uniforms and they consider them important. Who gets dress codes? Professionals. Who gets uniforms? The groundskeepers, the janitors, the kitchen staff, and now the helpdesk.
I work for a software company with 500 people. We aren't allowed to do IT stuff (for good reason) just because we work in the software industry. We aren't IT, we are developers, testers, trainers, SEs, PEs, PMs, etc. etc. Therefore, we have a staff of about 25 IT guys who do all the IT work.
That's only 20 computers per IT guy (40 if two computers per person). Do they manage them all by hand? A few free tools and a properly educated IT professional and you'd need only 3-4 people (two could do it, but it's nice to have backup people and people for planning and growth).
Maybe you've got hundreds of servers you don't know about?
With only 500 computers, I could make a setup to reimage all 500 every night fairly easily, just by my lonesome. I agree with GP. That company doesn't need uniforms, they need to cut some dead weight.
As much as I appreciate the ease of having a uniform from my days in the military, they have no business in the professional IT world unless you are customer facing.
"The other departments in this company are our customers. We bill them inter-departmentally for our hours. Don't forget to tell them that they need a regular defrag every other week at $40 each. And sell those extended warranties!" /PHB-speak
When your skills outgrow the help desk - and they should - consider losing the uniform as a perk of advancement.
If you wear an unprofessional looking uniform (read: branded for your department), you reinforce the idea that you belong there. There will be no advancement into other groups even within IT at that company. If you want the helpdesk to start dressing nicer, tell them to start dressing nicer. Business casual is the dress code for workstation flunkies in about half of the places out there.
I'd rather go to 1890 and get me a couple of shares of GOGH. Vincent van, that is.
Why not back to ??? B.C. and buy patents from GOG, maker of wheel and other simple machines. Apply Sonny Bononomics in Congress for patents at life +X millenia, and everyone will have to license anything round that turns on an axle.
The "Security Theatre" is just a new opening for corrupt politicans and power-hungry individuals to remove more freedom from people. Benjamin Franklin said it best when he said "Any society that would give up a little liberty to gain a little security will deserve neither and lose both."
We can't give up even just a little liberty to gain security against corrupt politicians?
On September 10, 2001, Donald Rumsfeld was giving a press conference about how $2B was missing from the Pentagon.
On September 10, 2001, the WTC security contract with Securacom ended. Marvin Bush, W's brother, was a principle in the company, and also sat on the Board of directors of KuwAm, an Kuwaiti-American investment firm which financially backed Securacom.
...and Earth has 4 corner simultaneous 4-day TIME CUBE in only 24 hour rotation. Care to connect more dots, Gene?
Give them something to lose or care about. When you have nothing you have nothing to lose.
And when everything is given to you, you don't care about it either. The underwear bomber was the son of a wealthy banker. Bin Laden is/was... the son of a reasonably wealthy construction magnate. Without working for something, you feel no claim to it.