When I was a wee lad just out of college I worked in a relatively shitty job that was basically 1/2 tech support consulting and 1/2 software development. My bos

When I was a wee lad just out of college I worked in a relatively shitty job that was basically 1/2 tech support consulting and 1/2 software development. My boss insisted that every single server we managed have the same 7 character root password (both our own and for clients) and that those machines be exposed to the open internet (with root ssh and other remote access protocols enabled!) accessible via that password. Since a number of those machines were inevitably pwned, and had to be cleaned up by none other than yours truly, I learned the extremely painful lesson of what happens when you sacrifice security in the name of usability (it was so easy - you only need to remember one short password!) As an aside - he was just as bad a boss on the software development side of the job. On the bright side it was interesting observing how various automated attacks succeeded in installing botnet C&C software, and how it worked to conceal itself. Edit: Of course I'll never know about the most sophisticated versions that escaped my detection :) Fortunately that was more than a decade ago.