4 ms·

What problems have you encountered that others should avoid?

jcims 7y ago
They run the gamut. Lack of a viable risk management program, lack of resiliency planning and testing, poor operational and change management controls, poor visibility and response planning for security events, poor SDLC security, etc. etc. The requirements vary based on our exposure.
Spooky23 7y ago
Over the years, I have run into: - Counterfeit components, like memory out of spec that creates scaled failures. - Fake products from the channel. - Fundamental mistruths with regard to how services are delivered. - Poor operational practices for maintaining SLA, especially for off-shored services. Those ops folks will move mountains to meet the minimum standard of "up", but will allow problems to fester. - Fraud. Fake on-site employees sending work back to a boiler room with people actually doing the work. - Fraud. Named users actually being fake people sharing a credential. In one case, a colleague in a manufacturing case discovered this when he accidentally received a link to an open video stream of a MFA token. - Fraud. Stuffing fake or inferior products into orders. Example: Order new laptops, find a bunch of refurbs in the pallets. Basically, people suck and if you primarily make purchasing decisions based on price, and you care about what you are buying, you need to treat the counter-party as a potentially hostile actor and assume that you are going to be ripped off.
- 6510 7y ago
  I read when having bicycle frames made in Taiwan you get the best price/quality ratio if you have a permanent onsite observer in the factory. That guy doesn't really do anything but they wont cut corners if he is around.
  - notyourday 7y ago
    You get what you pay for. If you aren't paying for the guy to be the observer there's no one to observe.
    - dredmorbius 7y ago
      You don't get what you pay for. But generally value derives from multiple independent credible verifiable audit mechanisms.
      - eru 7y ago
        Or from reputation. A company with a reputation for quality can charge more, because you don't need observers and can just rely on them. And they want to deliver on the reputation, so that they can keep milking it.
        dredmorbius 7y ago
        The value of trust. JS Mill has some interesting observations going back a ways. Auditing is still recommended.
        eru 7y ago
        Definitely, auditing is one way to speed up the process. Ignoring auditing for a moment: The trustworthy reputation is quicker to build, if the quality of the product is easy to ascertain quickly. But if you are a company in a sector where that's not possible, the reputation for quality becomes even more valuable. And you can potentially ride it out for a long time in an exit scam. https://en.wikipedia.org/wiki/Exit_scam https://en.wikipedia.org/wiki/Exit_scam
      - notyourday 7y ago
        > You don't get what you pay for. Yes you do. You get exactly what you pay for. If you pay for a dozen of German inspectors who think Chinese factory produces junk that is outside the spec, a dozen of German inspectors with that attitude are going to do inspections. If you do no want to pay those German inspectors, you are not going to get those inspections. In most of the cases companies do not want to pay for it. Apple manufactures amazing iPhones in China. Apple iPhones easily last 5-6 years. Blu manufactures crappy Android phones. They barely last a year. Apple's iphones cost more to manufacture than Blu phones sell for.
- maerF0x0 7y ago
  > Fraud. Named users actually being fake people sharing a credential. In one case, a colleague in a manufacturing case discovered this when he accidentally received a link to an open video stream of a MFA token. This is a classic bait and switch in many online work platforms. The person who interviews for your open contract/role is not the person who does the work.

They run the gamut. Lack of a viable risk management program, lack of resiliency planning and testing, poor operational and change management controls, poor visibility and response planning for security events, poor SDLC security, etc. etc. The requirements vary based on our exposure.

Spooky23 7y ago

Over the years, I have run into: - Counterfeit components, like memory out of spec that creates scaled failures. - Fake products from the channel. - Fundamental mistruths with regard to how services are delivered. - Poor operational practices for maintaining SLA, especially for off-shored services. Those ops folks will move mountains to meet the minimum standard of "up", but will allow problems to fester. - Fraud. Fake on-site employees sending work back to a boiler room with people actually doing the work. - Fraud. Named users actually being fake people sharing a credential. In one case, a colleague in a manufacturing case discovered this when he accidentally received a link to an open video stream of a MFA token. - Fraud. Stuffing fake or inferior products into orders. Example: Order new laptops, find a bunch of refurbs in the pallets. Basically, people suck and if you primarily make purchasing decisions based on price, and you care about what you are buying, you need to treat the counter-party as a potentially hostile actor and assume that you are going to be ripped off.

6510 7y ago
I read when having bicycle frames made in Taiwan you get the best price/quality ratio if you have a permanent onsite observer in the factory. That guy doesn't really do anything but they wont cut corners if he is around.
- notyourday 7y ago
  You get what you pay for. If you aren't paying for the guy to be the observer there's no one to observe.
  - dredmorbius 7y ago
    You don't get what you pay for. But generally value derives from multiple independent credible verifiable audit mechanisms.
    - eru 7y ago
      Or from reputation. A company with a reputation for quality can charge more, because you don't need observers and can just rely on them. And they want to deliver on the reputation, so that they can keep milking it.
      - dredmorbius 7y ago
        The value of trust. JS Mill has some interesting observations going back a ways. Auditing is still recommended.
        eru 7y ago
        Definitely, auditing is one way to speed up the process. Ignoring auditing for a moment: The trustworthy reputation is quicker to build, if the quality of the product is easy to ascertain quickly. But if you are a company in a sector where that's not possible, the reputation for quality becomes even more valuable. And you can potentially ride it out for a long time in an exit scam. https://en.wikipedia.org/wiki/Exit_scam https://en.wikipedia.org/wiki/Exit_scam
    - notyourday 7y ago
      > You don't get what you pay for. Yes you do. You get exactly what you pay for. If you pay for a dozen of German inspectors who think Chinese factory produces junk that is outside the spec, a dozen of German inspectors with that attitude are going to do inspections. If you do no want to pay those German inspectors, you are not going to get those inspections. In most of the cases companies do not want to pay for it. Apple manufactures amazing iPhones in China. Apple iPhones easily last 5-6 years. Blu manufactures crappy Android phones. They barely last a year. Apple's iphones cost more to manufacture than Blu phones sell for.
maerF0x0 7y ago
> Fraud. Named users actually being fake people sharing a credential. In one case, a colleague in a manufacturing case discovered this when he accidentally received a link to an open video stream of a MFA token. This is a classic bait and switch in many online work platforms. The person who interviews for your open contract/role is not the person who does the work.