4 ms·

We're talking about businesses here, not your private amusement, though. As a business you need to ask yourself: and who pays for the time it takes to educate

by qayxc 5y ago

We're talking about businesses here, not your private amusement, though. As a business you need to ask yourself: and who pays for the time it takes to educate at least two employees on this "basic and elementary matter"? If it really were so "basic and elementary", how come even critical infrastructure regularly falls victim to the most primitive of ransomware attacks? Misconfigured email and network access settings, vulnerable, out of date software stacks, non-existing contingency plans, lack of monitoring, no escalation strategy, etc. etc. Billions are lost each year due to this. It's very easy to underestimate the actual complexity of the task in its fullest whilst overestimating one's own abilities because "it's not hard to setup NGinx and service stack XY on a random x64 box". Anecdote from personal experience: tasked an applicant for a DevOps position with comparing two systems we could choose from for a backend service. The systems came in the form of installation packages and docker-images respectively. Having had no experience with Docker at the time, I thought it'd safe my team a great deal of time to have the "new guy", who knew Docker inside out, deal with it. A week later we had two results: 1) a usable comparison of the two systems and 2) an e-mail from the cloud service who informed us that the machines we rented were performing DDoS attacks on a foreign company... New guy had forgotten to properly secure the test machines he had set up and it took hackers all of 72 hours to find and hijack them. Luckily it only took a few clicks to wipe the offending boxes, but it served as a warning for what happens if you take the whole "big scary nothings" too lightly.

bsenftner 5y ago
It certainly helps if one begins with experienced engineers. I am not talking about personal projects, I am discussing funded startups. If your team has not run servers on their own in the past, get a different team. It is not as if there is not a giant population of grey beards with this knowledge seeking work... I accept your points, but far too many inexperienced devOps are given keys that should not have them. From your Docker story, it sounds like poor decision making on your behalf. Just because a developer knows Docker does not mean they know how to expose that securely to the public - far too many devs believe that's not their job.
- ghaff 5y ago
  >It is not as if there is not a giant population of grey beards with this knowledge seeking work... Really? There is a giant population of senior experienced engineers looking to do basic a lot of basic sys admin stuff? And they're willing to work for peanuts, right? By the way, I totally agree with your basic point. The developer probably downloaded some images from a random public repo. As you say, far too many devs think security is someone else's problem and then get upset when the security person blocks their app going into production.
- lbriner 5y ago
  I'm not sure which companies you are talking about here. I work for a small startup and between us, we have plenty of experience of maintaining servers but that doesn't mean I would bet my company existence on me not forgetting to setup the firewall correctly. It also doesn't account for all of the out-of-hours stuff we need to do. Even with a hosted solution and a lot of paid-for services like Cloudflare, we still have to check out every unusual error email, everything that seems out of the ordinary. If you are 200+ people, great, you probably already have a team to manage this. If you are small like 90% of companies then you won't and I want to spend my time on the things I am expert in.
- qayxc 5y ago
  > Just because a developer knows Docker does not mean they know how to expose that securely to the public While that's certainly true, I think you missed the part where the guy specifically applied for a DevOps position. The "Ops"-part wasn't optional and exposing a test system to the public in the first place is a big fail in and of itself obviously. But that's besides the point: the point was that operating even a single server is more complex than many people tend to admit and you just confirmed this statement. I also don't understand how you jump from "it's not hard" and "big scary nothing" to "funded startups" and getting a "different team" preferably consisting of knowledgeable "grey beards". Which is it? Is it simple enough to learn on a rainy weekend or do you actually need dedicated trained and/or experienced professionals, because far too many devs are unsuitable for this? I have trouble following your train of thought tbh.
- whoknew1122 5y ago

by qayxc 5y ago

bsenftner 5y ago

It certainly helps if one begins with experienced engineers. I am not talking about personal projects, I am discussing funded startups. If your team has not run servers on their own in the past, get a different team. It is not as if there is not a giant population of grey beards with this knowledge seeking work... I accept your points, but far too many inexperienced devOps are given keys that should not have them. From your Docker story, it sounds like poor decision making on your behalf. Just because a developer knows Docker does not mean they know how to expose that securely to the public - far too many devs believe that's not their job.

ghaff 5y ago
>It is not as if there is not a giant population of grey beards with this knowledge seeking work... Really? There is a giant population of senior experienced engineers looking to do basic a lot of basic sys admin stuff? And they're willing to work for peanuts, right? By the way, I totally agree with your basic point. The developer probably downloaded some images from a random public repo. As you say, far too many devs think security is someone else's problem and then get upset when the security person blocks their app going into production.
lbriner 5y ago
I'm not sure which companies you are talking about here. I work for a small startup and between us, we have plenty of experience of maintaining servers but that doesn't mean I would bet my company existence on me not forgetting to setup the firewall correctly. It also doesn't account for all of the out-of-hours stuff we need to do. Even with a hosted solution and a lot of paid-for services like Cloudflare, we still have to check out every unusual error email, everything that seems out of the ordinary. If you are 200+ people, great, you probably already have a team to manage this. If you are small like 90% of companies then you won't and I want to spend my time on the things I am expert in.
qayxc 5y ago
> Just because a developer knows Docker does not mean they know how to expose that securely to the public While that's certainly true, I think you missed the part where the guy specifically applied for a DevOps position. The "Ops"-part wasn't optional and exposing a test system to the public in the first place is a big fail in and of itself obviously. But that's besides the point: the point was that operating even a single server is more complex than many people tend to admit and you just confirmed this statement. I also don't understand how you jump from "it's not hard" and "big scary nothing" to "funded startups" and getting a "different team" preferably consisting of knowledgeable "grey beards". Which is it? Is it simple enough to learn on a rainy weekend or do you actually need dedicated trained and/or experienced professionals, because far too many devs are unsuitable for this? I have trouble following your train of thought tbh.
whoknew1122 5y ago