3 ms·

It is very easy for IT managers to put the blame on "hackers" intruding into the network, instead of assuming they created an insecure system. In many companies

It is very easy for IT managers to put the blame on "hackers" intruding into the network, instead of assuming they created an insecure system. In many companies this can work.

prox 5y ago
Lots of these folks (like the governor) don’t even know the basics of IT. Zero knowledge. You can tell them anything and it will stick.
skissane 5y ago
Years ago, I worked at this place, they tried to install these new core routers. The first core router worked fine, but connect the second and the whole campus network would go into meltdown. The network team could not work it out. The vendor could not work it out. But one of the IT managers had an explanation: me. Firstly, it was due to an OpenVPN I installed on a server (with permission-as a stopgap measure so we could remotely access the “next-gen data centre” because the networking team was taking too long to get the real VPN installed and it was blocking other teams on the project.) The explanation didn’t make any technical sense: the VPN is just an application, nothing to do with the core routers; but he wasn’t technical enough to understand that. They told me to shut it down, so I did (even though doing so inconvenienced the project), and lo and behold, it made zero difference to the problem. Then, he apparently even suggested at a management meeting (I wasn’t there but I heard about it) that I was sneaking in to the data centre at night or on the weekends to sabotage things, and that was why the new routers didn’t work. Apparently they even asked campus security for my physical access logs, which revealed I hadn’t been doing any such thing. Eventually, the vendor worked out the problem. When you install the router, there was a step you had to change the VRRP IDs to give every router a unique ID on the network. Clearly explained in the documentation, obviously essential, apparently our networking team didn’t read that part. You plug one new router in, everything is fine; plug the second one in, well it still has the OOTB default VRRP ID, so now two core routers on the campus network have the same VRRP ID, and all the other routers got confused, and the whole thing fell apart. Both our networking team and the vendor’s support team were so focused on chasing some obscure bug they didn’t see the basic config issue.
- isoskeles 5y ago
  Did that IT manager ever apologize for accusing you of being the problem?
  - skissane 5y ago
    I don’t remember him ever directly apologising, although he was nice to me afterwards (and this was many years ago, memories get hazy). I think he was rather embarrassed by the whole incident, it turned out to be such a basic configuration issue and it took them so long to solve it. I only knew about the whole “sneaking in at night” allegation because my boss told me what he’d said at meetings to which I wasn’t invited, and I don’t think my boss was supposed to tell me what was said in those meetings, so I’m not even sure if he knew that I knew he’d accused me
- temp_praneshp 5y ago
  Wow, I'll keep this in mind next time I complain about my manager.
  - wslack 5y ago
    r/talesfromtechsupport is full of these sorts of stories. I make a visit on days when my job is frustrating and inevitably feel better.
Spivak 5y ago
I very much want the blame to be on the person who broke into my house regardless of whether my door was locked or my window was open.
- zentiggr 5y ago
  Which works great when there's some kind of access restriction in place. If you wind up putting your tax returns in the 'little free library' you set up on your front yard, you can't blame others for reading them, then handing them back to you and not telling anyone else. That's the proper analogy for what happened in the original article.
  - Spivak 5y ago
    This doesn’t track at all. This is me telling you that your forms are on my desk and throwing you the keys to my office. And then after getting your papers you go rummaging around other stuff. Like sure I’m accepting a risk that you could do that but you’re still a dick if you actually do.
    - closeparen 5y ago
      Content you're serving on a public URL is content you have published. It's not your house and you didn't extend anyone any trust or limited access. You put it in The New York Times. Maybe you hoped no one would find it because it's on page B30 and most people only read A1. But people are allowed to read page B30 if they want to.
    - zentiggr 5y ago
      The point is that there's no keys involved, nothing in your private office. No rummaging either. Publishing to a public web server is analogous to that little free library, out in the yard. No keys, anyone can look in it at any time. If you accidentally put something sensitive in there, where anyone can see it without any access control, you can't blame them for doing so.
dr-detroit 5y ago
In my experience the managers don't have the information to make a sound decision. The fault is putting trust in the cat who impressed you 20 years ago when alls you needed was 1 sysadmin for your exchange server. He hasn't learned anything in 20 years and is above reproach because when I point out his failings him and the manager go off in a quiet room and he DESTROYS me with trash talk.
miohtama 5y ago
All hacks are ”sophisticated” because otherwise the other party would be ”dumb”
da_chicken 5y ago
Hey, the only people we have to convince that it's not hacking are the insurance companies. When they start charging their clients for their absurd levels of risk and liability, we'll start to see actual change.

It is very easy for IT managers to put the blame on "hackers" intruding into the network, instead of assuming they created an insecure system. In many companies this can work.

prox 5y ago

Lots of these folks (like the governor) don’t even know the basics of IT. Zero knowledge. You can tell them anything and it will stick.

skissane 5y ago

Years ago, I worked at this place, they tried to install these new core routers. The first core router worked fine, but connect the second and the whole campus network would go into meltdown. The network team could not work it out. The vendor could not work it out. But one of the IT managers had an explanation: me. Firstly, it was due to an OpenVPN I installed on a server (with permission-as a stopgap measure so we could remotely access the “next-gen data centre” because the networking team was taking too long to get the real VPN installed and it was blocking other teams on the project.) The explanation didn’t make any technical sense: the VPN is just an application, nothing to do with the core routers; but he wasn’t technical enough to understand that. They told me to shut it down, so I did (even though doing so inconvenienced the project), and lo and behold, it made zero difference to the problem. Then, he apparently even suggested at a management meeting (I wasn’t there but I heard about it) that I was sneaking in to the data centre at night or on the weekends to sabotage things, and that was why the new routers didn’t work. Apparently they even asked campus security for my physical access logs, which revealed I hadn’t been doing any such thing. Eventually, the vendor worked out the problem. When you install the router, there was a step you had to change the VRRP IDs to give every router a unique ID on the network. Clearly explained in the documentation, obviously essential, apparently our networking team didn’t read that part. You plug one new router in, everything is fine; plug the second one in, well it still has the OOTB default VRRP ID, so now two core routers on the campus network have the same VRRP ID, and all the other routers got confused, and the whole thing fell apart. Both our networking team and the vendor’s support team were so focused on chasing some obscure bug they didn’t see the basic config issue.

isoskeles 5y ago
Did that IT manager ever apologize for accusing you of being the problem?
- skissane 5y ago
  I don’t remember him ever directly apologising, although he was nice to me afterwards (and this was many years ago, memories get hazy). I think he was rather embarrassed by the whole incident, it turned out to be such a basic configuration issue and it took them so long to solve it. I only knew about the whole “sneaking in at night” allegation because my boss told me what he’d said at meetings to which I wasn’t invited, and I don’t think my boss was supposed to tell me what was said in those meetings, so I’m not even sure if he knew that I knew he’d accused me
temp_praneshp 5y ago
Wow, I'll keep this in mind next time I complain about my manager.
- wslack 5y ago
  r/talesfromtechsupport is full of these sorts of stories. I make a visit on days when my job is frustrating and inevitably feel better.

Spivak 5y ago

I very much want the blame to be on the person who broke into my house regardless of whether my door was locked or my window was open.

zentiggr 5y ago
Which works great when there's some kind of access restriction in place. If you wind up putting your tax returns in the 'little free library' you set up on your front yard, you can't blame others for reading them, then handing them back to you and not telling anyone else. That's the proper analogy for what happened in the original article.
- Spivak 5y ago
  This doesn’t track at all. This is me telling you that your forms are on my desk and throwing you the keys to my office. And then after getting your papers you go rummaging around other stuff. Like sure I’m accepting a risk that you could do that but you’re still a dick if you actually do.
  - closeparen 5y ago
    Content you're serving on a public URL is content you have published. It's not your house and you didn't extend anyone any trust or limited access. You put it in The New York Times. Maybe you hoped no one would find it because it's on page B30 and most people only read A1. But people are allowed to read page B30 if they want to.
  - zentiggr 5y ago
    The point is that there's no keys involved, nothing in your private office. No rummaging either. Publishing to a public web server is analogous to that little free library, out in the yard. No keys, anyone can look in it at any time. If you accidentally put something sensitive in there, where anyone can see it without any access control, you can't blame them for doing so.

dr-detroit 5y ago

In my experience the managers don't have the information to make a sound decision. The fault is putting trust in the cat who impressed you 20 years ago when alls you needed was 1 sysadmin for your exchange server. He hasn't learned anything in 20 years and is above reproach because when I point out his failings him and the manager go off in a quiet room and he DESTROYS me with trash talk.

miohtama 5y ago

All hacks are ”sophisticated” because otherwise the other party would be ”dumb”

da_chicken 5y ago

Hey, the only people we have to convince that it's not hacking are the insurance companies. When they start charging their clients for their absurd levels of risk and liability, we'll start to see actual change.