4 ms·

At my last employer, the security guy’s gig was “run Qualys”. He didn’t help us filter anything, he didn’t provide context, he didn’t provide guidance on how t

At my last employer, the security guy’s gig was “run Qualys”. He didn’t help us filter anything, he didn’t provide context, he didn’t provide guidance on how to correct or implement a compensating control. There was a business need to run Qualys, and so he was the human crontab. The rest of the time he spent vaping and complaining about compensation.

9wzYQbTYsAIc 4y ago
The next iteration of that terrible idea is to have a security contractor do that role and report to someone else who decides whether to read the report or not. DevSec is next, right?
- deleted 4y ago
  [deleted]
peteradio 4y ago
> human crontab That's good. Scrum manager as a crontab: Every week, scheduled per developer 1/2 hour: "[90%: How's your progress? Any blockers? I don't have any updates on any blockers you may or may not have previously mentioned. Your dog is good? You have a dog right? I thought so. See you., 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting. See you.]" Every Tuesday & Thursday: "[90%: Look I don't have much, you guys know what your working on I'm not gonna waste your time; 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about.] Every other week, meeting scheduled with all developers: "The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about."
talideon 4y ago
Qualys is one of the most useless pieces of software I've ever come across. It purely exists for ass-covering and box-ticking purposes, and requires so much access to run its scans (it runs random things as root and ssh's into your whole fleet) that it's one compromise away from taking down a significant chunk of the tech industry. It's one massive backdoor into everything. And on top of that, if you use a cloud provider, the data you get back is next to useless because it still thinks hostnames/IPs are a remotely useful way to identify stuff, which they aren't. It looks like they might finally be providing some remotely useful identifying metadata, like instance tags, but only after years of begging for it.

9wzYQbTYsAIc 4y ago

The next iteration of that terrible idea is to have a security contractor do that role and report to someone else who decides whether to read the report or not. DevSec is next, right?

deleted 4y ago
[deleted]

peteradio 4y ago

> human crontab That's good. Scrum manager as a crontab: Every week, scheduled per developer 1/2 hour: "[90%: How's your progress? Any blockers? I don't have any updates on any blockers you may or may not have previously mentioned. Your dog is good? You have a dog right? I thought so. See you., 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting. See you.]" Every Tuesday & Thursday: "[90%: Look I don't have much, you guys know what your working on I'm not gonna waste your time; 10%: The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about.] Every other week, meeting scheduled with all developers: "The [CEO;CTO;COO] is pissed. The velocity is not on target. I'm not saying this to anyone in particular but I am saying this to all of you. There's going to be a retrospective and I'm not sure what we are going to say. Look I got another meeting, feel free to stay on if ya'll have anything to talk about."

talideon 4y ago

Qualys is one of the most useless pieces of software I've ever come across. It purely exists for ass-covering and box-ticking purposes, and requires so much access to run its scans (it runs random things as root and ssh's into your whole fleet) that it's one compromise away from taking down a significant chunk of the tech industry. It's one massive backdoor into everything. And on top of that, if you use a cloud provider, the data you get back is next to useless because it still thinks hostnames/IPs are a remotely useful way to identify stuff, which they aren't. It looks like they might finally be providing some remotely useful identifying metadata, like instance tags, but only after years of begging for it.