4 ms·

I would go with an incremental progression of something like 100 random devices a week for 17 weeks, so that people see the tidal wave eating others and suddenl

I would go with an incremental progression of something like 100 random devices a week for 17 weeks, so that people see the tidal wave eating others and suddenly "get it". Less overwhelming for the service/support desk folk too.

Oxidation 4y ago
Or start with the "most critical" devices: those belonging to the highest-ranking users. They're the high-value hacking targets so it's only reasonable. Might unstick a few wallets better than hitting mostly rank-and-file for something they have no control over.
- gumby 4y ago
  Or incrementally degrade service (lock out web browser, then email...)
- jdironman 4y ago
  The problem with that is, it's most likely those devices which are already compliant / up to date.
- basch 4y ago
  If you are this close to a deadline, it doesnt really matter anymore. There is no avoiding the iceberg. You can fix your organization for next time, which is what the org believe it has initiated.
  - Oxidation 4y ago
    Well, yes you don't do this two hours out, you'd need to do it some time in the 13 months they knew about it for it to work. But at the end of the day, they did the job they were paid to do and were clear about the looming impact. It's not their job to also wipe their clients' metaphorical bottoms when they were ignored.
kneebonian 4y ago
Based on the thread I think it was Legal and Compliance forcing it. It may have been regulatory required. Also they say they are managing on behalf of their client, so their position as mercenaries is just to follow orders.
masklinn 4y ago
TFA explains that this was self imposed a hard cutoff: > For anyone wondering why we don’t just lift the compliance restrictions, we don’t specify it. Their Compliance department does after a year-long grace period: > The machines came to end of life about 12 months ago, and the company being a multi-billion dollar operation managed to eke out another year of manufacturer support. Mostly symbolic as they’re not exactly going to release custom firmware for a handful of devices. They then put a set-in-stone tombstone date on support. 12pm today. This was imposed internally by the company's compliance and legal departments, TFAA is the executioner but the execution would be contractually mandated: > They require, and have specified, a zero-tolerance for device non-compliance. This means an unapproved batched and drawn-out phaseout would be a breach of contract.
- mlyle 4y ago
  > This means an unapproved batched and drawn-out phaseout would be a breach of contract. You could brownout or kill a few a few days before the real issue, though, potentially.
  - amluto 4y ago
    Which might breach an SLA or itself be deliberate malfeasance. If I were in this position, I would want to be absolutely squeaky clean. What one could try is to call the CEO directly. Or maybe try the legal backdoor: contact the general counsel, tell them that the contract says such-and-such, that you think the contract is well written and you intend to do what it says, but that the organization should be aware that it may cause a problem. If legal doesn’t know how to get the CEO’s attention, then something is very wrong.
    - masklinn 4y ago
      The very first post of TFA lays out that they've been sending emergency-level alerts for a while (aside from that being a year-long issue): > 4 meetings, 124 emails, and two phone calls a day for the last 14 days have warned them of this. There's only so much you can do. > If legal doesn’t know how to get the CEO’s attention, then something is very wrong. From the thread legal (and / or compliance) is the setter of the issue, and was well aware that it would cause issues (for a minority), but they were not in charge of resolution. And from downthread posts, they likely extensively documented their warnings: > oh I’m absolutely backing the horse with the 3 miles of email threads proving this And methinks legal and compliance had very much planned for the issue coming to a head, because they were getting fed up with being blow off, and having to shoulder the legal or regulatory risk.
ufmace 4y ago
But that would involve actual planning. When do you do that? Do it for 17 weeks before the out of support deadline? The users start screaming, we still have 17 weeks left before the deadline, how dare you disable us early! And they get enabled again. Do it for 17 weeks after the deadline? The compliance people start screaming, you have 1600 devices out of compliance, we need them shut down now!
- Aachen 4y ago
  I think it is this sort of logic that will puzzle aliens the most, should we ever be on speaking terms with any.
  - Thetawaves 4y ago
    Bureaucracy is universal, I'm sure they will understand this extremely well.
lifefeed 4y ago
Github once did brownouts on features they were removing. For 12 hours, then later for 24 hours, they turn off the feature temporarily. The idea was to cause alarm bells to start loudly ringing for anyone still using it. https://github.blog/changelog/2021-04-19-sunsetting-api-authentication-via-query-parameters-and-the-oauth-applications-api/ https://github.blog/changelog/2021-04-19-sunsetting-api-auth... I don't know if that concept would work in this case, compliance is it's own beast, but I love that idea in general.

Oxidation 4y ago

Or start with the "most critical" devices: those belonging to the highest-ranking users. They're the high-value hacking targets so it's only reasonable. Might unstick a few wallets better than hitting mostly rank-and-file for something they have no control over.

gumby 4y ago
Or incrementally degrade service (lock out web browser, then email...)
jdironman 4y ago
The problem with that is, it's most likely those devices which are already compliant / up to date.
basch 4y ago
If you are this close to a deadline, it doesnt really matter anymore. There is no avoiding the iceberg. You can fix your organization for next time, which is what the org believe it has initiated.
- Oxidation 4y ago
  Well, yes you don't do this two hours out, you'd need to do it some time in the 13 months they knew about it for it to work. But at the end of the day, they did the job they were paid to do and were clear about the looming impact. It's not their job to also wipe their clients' metaphorical bottoms when they were ignored.

kneebonian 4y ago

Based on the thread I think it was Legal and Compliance forcing it. It may have been regulatory required. Also they say they are managing on behalf of their client, so their position as mercenaries is just to follow orders.

masklinn 4y ago

TFA explains that this was self imposed a hard cutoff: > For anyone wondering why we don’t just lift the compliance restrictions, we don’t specify it. Their Compliance department does after a year-long grace period: > The machines came to end of life about 12 months ago, and the company being a multi-billion dollar operation managed to eke out another year of manufacturer support. Mostly symbolic as they’re not exactly going to release custom firmware for a handful of devices. They then put a set-in-stone tombstone date on support. 12pm today. This was imposed internally by the company's compliance and legal departments, TFAA is the executioner but the execution would be contractually mandated: > They require, and have specified, a zero-tolerance for device non-compliance. This means an unapproved batched and drawn-out phaseout would be a breach of contract.

mlyle 4y ago
> This means an unapproved batched and drawn-out phaseout would be a breach of contract. You could brownout or kill a few a few days before the real issue, though, potentially.
- amluto 4y ago
  Which might breach an SLA or itself be deliberate malfeasance. If I were in this position, I would want to be absolutely squeaky clean. What one could try is to call the CEO directly. Or maybe try the legal backdoor: contact the general counsel, tell them that the contract says such-and-such, that you think the contract is well written and you intend to do what it says, but that the organization should be aware that it may cause a problem. If legal doesn’t know how to get the CEO’s attention, then something is very wrong.
  - masklinn 4y ago
    The very first post of TFA lays out that they've been sending emergency-level alerts for a while (aside from that being a year-long issue): > 4 meetings, 124 emails, and two phone calls a day for the last 14 days have warned them of this. There's only so much you can do. > If legal doesn’t know how to get the CEO’s attention, then something is very wrong. From the thread legal (and / or compliance) is the setter of the issue, and was well aware that it would cause issues (for a minority), but they were not in charge of resolution. And from downthread posts, they likely extensively documented their warnings: > oh I’m absolutely backing the horse with the 3 miles of email threads proving this And methinks legal and compliance had very much planned for the issue coming to a head, because they were getting fed up with being blow off, and having to shoulder the legal or regulatory risk.

ufmace 4y ago

But that would involve actual planning. When do you do that? Do it for 17 weeks before the out of support deadline? The users start screaming, we still have 17 weeks left before the deadline, how dare you disable us early! And they get enabled again. Do it for 17 weeks after the deadline? The compliance people start screaming, you have 1600 devices out of compliance, we need them shut down now!

Aachen 4y ago
I think it is this sort of logic that will puzzle aliens the most, should we ever be on speaking terms with any.
- Thetawaves 4y ago
  Bureaucracy is universal, I'm sure they will understand this extremely well.

lifefeed 4y ago

Github once did brownouts on features they were removing. For 12 hours, then later for 24 hours, they turn off the feature temporarily. The idea was to cause alarm bells to start loudly ringing for anyone still using it. https://github.blog/changelog/2021-04-19-sunsetting-api-authentication-via-query-parameters-and-the-oauth-applications-api/ https://github.blog/changelog/2021-04-19-sunsetting-api-auth... I don't know if that concept would work in this case, compliance is it's own beast, but I love that idea in general.