4 ms·

I'm guessing upper management prioritized the update of these devices with downstream management rather than overburden them with other stuff. So in the end, t

I'm guessing upper management prioritized the update of these devices with downstream management rather than overburden them with other stuff. So in the end, this is just one piss poor managed division abusing another piss poor managed division. Who gets the heat? Probably the lowest level people. Why "wipe" them? That seems unnecessarily punative. You can see the "don't give a shit I work with a predatory organization" oozing from everywhere. The security guy is trying to claim that they've sent out many many notices, but really this is just an excuse to abuse other people in a machiavellian abusive organization. "Service Desk is now aware that everyone else except them was aware, and now IT is absolutely incandescent." Whoops, missed an email and a meeting in there bucko. And it's the SECOND company where this was "implemented" or "specced"? This sounds like someone checked a box or compliance or ass-covering upper management slid this under the table, but all the people it ACTUALLY AFFECTS didn't get any input or opinion on the matter. And when push came to shove over funding it that person had probably moved on to bigger and better things. So since you get to do it, you seem to be gleefully doing it. Great job.

ilyt 4y ago
> Why "wipe" them? That seems unnecessarily punative. There was something in the thread about the devices coming out of support by manufacturer, which was already extended by a year.
Blackthorn 4y ago
What exactly are you suggesting this person does? The policy to wipe clearly came from the company's compliance department. They warned them over and over what was about to happen, and went above and beyond doing it with multiple meetings and phone calls.
- whstl 4y ago
  Exactly. In this situation all you must do is warn people of the risks and document, document, document. Which the article writer seems to have done.
iso1631 4y ago
A gleeful feeling does come across, although the poster does claim it's not schadenfreude. They also mention they think plenty of notice was given out to various middle managers. There are better ways to handle this, when sending the messages out. If the deadline for compliance was 31 Jan, then when sending comms out say the deadline is 31 Oct, and machines would be wiped after that. Then start wiping them, 10% of machines on 1st November, another 10% on 8th November, etc.
- tux3 4y ago
  I think we can charitably call it watching a trainwreck unfold. There is not necessarily any Schadenfreude in watching and reporting it. No one really needs to be taking pleasure, it's just hard to not pay attention to a train crash occuring in slow motion. It's very natural to want to talk about something this stupid/bad. Rubber necking is extremely human.
- AtlasBarfed 4y ago
  I agree. Not a single concern for boots on the ground that are likely already squeezed, and now has the apparently abusive compliance and security departments fucking them over. Now everyone in the affected chain gets a black mark on their "permanent records" and gets exposed at a time when likely layoffs are coming. What I don't hear is "why can't they upgrade, and how can we help them upgrade", it's WE TOLD YOU, NOW YOU SUFFER. Here's the kicker: it's 1600 devices. Ok, so they've been told for 13 months to do this. Well, let's do some math. That's 260 working days. Oh look, about 1600 working hours. So if you guys had simply upgraded a device an hour over the last year, this wouldn't have been the problem. Yes, that's not fair, but neither is what the person doing. Security is the military arm of compliance. Finger pointing at compliance is a bit mendacious. Saying LOL it's not my fault, it was compliance. NOW WATCH ME DROP THE HAMMER BOOM. I mean, I guess the guy is saying LOL I'm outsourced and not even in the company HAHAHA. Still, eff this guy for taking a bit of glee in this.
  - iso1631 4y ago
    If I were uncharitable and cynical I would claim that it looks like somebody has a goal to implement central device procurement and management and have built a system to enable that to happen.
tux3 4y ago
Don't shoot the messenger. If compliance and legal say to wipe the laptops, and everyone with a budget was aware of it for a year, it's not reasonable to put the disaster on whoever was in charge of implementing policy. This is not a Petrov situation, you're not saving the world by going out of your way to be the person that will defy Compliance today, just because the policy is really dumb. The people locked out would be shortsighted to blame the random security guy. They joined a big company with a very strict compliance machine, not a startup where you move fast and break things, then ask legal for forgiveness. Big organizations are dysfunctional, news at 11. Don't blame a random IC for executing policy after considerable warnings. If communication is so thoroughly broken internally, and no one wants to take responsability for necessary spending, it's not the job of some random security guy to fix that internal dysfunction.
zokier 4y ago
> Why "wipe" them? That seems unnecessarily punative. Potentially leaving company confidential material on non-compliant devices is not something Compliance department would want to allow
gpderetta 4y ago
It seems to me that compliance was fully aware of what was going to happen and wanted to set an example. An expensive example, but apparently still spare change for the company, so it was well calibrated. Don't fuck with compliance I guess?
Krisjohn 4y ago
> Why "wipe" them? That seems unnecessarily punative. You're proposing to remove the devices from the cloud management service, probably including admin lockouts and anti-malware software, but leaving all the data on them?

ilyt 4y ago

> Why "wipe" them? That seems unnecessarily punative. There was something in the thread about the devices coming out of support by manufacturer, which was already extended by a year.

Blackthorn 4y ago

What exactly are you suggesting this person does? The policy to wipe clearly came from the company's compliance department. They warned them over and over what was about to happen, and went above and beyond doing it with multiple meetings and phone calls.

whstl 4y ago
Exactly. In this situation all you must do is warn people of the risks and document, document, document. Which the article writer seems to have done.

iso1631 4y ago

A gleeful feeling does come across, although the poster does claim it's not schadenfreude. They also mention they think plenty of notice was given out to various middle managers. There are better ways to handle this, when sending the messages out. If the deadline for compliance was 31 Jan, then when sending comms out say the deadline is 31 Oct, and machines would be wiped after that. Then start wiping them, 10% of machines on 1st November, another 10% on 8th November, etc.

tux3 4y ago
I think we can charitably call it watching a trainwreck unfold. There is not necessarily any Schadenfreude in watching and reporting it. No one really needs to be taking pleasure, it's just hard to not pay attention to a train crash occuring in slow motion. It's very natural to want to talk about something this stupid/bad. Rubber necking is extremely human.
AtlasBarfed 4y ago
I agree. Not a single concern for boots on the ground that are likely already squeezed, and now has the apparently abusive compliance and security departments fucking them over. Now everyone in the affected chain gets a black mark on their "permanent records" and gets exposed at a time when likely layoffs are coming. What I don't hear is "why can't they upgrade, and how can we help them upgrade", it's WE TOLD YOU, NOW YOU SUFFER. Here's the kicker: it's 1600 devices. Ok, so they've been told for 13 months to do this. Well, let's do some math. That's 260 working days. Oh look, about 1600 working hours. So if you guys had simply upgraded a device an hour over the last year, this wouldn't have been the problem. Yes, that's not fair, but neither is what the person doing. Security is the military arm of compliance. Finger pointing at compliance is a bit mendacious. Saying LOL it's not my fault, it was compliance. NOW WATCH ME DROP THE HAMMER BOOM. I mean, I guess the guy is saying LOL I'm outsourced and not even in the company HAHAHA. Still, eff this guy for taking a bit of glee in this.
- iso1631 4y ago
  If I were uncharitable and cynical I would claim that it looks like somebody has a goal to implement central device procurement and management and have built a system to enable that to happen.

tux3 4y ago

Don't shoot the messenger. If compliance and legal say to wipe the laptops, and everyone with a budget was aware of it for a year, it's not reasonable to put the disaster on whoever was in charge of implementing policy. This is not a Petrov situation, you're not saving the world by going out of your way to be the person that will defy Compliance today, just because the policy is really dumb. The people locked out would be shortsighted to blame the random security guy. They joined a big company with a very strict compliance machine, not a startup where you move fast and break things, then ask legal for forgiveness. Big organizations are dysfunctional, news at 11. Don't blame a random IC for executing policy after considerable warnings. If communication is so thoroughly broken internally, and no one wants to take responsability for necessary spending, it's not the job of some random security guy to fix that internal dysfunction.

zokier 4y ago

> Why "wipe" them? That seems unnecessarily punative. Potentially leaving company confidential material on non-compliant devices is not something Compliance department would want to allow

gpderetta 4y ago

It seems to me that compliance was fully aware of what was going to happen and wanted to set an example. An expensive example, but apparently still spare change for the company, so it was well calibrated. Don't fuck with compliance I guess?

Krisjohn 4y ago

> Why "wipe" them? That seems unnecessarily punative. You're proposing to remove the devices from the cloud management service, probably including admin lockouts and anti-malware software, but leaving all the data on them?