5 ms·

A gleeful feeling does come across, although the poster does claim it's not schadenfreude. They also mention they think plenty of notice was given out to variou

A gleeful feeling does come across, although the poster does claim it's not schadenfreude. They also mention they think plenty of notice was given out to various middle managers. There are better ways to handle this, when sending the messages out. If the deadline for compliance was 31 Jan, then when sending comms out say the deadline is 31 Oct, and machines would be wiped after that. Then start wiping them, 10% of machines on 1st November, another 10% on 8th November, etc.

tux3 4y ago
I think we can charitably call it watching a trainwreck unfold. There is not necessarily any Schadenfreude in watching and reporting it. No one really needs to be taking pleasure, it's just hard to not pay attention to a train crash occuring in slow motion. It's very natural to want to talk about something this stupid/bad. Rubber necking is extremely human.
AtlasBarfed 4y ago
I agree. Not a single concern for boots on the ground that are likely already squeezed, and now has the apparently abusive compliance and security departments fucking them over. Now everyone in the affected chain gets a black mark on their "permanent records" and gets exposed at a time when likely layoffs are coming. What I don't hear is "why can't they upgrade, and how can we help them upgrade", it's WE TOLD YOU, NOW YOU SUFFER. Here's the kicker: it's 1600 devices. Ok, so they've been told for 13 months to do this. Well, let's do some math. That's 260 working days. Oh look, about 1600 working hours. So if you guys had simply upgraded a device an hour over the last year, this wouldn't have been the problem. Yes, that's not fair, but neither is what the person doing. Security is the military arm of compliance. Finger pointing at compliance is a bit mendacious. Saying LOL it's not my fault, it was compliance. NOW WATCH ME DROP THE HAMMER BOOM. I mean, I guess the guy is saying LOL I'm outsourced and not even in the company HAHAHA. Still, eff this guy for taking a bit of glee in this.
- iso1631 4y ago
  If I were uncharitable and cynical I would claim that it looks like somebody has a goal to implement central device procurement and management and have built a system to enable that to happen.
- zokier 4y ago
  > Here's the kicker: it's 1600 devices. Ok, so they've been told for 13 months to do this That is not really how I read it; the devices got an year extension because people had already failed to refresh them within the standard cycle. From the sounds of it these are typical workstations etc, their support cycles are very predictable and if you bought some crappy ones without predictable lifecycle that is on you too. That extension should have been wakeup call, the process had already failed then.
- jodrellblank 4y ago
  Not sure if the devices are laptops or phones, so assume $400/device and $50/hour time, that's about a $700,000 dollars. "If you had simply spent nearly three quarters of a million dollars of your own money, done 40 weeks of volunteer overtime on top of your normal job, without any purchase approval, without the authority to do that, and no guarantee of seeing that money back, this wouldn't have been a problem, so fuck you" is a terrible take all around. > "What I don't hear is "why can't they upgrade, and how can we help them upgrade"" We know why they can't upgrade, because the departments responsible for purchasing the upgrades won't agree to spend the money. This isn't something which can be helped by more technical input. > "Finger pointing at compliance is a bit mendacious" "mendacious: not telling the truth; lying." - nope, wrong. Legal and Compliance say it must be done and you must do it, and have the authority to do that. Pointing fingers at them is honest and appropriate, that is where the instruction is coming from (legal) and the reason why the instruction exists (compliance with internal or external regulations).
  - iso1631 4y ago
    Except the tale all falls apart when the service desk had no idea this was going to happen Clearly the compliance team (or whoever is implementing it) has failed in its communication
    - AtlasBarfed 4y ago
      I'm not saying the guy is the second coming of Hitler. I mean is it his job to care? Not really. Is the absurdity humorous? Maybe he communicated it wrong? It's twitter. It's more that security teams tend to have uncooperative, aggressive, authoritatian, and punative dispositions. I think ye old security industry had its roots in three letter government agencies which are used to conformance, policy hammers, and enemies of the state. But when you add that to an organization already rife with infighting, dissatisfaction, and frustration, it will just lead to more resentment and your employees become your enemies. The biggest security threats these days aren't leet hackers exploiting 0days, or even the county password inspector conning his way in. It's overworked angry pissed off employees leaving the door open. It's like Princess Leia said: the tighter you squeeze, the more people you lose.

tux3 4y ago

I think we can charitably call it watching a trainwreck unfold. There is not necessarily any Schadenfreude in watching and reporting it. No one really needs to be taking pleasure, it's just hard to not pay attention to a train crash occuring in slow motion. It's very natural to want to talk about something this stupid/bad. Rubber necking is extremely human.

AtlasBarfed 4y ago

I agree. Not a single concern for boots on the ground that are likely already squeezed, and now has the apparently abusive compliance and security departments fucking them over. Now everyone in the affected chain gets a black mark on their "permanent records" and gets exposed at a time when likely layoffs are coming. What I don't hear is "why can't they upgrade, and how can we help them upgrade", it's WE TOLD YOU, NOW YOU SUFFER. Here's the kicker: it's 1600 devices. Ok, so they've been told for 13 months to do this. Well, let's do some math. That's 260 working days. Oh look, about 1600 working hours. So if you guys had simply upgraded a device an hour over the last year, this wouldn't have been the problem. Yes, that's not fair, but neither is what the person doing. Security is the military arm of compliance. Finger pointing at compliance is a bit mendacious. Saying LOL it's not my fault, it was compliance. NOW WATCH ME DROP THE HAMMER BOOM. I mean, I guess the guy is saying LOL I'm outsourced and not even in the company HAHAHA. Still, eff this guy for taking a bit of glee in this.

iso1631 4y ago
If I were uncharitable and cynical I would claim that it looks like somebody has a goal to implement central device procurement and management and have built a system to enable that to happen.
zokier 4y ago
> Here's the kicker: it's 1600 devices. Ok, so they've been told for 13 months to do this That is not really how I read it; the devices got an year extension because people had already failed to refresh them within the standard cycle. From the sounds of it these are typical workstations etc, their support cycles are very predictable and if you bought some crappy ones without predictable lifecycle that is on you too. That extension should have been wakeup call, the process had already failed then.
jodrellblank 4y ago
Not sure if the devices are laptops or phones, so assume $400/device and $50/hour time, that's about a $700,000 dollars. "If you had simply spent nearly three quarters of a million dollars of your own money, done 40 weeks of volunteer overtime on top of your normal job, without any purchase approval, without the authority to do that, and no guarantee of seeing that money back, this wouldn't have been a problem, so fuck you" is a terrible take all around. > "What I don't hear is "why can't they upgrade, and how can we help them upgrade"" We know why they can't upgrade, because the departments responsible for purchasing the upgrades won't agree to spend the money. This isn't something which can be helped by more technical input. > "Finger pointing at compliance is a bit mendacious" "mendacious: not telling the truth; lying." - nope, wrong. Legal and Compliance say it must be done and you must do it, and have the authority to do that. Pointing fingers at them is honest and appropriate, that is where the instruction is coming from (legal) and the reason why the instruction exists (compliance with internal or external regulations).
- iso1631 4y ago
  Except the tale all falls apart when the service desk had no idea this was going to happen Clearly the compliance team (or whoever is implementing it) has failed in its communication
  - AtlasBarfed 4y ago
    I'm not saying the guy is the second coming of Hitler. I mean is it his job to care? Not really. Is the absurdity humorous? Maybe he communicated it wrong? It's twitter. It's more that security teams tend to have uncooperative, aggressive, authoritatian, and punative dispositions. I think ye old security industry had its roots in three letter government agencies which are used to conformance, policy hammers, and enemies of the state. But when you add that to an organization already rife with infighting, dissatisfaction, and frustration, it will just lead to more resentment and your employees become your enemies. The biggest security threats these days aren't leet hackers exploiting 0days, or even the county password inspector conning his way in. It's overworked angry pissed off employees leaving the door open. It's like Princess Leia said: the tighter you squeeze, the more people you lose.