3 ms·

I have a hard time believing this is genuine. It feels like ragebait for security nerds to me.

• andrewflnr 3y ago
  What a paradox. You are blessed with innocence about the ways of low-rent security auditors, but poisoned with cynicism toward their victims.
  • sdflhasjd 3y ago
    I dunno, I also feel it's fake. When I compare the experience dealing with bullshitters aginst the one in the original post, it has a different feel. The post is too "internet creative writing" in tone an substance: where every argument, counter-argument, rebuttal and retort perfectly mesh to create the ideal shower-argument-esque narrative. Particularly as it feels like the same person is writing both sides. In real-life you either cut it off politely to save your own time, or it would just descend into a mudfight.
    • autoexecdotbat 3y ago
      If it makes you feel better I had a similar, but not so exciting, situation happen to me in the past. So it's not entirely outside the realm of shit that happens. What does seem super fake is the doubling down, having it an SOP/SSP, and the tripling down without some crazy amount of escalating. For example my experience went sort of like this: Low Rent Auditor: Please supply a list of username and passwords for xyz systems. Me(ccing boss and internal secops): No. Why are you asking me for that? <Links to internal SOPs, guidelines, basic common sense, etc>. Low Rent Auditor: We need this for x box on y form. <attached> Me (ccing their Sr. Auditor): That's not what that is asking for. Here's a copy of the PAM config. <attached> FIN
• technion 3y ago
  Meanwhile my issue with it is that the story got so popular online, given it feels like a normal day with most security auditors. I have to have worked with dozens of guys just like this. The only thing consistent is that they are the ones being listened to.