3 ms·
They were providing root either way, the only change I assume was switching from the same root on all machines to a per-machine root password. I can understand
by masklinn 3y ago
They were providing root either way, the only change I assume was switching from the same root on all machines to a per-machine root password.
I can understand how that would be a pain in the ass if your legacy architecture (e.g. administration and reporting tooling, etc…) is predicated upon a unified root, you probably don’t even have a way to report the information so that machines and passwords could be paired.
Assuming a good way to provision keys is provided, I’d make the insecure unified root password into a paid option (with lots of warnings) the price of which would increase every year. This way the existing workflow of the customer keeps working short-term, but you CY the hell out of your A in case of breach at the customer’s, and at one point the line item will get large enough that the customer allocates time & money to fix their shit.
- true_religion 3y agoCharging for insecure systems incentivizes selling those same systems to customers. Soon you’ll have sales guys regaling how this unified root password system is extremely convenient and you’re one of the few companies who provides this single-signature-security-system (S4 compliance). Next thing you know someone will gain an software patent on this to ensure no one else can provide it.
- perfmode 3y agoBut charging for it also disincentivizes customers from asking for it.
- PaulHoule 3y agoPass some law that says the money has to go to some federal cybersecurity fund or something to pay for cleaning up the mess.
- masklinn 3y ago> Soon you’ll have sales guys The solution is trivial: no commission on this. Possibly even negative commission, can't convince your client not to take this? You get less money for the sale. This way sales are incentivised to only talk about this if not doing so would lose them the sale entirely.