3 ms·

You have to remember that most businesses don't perform any kind of security auditing whatsoever. Any non-tech business with 50 or less people has gaping securi

You have to remember that most businesses don't perform any kind of security auditing whatsoever. Any non-tech business with 50 or less people has gaping security holes. I say that with absolute certainty.

b112 3y ago
I saw someone running win98se 5 years ago, the box seething, writhing in pain with highly apparent malware, as a controller for industry grade, niche market machinery. It was network connected for "the IT company to log in and fix things", had software that would only work in win98se, and because the machine was "in the room", its browser was used because "convenient". No one cared. This is normalcy for most people. Even if the "it only works on bare metal" thing was true, and its hardware key device may make that a reality, there's zero reason to let people browse on it. Or leave it online 24x7, one could bring a switch port up/down when needed. Ah well. As you say, this is normal.
- bongodongobob 3y ago
  Yep, especially in manufacturing. They still run windows XP machines because you can't upgrade the OS due to vendor specific hacks. It's either run XP or fork out a million dollars for an OS upgrade because they would need to replace the whole machine. I've supported many businesses like this.
acdha 3y ago
True, but if the CFO is running with admin privileges how likely is it that they are otherwise enough on the ball security-wise to be writing or even making decisions about code in an unsafe language? The whole point of safety standards is to avoid everyone needing to be an expert in everything: I can look for a UL label and know that someone else has taken care of the basics, even though our CFO can still do something crazy like leaving his space heater running under a pile of newspaper. That doesn’t mean having the other safeguards wasn’t a good idea because they don’t solve every problem.

b112 3y ago

I saw someone running win98se 5 years ago, the box seething, writhing in pain with highly apparent malware, as a controller for industry grade, niche market machinery. It was network connected for "the IT company to log in and fix things", had software that would only work in win98se, and because the machine was "in the room", its browser was used because "convenient". No one cared. This is normalcy for most people. Even if the "it only works on bare metal" thing was true, and its hardware key device may make that a reality, there's zero reason to let people browse on it. Or leave it online 24x7, one could bring a switch port up/down when needed. Ah well. As you say, this is normal.

bongodongobob 3y ago
Yep, especially in manufacturing. They still run windows XP machines because you can't upgrade the OS due to vendor specific hacks. It's either run XP or fork out a million dollars for an OS upgrade because they would need to replace the whole machine. I've supported many businesses like this.

acdha 3y ago

True, but if the CFO is running with admin privileges how likely is it that they are otherwise enough on the ball security-wise to be writing or even making decisions about code in an unsafe language? The whole point of safety standards is to avoid everyone needing to be an expert in everything: I can look for a UL label and know that someone else has taken care of the basics, even though our CFO can still do something crazy like leaving his space heater running under a pile of newspaper. That doesn’t mean having the other safeguards wasn’t a good idea because they don’t solve every problem.