4 ms·
It's interesting that they can just reassign an email alias to someone else without any approvals. Could this be a permissions oversight? Or could the person wh
by kccqzy 1y ago
It's interesting that they can just reassign an email alias to someone else without any approvals. Could this be a permissions oversight? Or could the person who designed the system thought that heck it's always permitted to reassign an email alias owned by the current user?
- khazhoux 1y agoAre you requesting a process and architecture retrospective on a company from 30 years ago? :-)
- kadoban 1y agoThe bigger issue is probably being allowed to set up an arbitrary one at _all_ without approvals. Once you have one, redirecting it is maybe not the biggest issue? Could still be problematic though. This story is quite old, security culture in tech was really quite basic and forgotten in a lot of places. I would hope that a similar thing would not be allowed today at anything like a big company.
- pixl97 1y ago>security culture in tech was really quite non-existent This is 1991, the actual number of people on the internet was tiny back then. Things like SMTP servers were commonly open relays (for some reason I'm remembering sendmail being an open relay out of the box). A lot of the internet culture wasn't based on security, but of the premise you shouldn't be a dick. It quickly changed in the next few years as the number of people online exploded.
- pianoben 1y agoYep! A formative experience of my childhood was working out how to type SMTP commands over telnet and sending mail from billg@microsoft.com to my dad. Such "opportunities" vanished decades ago. Fun times :)
- mixmastamyk 1y agoWorked at an aerospace concern in the early 90s… for the first year or so there was no firewall. Yes, my Mac and PC directly on the internet with routable addresses. I soon set up a website and webcam as they were shipped. CU-See-Me blew my mind. At some point I stood up a Quake server and invited friends to play. ;-)
- deleted 1y ago[deleted]
- madeofpalk 1y agoIt was 1991. They were an up start tech company. It was a different time.
- joezydeco 1y agoYou could also register a domain for free by sending an email form to a bot. It was truly the wild frontier.
- qingcharles 1y agoThe sheer number of multi-million dollar value domains you could snag in those days was wild. All that ended when it changed to, IIRC, $200/2yr and everyone suddenly dropped all their parked domains.
- joezydeco 1y agoWe were all a bit high and mighty and believed commercial use of the Internet was an awful idea. So grabbing any domain for selling things (cars.com, movies.com, sex.com) was out of the question. We were so, so wrong.
- mattl 1y agoAnd I'm sure it was the responsibility of a single person editing /etc/aliases in Emacs, not a big drawn out process too.
- mixmastamyk 1y agoThe biggest factor is the small company… same could happen today.
- caseyy 1y agoEveryone’s super concerned about security and control, but the best places I worked in were more concerned with freedom. Yes, be savvy about security, protect key assets, but “permissions oversight” about claiming an alias seems excessive. You’ll have 1,000x more headaches and burned operational cash getting everyone to approve everyone else’s every step than handling one security incident in a decade. And even with very tight security, something will still happen. It’s best to have backups, a good restore plan, and a relaxed culture*. Or that’s what I think, anyway. I’m in SME land though, not big tech. But then again, 99.99% companies are. * common sense exceptions apply.
- kccqzy 1y ago> but the best places I worked in were more concerned with freedom Sure. But if that's the case why do you even have individual email? Make everything a group email and group IM. Not allowed to send messages to a specific person; can only send messages to everyone. What would happen? Can you see the flaw in this logic? Email isn't only for discussing work projects. It needs to be private for discussions involving HR, legal, and other personnel matters.
- shawnz 1y agoEven with the privacy concerns aside, you need individual mailboxes for reasons of maintaining organization. I think your point would be better made if in your hypothetical, we still had individual mailboxes, but everyone could see into everyone else's mailbox.
- deleted 1y ago[deleted]
- caseyy 1y agoSteve Jobs’s email was not taken away. A guy was allowed to register an alias self-service style. Everyone could reach Jobs on his email.
- mattl 1y ago