3 ms·

How on earth would that make more sense than properly setting up ACME and forgetting about the problem for the next hundred years?? If your bespoke ERP system i

by 9dev 1y ago

How on earth would that make more sense than properly setting up ACME and forgetting about the problem for the next hundred years?? If your bespoke ERP system is really so hostile toward cert changes, put it behind a proper reverse proxy with modern TLS features and self-sign a certificate for a hundred years, and be done with it. It'll take about fifteen minutes of time, and executive level won't ever have to concern themselves with something as mundane as TLS certificates again.

zoeysmithe 1y ago
Yep this. This is just "we have so much technical debt, our square pegs should fit into all round holes!" Business culture devaluing security is the root of this and I hope people see the above example of everything that's wrong with how some technology companies operate, and "just throw money at the problem because security in an annoying cost center" is super bad leadership. I'm going to guess this guy also have an MFA exception on his account and a 7 character password because "it just works! It just makes sense, nerds!" I've worked with these kinds of execs all my career and they are absolutely the problem here.
- FuriouslyAdrift 1y ago
  IT serves business needs... not the other way around. If anything, cloud services and mobile device access has made securing anything just about impossible.
  - Loudergood 1y ago
    Classic case of business not understanding that it doesn't just need access to the data, it needs secure access to the data.
    - FuriouslyAdrift 1y ago
      That's what insurance and lawyers are for... so sayeth my management that pay me.
darkwater 1y ago
> How on earth would that make more sense than properly setting up ACME and forgetting about the problem for the next hundred years?? If your bespoke ERP system is really so hostile toward cert changes, put it behind a proper reverse proxy with modern TLS features and self-sign a certificate for a hundred years, and be done with it. I completely agree with you but you would be astonished by how many companies, even small/medium companies that uses recent technologies and are otherwise pretty lean, still think that restarting/redeploying/renewing as less as possible is the best way to go instead of fixing the root issue that makes restarting/redeploying/renewing a pain in the ass.
- 9dev 1y ago
  > […] that restarting/redeploying/renewing as less as possible is the best way to go instead of fixing the root issue that makes restarting/redeploying/renewing a pain in the ass. I mean… There's a tradeoff to be sure. I also have a list of things that could be solved properly, but can't justify the time expense to doing so compared to repeating the shortcut every so often. It's like that expensive espresso machine I've been drooling over for years—I can go out and grab a lot of great coffee at a barista shop before the machine would have saved me money. But in this particular instance, sure; once you factor the operational risk in, proper automation often is a no-brainer.
- FuriouslyAdrift 1y ago
  I have to schedule at least 30 days out on any change or restart for main systems and I may be overruled by ANY manager. I actually watched for crashes (thank you inventory control department shenanigans) so that I can sneak in changes during a reset.
- moduspol 1y ago
  I don't know about OP but I've also worked plenty of places where I seem to be the only person who understands TLS. And not even at the "math" level. I mean, like, how to get them into a Java keystore. Or how to get Apache or nginx to use them. That you need to include the intermediate certificate. How to get multiple SANs instead of a wildcard certificate. How to use certbot (with HTTP requests or DNS verification). How to get your client to trust a custom CA. How to troubleshoot what's wrong from a client. I think the most rational takeaway is just that it's too difficult for a typical IT guy to understand, and most SMBs that aren't in tech don't have anyone more knowledgeable on staff.
FuriouslyAdrift 1y ago
Support contract states we cannot put it behind a proxy. We used to use HAProxy and multiple web server instances, but the support switched to India and they claimed they could no longer undertsand or support that configuration. Since it is a main system for the entire org and the support contract is part of our financial liability and data insurance, the load balancer had to go. This is corporate enterprise IT. Now you know why sysadmins are so grumpy.
- 9dev 1y ago
  My condolences:)
- slipperydippery 1y ago
  Most safety & security dysfunction stories: high level management-tier misaligned incentives, incompetence, and ignorance, overriding the expert advice of mere peons, leading to predictable catastrophes (not to mention, usually, extra costs in the meantime—just hidden ones). Most solutions: make the peons watch a training video or attend a training session about how they should speak up more.

by 9dev 1y ago

zoeysmithe 1y ago

Yep this. This is just "we have so much technical debt, our square pegs should fit into all round holes!" Business culture devaluing security is the root of this and I hope people see the above example of everything that's wrong with how some technology companies operate, and "just throw money at the problem because security in an annoying cost center" is super bad leadership. I'm going to guess this guy also have an MFA exception on his account and a 7 character password because "it just works! It just makes sense, nerds!" I've worked with these kinds of execs all my career and they are absolutely the problem here.

FuriouslyAdrift 1y ago
IT serves business needs... not the other way around. If anything, cloud services and mobile device access has made securing anything just about impossible.
- Loudergood 1y ago
  Classic case of business not understanding that it doesn't just need access to the data, it needs secure access to the data.
  - FuriouslyAdrift 1y ago
    That's what insurance and lawyers are for... so sayeth my management that pay me.

darkwater 1y ago

> How on earth would that make more sense than properly setting up ACME and forgetting about the problem for the next hundred years?? If your bespoke ERP system is really so hostile toward cert changes, put it behind a proper reverse proxy with modern TLS features and self-sign a certificate for a hundred years, and be done with it. I completely agree with you but you would be astonished by how many companies, even small/medium companies that uses recent technologies and are otherwise pretty lean, still think that restarting/redeploying/renewing as less as possible is the best way to go instead of fixing the root issue that makes restarting/redeploying/renewing a pain in the ass.

9dev 1y ago
> […] that restarting/redeploying/renewing as less as possible is the best way to go instead of fixing the root issue that makes restarting/redeploying/renewing a pain in the ass. I mean… There's a tradeoff to be sure. I also have a list of things that could be solved properly, but can't justify the time expense to doing so compared to repeating the shortcut every so often. It's like that expensive espresso machine I've been drooling over for years—I can go out and grab a lot of great coffee at a barista shop before the machine would have saved me money. But in this particular instance, sure; once you factor the operational risk in, proper automation often is a no-brainer.
FuriouslyAdrift 1y ago
I have to schedule at least 30 days out on any change or restart for main systems and I may be overruled by ANY manager. I actually watched for crashes (thank you inventory control department shenanigans) so that I can sneak in changes during a reset.
moduspol 1y ago
I don't know about OP but I've also worked plenty of places where I seem to be the only person who understands TLS. And not even at the "math" level. I mean, like, how to get them into a Java keystore. Or how to get Apache or nginx to use them. That you need to include the intermediate certificate. How to get multiple SANs instead of a wildcard certificate. How to use certbot (with HTTP requests or DNS verification). How to get your client to trust a custom CA. How to troubleshoot what's wrong from a client. I think the most rational takeaway is just that it's too difficult for a typical IT guy to understand, and most SMBs that aren't in tech don't have anyone more knowledgeable on staff.

FuriouslyAdrift 1y ago

Support contract states we cannot put it behind a proxy. We used to use HAProxy and multiple web server instances, but the support switched to India and they claimed they could no longer undertsand or support that configuration. Since it is a main system for the entire org and the support contract is part of our financial liability and data insurance, the load balancer had to go. This is corporate enterprise IT. Now you know why sysadmins are so grumpy.

9dev 1y ago
My condolences:)
slipperydippery 1y ago
Most safety & security dysfunction stories: high level management-tier misaligned incentives, incompetence, and ignorance, overriding the expert advice of mere peons, leading to predictable catastrophes (not to mention, usually, extra costs in the meantime—just hidden ones). Most solutions: make the peons watch a training video or attend a training session about how they should speak up more.