4 ms·

No amount of beating low level employees will change whether they can accept pdf sent by email or not. And also, they are not supposed to use their intuitive i

by watwut 8mo ago

No amount of beating low level employees will change whether they can accept pdf sent by email or not. And also, they are not supposed to use their intuitive ideas about what is and what is not dangerous use of software. When they do use their intuitive ideas, hacks happen. Karen here doing what she was told and accepting only formats that her organization security team told her to do is Karen doing the correct thing. We are on HN. People who are responsible for overreaching unreasonable security rules ... are basically us. And we are all paid way more then Karen, but are the first to call Karen an idiot when the hack happens. Karen does not know why pdf is different from doc or whatever. Nor is she required to know.

trinsic2 8mo ago
Disagree. Employees need to be responsible and make their voices heard. The whole thing was justified. We enable nightmares with our acquiescence.
- perching_aix 8mo ago
  And how does the author (or you) know she doesn't keep raising this? Edit: can't even confirm that it really is only fax and physical mail that's available; on a cursory search, tackling this fully online is already well possible: https://news.ycombinator.com/item?id=47544562 https://news.ycombinator.com/item?id=47544562
  - snk 8mo ago
    You mean, Karen lied?
    - perching_aix 8mo ago
      No, that is not what I meant. If anything, the blogpost author might have, but that's not what I mean either. It is entirely possible for both parties to have simply missed thinking of this. Or for me to be missing or misunderstanding something.
johnnyanmac 8mo ago
>No amount of beating low level employees will change whether they can accept pdf sent by email or not. I disagree. I'm sorry Karen here needs to bear the brunt, but if this kept up, at some point Karen's boss will take notice, And then it moves up the chain to someone who can affect that policy. Companies purposefully set us up to communicate bottom-up, so we can either play the game or break the law. >People who are responsible for overreaching unreasonable security rules ... are basically us No, it'd be a policy maker or CEO who thinks we're in the 90's and that secure email documentation isn't a thing. "We" could suggest so many ways to handle it that would save costs while being more secure. We're not much higher on the totem pole than Karen. Yet suddenly, we get these incidents and our bosses are suddenly rushing to IT to find a solution. As if 6 months of deliberation wasn't enough.
- masklinn 8mo ago
  > I'm sorry Karen here needs to bear the brunt, but if this kept up, at some point Karen's boss will take notice, And then it moves up the chain to someone who can affect that policy. That’s a hilarious fantasy you have here.
  - johnnyanmac 8mo ago
    I'm open to options. Not doomerism "the system can't be fixed" mentality. I don't like to think of myself as combative. Ideally we get listened to in council and they properly pull what strings are needed to help. But this has been my reality. Employees can evangelize for months for better security, but then a (very avoidable) hack happens and suddenly the budget for it appears out of thin air. Being a nuisance (or letting nature take its course, in the perspective of an employee) is much more powerful to these kinds of organizations than words.
    - masklinn 8mo ago
      > But this has been my reality. Employees can evangelize for months for better security, but then a (very avoidable) hack happens and suddenly the budget for it appears out of thin air. So your lived experience indicates that harassing front-line low-level employees about it does not work because they won't be listened to. Why, then, are you advocating for harassing front-line low-level employees? Go for the people who can actually set policy: ministers, representatives, council, agency boards, managers. When you call, rather than take it out on the employee request to be transferred up. And even if you don't have the energy to keep fighting after your own case has been fixed (a very common remedy when it's usually much easier to grease the squeaky wheel than to actually fix the axle), try to leave information on your process and contact points in accessible locations so that those afterwards can start a step or two ahead.
callmeal 8mo ago
>No amount of beating low level employees will change whether they can accept pdf sent by email or not. Yes, but a boss being unable to receive a fax because the machine is "otherwise occupied" may do that.
- autoexec 8mo ago
  I highly doubt it. Not accepting PDF files from random email addresses that send to your very publicly listed email address is a smart policy. One angry jerk trying to DoS the fax machine is not going to change the policy. At best, it'd cause them to ditch the paper and toner and upgrade so that all incoming faxes are automatically scanned and sent to an email box.
cortesoft 8mo ago
> We are on HN. People who are responsible for overreaching unreasonable security rules ... are basically us. I don’t think that is true. Rules that you have to use a fax machine are enshrined in outdated laws. No IT professional is going to say to use a fax machine for security. The same thing is true for a lot of security practices. Our company had silly password rotation policies because of certification requirements, not because our IT team thought it was necessary.
- autoexec 8mo ago
  > No IT professional is going to say to use a fax machine for security. An IT professional will say don't open PDF files from every random email that comes into your publicly posted email address though.

by watwut 8mo ago

trinsic2 8mo ago

Disagree. Employees need to be responsible and make their voices heard. The whole thing was justified. We enable nightmares with our acquiescence.

perching_aix 8mo ago
And how does the author (or you) know she doesn't keep raising this? Edit: can't even confirm that it really is only fax and physical mail that's available; on a cursory search, tackling this fully online is already well possible: https://news.ycombinator.com/item?id=47544562 https://news.ycombinator.com/item?id=47544562
- snk 8mo ago
  You mean, Karen lied?
  - perching_aix 8mo ago
    No, that is not what I meant. If anything, the blogpost author might have, but that's not what I mean either. It is entirely possible for both parties to have simply missed thinking of this. Or for me to be missing or misunderstanding something.

johnnyanmac 8mo ago

>No amount of beating low level employees will change whether they can accept pdf sent by email or not. I disagree. I'm sorry Karen here needs to bear the brunt, but if this kept up, at some point Karen's boss will take notice, And then it moves up the chain to someone who can affect that policy. Companies purposefully set us up to communicate bottom-up, so we can either play the game or break the law. >People who are responsible for overreaching unreasonable security rules ... are basically us No, it'd be a policy maker or CEO who thinks we're in the 90's and that secure email documentation isn't a thing. "We" could suggest so many ways to handle it that would save costs while being more secure. We're not much higher on the totem pole than Karen. Yet suddenly, we get these incidents and our bosses are suddenly rushing to IT to find a solution. As if 6 months of deliberation wasn't enough.

masklinn 8mo ago
> I'm sorry Karen here needs to bear the brunt, but if this kept up, at some point Karen's boss will take notice, And then it moves up the chain to someone who can affect that policy. That’s a hilarious fantasy you have here.
- johnnyanmac 8mo ago
  I'm open to options. Not doomerism "the system can't be fixed" mentality. I don't like to think of myself as combative. Ideally we get listened to in council and they properly pull what strings are needed to help. But this has been my reality. Employees can evangelize for months for better security, but then a (very avoidable) hack happens and suddenly the budget for it appears out of thin air. Being a nuisance (or letting nature take its course, in the perspective of an employee) is much more powerful to these kinds of organizations than words.
  - masklinn 8mo ago
    > But this has been my reality. Employees can evangelize for months for better security, but then a (very avoidable) hack happens and suddenly the budget for it appears out of thin air. So your lived experience indicates that harassing front-line low-level employees about it does not work because they won't be listened to. Why, then, are you advocating for harassing front-line low-level employees? Go for the people who can actually set policy: ministers, representatives, council, agency boards, managers. When you call, rather than take it out on the employee request to be transferred up. And even if you don't have the energy to keep fighting after your own case has been fixed (a very common remedy when it's usually much easier to grease the squeaky wheel than to actually fix the axle), try to leave information on your process and contact points in accessible locations so that those afterwards can start a step or two ahead.

callmeal 8mo ago

>No amount of beating low level employees will change whether they can accept pdf sent by email or not. Yes, but a boss being unable to receive a fax because the machine is "otherwise occupied" may do that.

autoexec 8mo ago
I highly doubt it. Not accepting PDF files from random email addresses that send to your very publicly listed email address is a smart policy. One angry jerk trying to DoS the fax machine is not going to change the policy. At best, it'd cause them to ditch the paper and toner and upgrade so that all incoming faxes are automatically scanned and sent to an email box.

cortesoft 8mo ago

> We are on HN. People who are responsible for overreaching unreasonable security rules ... are basically us. I don’t think that is true. Rules that you have to use a fax machine are enshrined in outdated laws. No IT professional is going to say to use a fax machine for security. The same thing is true for a lot of security practices. Our company had silly password rotation policies because of certification requirements, not because our IT team thought it was necessary.

autoexec 8mo ago
> No IT professional is going to say to use a fax machine for security. An IT professional will say don't open PDF files from every random email that comes into your publicly posted email address though.