Nobody in their right mind would put me in management.
But I do have a customer I am assigned to, and I have to manage those projects
And I fucking hate it
Not the customer themselves, they're nice people. I hate the act of managing. Calling here, calling there, oh this guy is on vacation, better delay everything then...
I installed Windows NT 3.1 on a Compaq ProSignia 3080 system, because of several reasons: I know that this machine was running Windows NT 3.1 when it was in productive use. And I think this machine was one of the machines Microsoft explicitly targeted with Windows NT. For improved performance, I ...
I'm definitely not going to go out of my way to find work to do
So I volunteered to be the SPOC for this customer, because a.) then I can say I'm SPOC for a customer, and b.) people won't believe I'm not doing anything productive
And since we are a priori understaffed only for the next 6 month, the direction does not want to hire too much because then we could become overstaffed.
Who on earth design a system this fucking shitty, has a pentest, two years to fix, and doesn't manage to fix ANYTHING?!
@A.Hersean I hope you can manage the next few months. Just refuse to perform, because management could see that as a sign that you don't need more people anyways
We had that at the local gov't after a "reform"
Departments were systematically bled out to "make the departments leaner" and then people dropped like flies from burnout
Management understands the situation, and we risk being late in delivering and having to pay penalties. But it's a risk they are willing to pay. They do not force us to work overtime either, like in lots of startups, so they are pretty cool on this matter compared to other work places.
Good, good. Because usually this shit goes like this: "We're temporarily understaffed, but it's just temporary, so give your best and push through" - "Oh, looks like we weren't understaffed at all and we can manage with 30% less people. Perfect."
The motto remains "quality of quantity", so we must take the time need to perform the tasks. But we still feel the pressure, because we like our work and would like to finish it in time.
@MechMK1 Management knows that a lot of people would quit if they put stuff like this in place. The turnover is still quite high because in my city there's a lot of jobs in cybersecurity so it's easy to find another job.
Also just saw a weird deleted question. Guy says he "scanned his internal network"; then claims he scanned his public IP. Says he didn't set up any port forwarding, then is suprised that no ports are open.
@A.Hersean Why do people go for other jobs then instead of this one?
I know ex-colleagues that went to other companies that offered dream jobs (for them), but did not deliver. One of them quit after 6 months. The other is still there, but ended up doing exactly the same job as back in our company.
My company offered me an incredible bonus system, which would have lead to me receiving ~300€ more per month
That system was "cut" 1 month after I started
I didn't consent to this, and essentially, was hired with a bait-and-switch tactic.
So I don't feel bad at all if I am tasked to do a pentest for 5 PD and only work 1.5 PD on it realistically.
After all, if they can unilaterally change the compensation they give me for my work, then it's only fair for me to unilaterally change the amount of work I put in.
We rarely have more time than enough to perform our tasks. We could almost always do more if we had more time. And since we like to produce quality work (related to why we refuse lots of applicants, and also to the good cooperative work atmosphere in the workplace), we rarely do the minimum (we can do it when the client is a real ass).
The arse client usually get few vulnerabilities (we can avoid exploring some for when the clients come back) with harsh reports detailing even minor stuff. We usually emphasize the nice things when we find some, but not for those those clients.
@A.Hersean I have this one sentence in my report, which is just basically "You're a complete fucking idiot and everything you touch will end up in failure"
Q: "When running the Windows Media Creation Tool, I get error 0xE0007BA2. What should I do?" A: "Run the Windows Media Creation Tool."
@A.Hersean That's why we don't certify
And I say in every kickoff meeting: "The goal of a penetration test is not to prove the absence of vulnerabilities. It is impossible to do that. The goal of a penetration test is to discover vulnerabilities, so that they can be fixed and make the product more secure.
I'm 100% certain if I fed a chatbot with all questions and answers from Super User tagged "windows" and then let it write automated answers to questions, it would do a better job that Microsoft's "Experts"
We don't technically certify. We are a contractor for a national agency that can deliver certifications. We write evaluation reports (the evaluations usually are of 20 to 30 work days), and based on our findings the agency delivers (or not) the certification.
Are there any advanced security technologies, for example, establishing a secured connection, which first require authentication based on security through organic-like changing obscurity of secrecy?
I'm not a fan of "regular" security through obscurity, because hackers will eventually discover an...
I believe that's what you get when you want to provide tech support to people who don't even know what they are doing.
Like, okay, imagine you open up a GitHub issue for a project. You provide detailed steps to reproduce the issue, provide a stacktrace, perhaps even a debugable memory dump. And the answers you will get are going to be amazing.
Now imagine doing the exact same thing on answers.microsoft.com. You will be asked "did you try restarting the application?" or "Did you try updating Windows?" or "Did you try disabling Anti-Virus?"
And because they expect that the "input" for questions is going to be nearly unusable, the answers they provide and are expected to provide are going to be nearly unusable.
And to be honest, "Did you try rebooting your computer?" or "Did you try restarting the application?" will probably resolve a good chunk of all issues.
For example, I once had OpenVPN problems, where my connection was continuously reset every couple of seconds. I resolved it by rebooting my machine. Why was it an issue in the first place? I'd love to know, but I probably never will
but is answers.microsoft.com a place for "official" support? I never understand if such communities (also on Google, etc.) are by enthusiasts for enthusiasts, or if they are something more official
sometimes I suspect (or rather, I'm pretty sure) lots of products rely on support by volunteers, hoping they will help clients use their products, instead of investing in real official support
I might be wrong, but I suspect there's something wrong with the way technology works. If a product has a problem, the problem should be fixed by whoever created (and sold) that product. Right now, in the world, millions of poor guys are fixing Microsoft's problems, while not being paid by Microsoft
Now that more and more of their products are on github, one can open issues.
@reed Depends. Most games end up with patches fixing most of their issues.
But for crappy IOT stuff, obviously not.
I think the culprit is this:
> THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
What is the difference between Cyber Security and Digital Security? They sound very similar (same) to me, But I have read that
current techniques of Machine Learning can provide Digital Security, But not Cyber Security.
So what is the difference?
In French, "digital" still retains its original meaning of "with digits" (AKA fingers). "Digital" gets translated to "numeric". So, "Digital security" would be gloves.