« first day (2540 days earlier)      last day (84 days later) » 

12:08 AM
Just need quick advice. My notice period is ending in 8 days and still some of my colleagues don't know I am leaving. I am thinking of just sending a company-wide E-Mail tomorrow to everyone to let them know
Is this a standard practice when you leave your job?
 
12:49 AM
@VarunAgw I typically, I send out an email on my last day.
 
To the many developers here
Anyone familiar with security nazi concept? someone taking security to excess?
Had a good chat on IT Sec about this, but to hear from non IT sec folks, what did you do to work with such a person?
 
@Anthony TWO WORDS: Malicious compliance. Work it to the book, let the work pile up, then explain why.
 
1:12 AM
Rich, malicious Compliance? what is that?
Malicious compliance is the behaviour of intentionally inflicting harm by strictly following the orders of a superior knowing that compliance with the orders will not have the intended result. The term usually implies the following of an order in such a way that ignores the order's intent but follows it to the letter. For example, when a group of firefighters were ordered by management to wear the unwanted self-contained breathing apparatus that they were being issued with for safety reasons, they took to wearing the equipment on their backs while ignoring it and breathing normally. This made...
so like white mutiny of a sort?
 
It means complying, knowing that things will end up worse.
"You want to encrypt everything, including our ancient log backups? OK, I guess we'll have to shut down the backend for several days while we do this. We'll also have to divert efforts that otherwise would be going to a valuable client. Whatever you say!"
 
Removing the A of CIA...nice one!
 
Yup
The problem with people with a naïve understanding of infosec is that they completely neglect availability as an aspect of security.
It's common with the defeatist "the only secure computer is an unplugged computer" mentality where a quantifiable and manageable confidentiality or integrity risk is turned into an absolute and non-negotiable loss of availability.
 
yes...cant get to it making the most secure asset worthless ;)
Would you say that statement is absolute in itself? Say if the data is very sensitive, could the loss of confidentiality be worse than a system thats unusable?
 
If loss of confidentiality is a problem, then authorization controls should be improved.
 
1:21 AM
And authentication - and accountability - AAA triad
 
Never heard of it as the AAA triad. I always call accountability non-repudiation. :P
 
Might be a different context, I guess, network based vs auditability in general
Forest, if confidentiality is often non - recoverable once lost
 
Then you need to either accept the risk or improve authorization.
 
@Anthony.....
user image
3
 
:D
 
1:37 AM
I worked at one place where not even IT had admin access to their own machines. Nothing like having to walk the help desk through doing their own jobs.
 
Nice one, should show that to some new team members...
 
To be fair, in some of the riskier environments, it's a very good thing to prevent IT from having admin access. Of course, it requires role-based access controls be set up to allow them to do a subset of administration tasks...
 
@forest - what is the standard for "riskier"?
how would you measure that?
 
@Anthony Risk analysis, of course.
But I'm talking about environments right around the level where you need NATO SDIP-27 certification for hardware (EMSEC to avoid "TEMPEST" attacks).
Many jobs like that require security clearance (though not all).
MITRE is an example of a corporation that uses those kinds of controls.
 
Not to challenge, where I work that would be waaaaaaaaay overboard...although we are regulated sector
 
1:46 AM
What industry?
 
Insurance , and little bits of healthcare
Lots of state DOI stuff and Sarbanes 404 as well
 
ah
 
Tried an experience to improve our security posture... and results were mixed
experiment*
 
What would you say is the biggest area that needs to be improved security-wise?
 
8
Q: Handling fallout due to new security policies

AnthonyI am an InfoSec professional working as an IT auditor. For several months now, I have working closely with our information security team to strengthen the security controls governing our PCI and SOX compliance efforts. Last week, new security policies went live in the production environment. In r...

Lots of crying and complaining...
 
1:50 AM
PCI can be a little silly tbh. :P
Given that the jump proxy example you gave really isn't that hard for people to use, I think the people complaining should have just sucked it up lol
 
Kinda...tried to explain why...we are not being arbitrary or a security nazi by any means
Imagine if CC #s fall into wrong hands...get rich on the black market ;)
 
A thing for people to remember is that good security controls require nothing more than learning a new way of management/maintenance/administration, whereas bad security controls permanently prevent someone from doing their job.
Most grumbling is due to the former, so they should just suck it up.
 
Would love for you to work at my company with that attitude, :) Open spots interested lol?
 
I only work for smaller companies/private individuals because I hate bureaucracy. :P
Things like PCI's requirement to use antivirus everywhere pisses me off.
 
What would you say is the biggest area that needs to be improved security-wise? - I say third party risk / vendor monitoring from my workplace
The concept of "shared risk" when outsourcing, you know?
 
1:56 AM
yup
Outsourcing without proper risk analysis is a recipe for disaster.
 
to use antivirus everywhere...
 
Antivirus has only very narrow use-cases, despite what many people think.
 
A little surprised...are you saying endpoints, servers, are too much?
 
It depends on the system and what is passing through it. For an email or file hosting server it makes sense simply to slow the spread of malware. But for a well-regulated system which is not downloading random files from the internet or being used to store arbitrary, user-submitted files, AV only serves to increase attack surface area.
It's much better to use a reputable IDS than signature/heuristic-based antivirus.
 
Yea...given due to polymorphism
 
2:02 AM
Not just that but simply because they're so easy to bypass and they're a goldmine for privilege escalation bugs (making them worse than nothing).
 
We are also starting a BYOD...how does that change the importance of AV? Meeting with management actually later this week
 
122
A: Alternatives to anti-virus for keeping oneself safe

forestAntivirus is more dangerous in that it parses complex attacker-controlled data in a highly privileged context. This is a recipe for privilege escalation exploits. As a result, sophisticated attackers can often abuse antivirus programs to gain SYSTEM privileges. This is not a rare occurrence or on...

I wrote about it here. There are so many better alternatives...
 
What has your experience been?
 
That doesn't really change the importance much (though I don't have direct experience with it) unless people are uploading their own files. It's probably a good idea for them to use AV, but protection from a compromised e.g. laptop should be done with network access controls and the like. And, of course, making sure no one device has too much access (use a physical terminal for the most sensitive machines, etc).
The problem with BYOD is that the heterogeneity is a nightmare for IT. It also makes some of the more advanced techniques like remote attestation (TPM) network access controls where each computer cryptographically proves that the software it is running is known good before being allowed to connect impractical to implement.
 
For them to run AV...yes. As users connect VPN, safety relies on security of the end host as it will be no different than if the users are directly connected to a port. Thanks for that!
 
2:09 AM
yep
What I just find silly is when e.g. Linux or Unix log servers run Norton 360...
When they have only UDP port 514 port for syslog and TCP port 22 for SSH open.
 
Like a vehicle that transport malware on BYOD assets to the corporate network. Although we do have DMZ as an extra layer of security
 
The best way to deal with that is to take trust away from the devices.
But of course that makes people grumble when they can no longer telnet in as root to an important production server from the same computer they play video games on.
 
Haha - back to my linked question of using jump hosts... when I was working on that, thought almost exactly the same1
!
 
:P
 
Since you asked me, from where you work, what would you say is you biggest security issue?
 
2:22 AM
hm
Well I'm a contractor.
But right now I'm dealing with a small company that has no clue what it's doing.
Like legit they'd be trying to write their own crypto if they knew what a cipher was.
 
Probably why you are there right? ;) to act as the expert consultant
Read a lot of your answers on IT sec SE and they are really good :)
 
thanks :p
 
Good example that I will use for my colleagues of why security nazism is bad - security.stackexchange.com/questions/204368/…
Nicely said on that answer - security vs usability
 
@Anthony AviD (an moderator from the infosec site) coined an excellent phrase:
Security at the expense of usability comes at the expense of security.
 
You gave me some great ideas tonight :) time to head to bed :P
Thank you!
 
2:35 AM
'night
no problem!
 
 
7 hours later…
9:40 AM
Kilisi leaving really stinks
he was always a valueable perspective and I enjoyed seeing his answers on things
 
9:52 AM
morning everyone
 
@Nofel Afternoon
 
hey @SouravGhosh how is it going
 
@Nofel Doing good, how about yourself?
 
good, thanks for asking
 
10:08 AM
@forest amen to that! it's a personal pet peeve of mine
 
@Nofel Good to hear that
anyone else thinks this is off-topic?
 
10:23 AM
@SouravGhosh I think with the clarification that the OP is wondering how to answer rather than what to answer that makes it answerable
a little basic perhaps - but hey we are all beginners at the start
besides.. I like easy questions - they have easy answers :)
this one:
7
Q: What is normal when you get fired from a larger company?

ajsmLast week I was fired from a 500+ person company for reasons I won't talk much about, but it was on the verge of a wrongful termination. Let's just say my old boss lied to get me fired since he didn't like me, and both him and HR handled my termination very unprofessionally. I'm curious to see ...

is a minefield
 
@motosubatsu Now once you answered, the question appears to be much better. :)
 
while some of the company's behavior seems pretty far out there I can't help but feel there's a lot of the story we aren't getting
 
@motosubatsu well, there are always two sides... :)
 
@SouravGhosh hehe.. so I can improve questions by answering them? careful.. that sort of thing might go to my head :)
@SouravGhosh 3 sides - side a, side b, and the truth
 
@motosubatsu IIRC, there's also a badge for that
@motosubatsu evermind, I'm off-by-one. :P
 
10:29 AM
I'm half-heartedly drafting an answer to that one.. not sure if I'll post it or not. Given the "All employers are the scions of satan" attitude that sometimes rears it's head here I think some of my post might draw a bit of hate
 
@Magisch Kilisi has a low tolerance for BS and the PC thought police. It was inevitable. Being called sexist for his answer, and having it deleted didn't help, the nastiness that followed... well.
@motosubatsu Yeah, bash an employer for 100+ rep points, say that there might be more going on, earn hate.
 
@RichardU I'm quite possibly doing the OP of that Q a disservice but "I'm not going to tell you the reasons I got fired but trust me it's all lies!" tends to make me think there's at least something going on, even if it's still a case that employer has reacted disproportionately (which I think to a certain extent they have here)
also the post does serve as a timely reminder that transferring your personal phone number to a work phone is always an emphatically dumb move
work provided phones and personal phones should never entangle (self employed people are a different story of course). If you can't be arsed to carry two phones then, well that's what Dual SIM phones are for
 
10:47 AM
@RichardU ok. thanks
 
@motosubatsu yeah, that got me too. I've only seen anything close to that behavior after someone's been fired for cause, and the cause is criminal behavior. It does seem that someone at the company was mad as hell, because that level of retaliation doesn't just drop out of the sky
 
@RichardU ya I noticed one needs a thick skin these days
FWIW the question in topic seems to me like the OP is burying the lede somewhat
hard to buy the "manager lied about me" line to that extent
 
@Magisch Well, I've had that happen to me as well, but I got that manager pushed out the door.
It's not unheard of, as people are evil.
But in the question in question, I've not seen HR get that obnoxious without severe provocation
 
@RichardU Thats what I meant though. I can grok a manager finagling someone out. But in a big corp HR will be CYA'ing all day in that instance. This reads like a) OP has done something awful enough for HR to react this way or b) world's worst HR is trying to get sued
 
@Magisch Yeah, I did come up against an evil HR department once. I could have sued and won, but I was in no physical or mental condition to do so.
 
11:42 AM
The questions are also meant to be a learning tool. Even if the question is full of outright lies, someone may still get benefit.
With regards to the question at hand, the company is acting very strange there
 
If someone wanna learn, my profile question give much life advice
n how HR can be evil like @RichardU said.
 
In my experience, HR hasn't been evil, just only about the company interests
But Australia has better labour laws, so it restricts their power
(And that's not to invalidate your own experience)
 
once when I was having 1-1 with HR, I told them "X guy told me, u shaved now u cannot go back to Pakistan coz taliban will after u" they said they will take care of it
 
@GregoryCurrie count yourself among the lucky ones. And labor laws don't make evil people good, just more crafty
 
yet, they didn coz he was senior mortgage advisor
 
11:44 AM
Nofel: You have to understand, what could they do?
Did you have proof?
The best they may have been able to do is warn the guy
I refuse to believe HR people are born as the spawn of satan and inherently bad
 
and they let me go coz my issue was "Y guy a junior to me, treat me like a gay person at work"
like his expression was bizzare
and they told u, ur making a issue etc etc
 
I don't know what that means Nofel. Treat you like a gay person? Did he try to fuck you in the arse or something?
 
@GregoryCurrie simply put, HR wont resolve problem unless a person is core team
 
Is core team senior people?
 
yea
I had been to company where HR r good
but in west its brutal
I have learn to keep my head down and work.
 
11:47 AM
West = USA?
 
@RichardU that HR thing was start of it all
When I say west, it can be europe or USA
 
@GregoryCurrie HR aren't born evil, it takes years of practice
 
hahah @RichardU
 
shrug That's your experience
 
btw how r u @RichardU
 
11:49 AM
I suppose this is the part where you tell me to check my privs or some shit
 
@GregoryCurrie he is right, I been with HR who were too good
 
@GregoryCurrie Sorry, I don't speak SJW
 
My previous company, I was friends with a lot of the HR staff. So much so that when my issue came up, the CEO had to make the decision as HR were too biased.
And, ironically, I'm pretty much as... inappropriate... as they come
 
@GregoryCurrie our HR is mostly insane. Somehow they became in charge of the redecorating, and placed aesthetics over functionality
 
I'm actually attending the wedding of one of the HR people this year
Yeah, some companies treat HR as just a bucket to throw random tasks
Oh, what I fucking hate is this new bullshit "business partner" shit
Give me a break
 
11:52 AM
@GregoryCurrie that wedding isn't in a church is it? I'd hate it if anyone burst into flames
 
I'd be pretty combustable there
"The goal of the HR business partner model is to add tangible value to the company by integrating HR into all aspects of strategic planning and business operations."
Like... jesus
Someone realised the HR team didn't have their fingers in enough pies
 
marriage and HR?
where did that come from
I m lost
 
I am friends with HR people. Even though the are evil. I am going to one of their weddings.
 
12:21 PM
so I got technical interview tomorrow
what shld I expect
shld it be a question
as JD is too vague
 
@motosubatsu I know it depends on the warranty but how often do extended warranties cover water pump leaks
 
@Twyxz it's a crapshoot.. will totally depend on the warranty provider, the car etc
 
This is awful...
If it's not covered it's a £150 diagnostic check
 
£150??
really
blinking heck.. do they get celebs to come and do the work or something
what car is it?
 
The Clio hahahah
I've already found the leak
But I need to parts and fitting
just as I got the bodywork fixed
might be time to get rid and pretend the leak was never there and sell it private
 
12:38 PM
ahh
you threw me with the diagnostic comment
if you know it's leaking then yeah it's just a straight up replacement job - time to check the warranty documentation and see if it covers the water pump
is it a Renault one or third party?
I won't swear to it but I think Renault themselves only offer an extension for the fourth year
nope.. I'm wrong.. you can keep extending up to 10 years old
if it is the Renault warranty then I'm almost certain they do cover water pump
 
renault one
Well I know it's leaking but they won't just take my word for it hahaha so if they check it and it's something else that isn't covered they'll charge me £150 and then parts + servicing
 
so I guess the question is how sure you are that it's the pump
 
Well what else in the cooling system wouldn't be covered
this is where you give me a massive list of crap I can't afford :P
But I'm 90% sure it's the pump.
 
12:53 PM
mmmm.. I think hoses are covered
not sure about the radiator
 
The radiator is the most expensive part isn't it? O.o
 
nah
rads aren't usually too bad
although you might get stung a bit by dealer tax
and there's always the gotcha that if it's caused by something like a stone punching a hole in the rad they won't cover that under warranty
tbh you'd probably know if was the rad though - it's usually fairly obvious
 
as in how?
 
you can usually see the coolant trail from them - plus the steam coming off them is something of a give away
 
Just under the pump and all the pipes theres like a mini puddle of coolant
so I'm assuming that's the case but then again it could be anything above
 
12:59 PM
sounds like pump then
or possibly a hose connected to the pump
but fairly sure they cover hoses anyway
2
Q: At what point to express interest in a four-day-workweek in a new job hunting? What to keep in mind when negotiating it?

EmbeddedBobI'm currently looking for jobs and I would love for it to be a four-day affair (reduced hours, not full hours squeezed into fewer days). I value free time way more than the money I can get for it and besides I genuinely believe I can offer the company way more productivity if I have more space ou...

^ I like this guys optimism
 
Nothing was smoking so I'll assume the rad is fine
I like that guys question to give me rep
 
@Twyxz <pedant>*steaming*</pedant>
I UV'd you there
simple question => simple answer = rep!
 
1:39 PM
I'll just scam someone. Fill it up
sell it on
 
@Twyxz don't be a scum bag
:)
it really does sound like pump to me
in which case you might as well make use of the warranty
 
yeah the diagnosis is only £150 if the problem found is not covered
so it could be free
 

« first day (2540 days earlier)      last day (84 days later) »