Hacker News Reader

Comment by dEnigma | Hacker News Reader

It wouldn't surprise me if the pandemic had an influence on some of these hacks. E.g. at our company there are some PCs still running Windows 7. For that reason they had no direct internet access, only to the internal network. But since about half the workforce, or at times more, had to work from home, and the licenses of our ERP software are bound to hardware, IT had to connect those PCs to the internet again, so the office workers could access them from home.

Of course the whole situation was less than ideal to begin with, but now it's even worse.

View on HN

Just to point out this makes no sense: you can have connectivity between host A and host B without also enabling transitive connectivity to the world of hacker-contolled host N.

I believe this is assuming companies have segmented networks and jump hosts.

In my experience, most... don't.

Enterprise IT at non-tech companies is an absolute #&@_ show. The only rationale I've been able to come with is: if some portion of your company isn't developing / keeping up with tech trends, your IT shop isn't going to be pressured to either.

It's also the case that the perception of non-technical companies having garbage IT means they get overlooked by more savy admins in their job-hunt. Very few people want to drag a manufacturer kicking and screaming into modern IT, when it's way easier to get a job with a company that gets it.

This year is going to be huge for Google cloud and m365.

It's also been my experience that non-technical companies sometimes strongly undervalue IT or programming expertise. Few who have a choice ways to take a job at a rate well under market using outdated technologies with an employer who will not value them.

I had one of those jobs for a while. It was awful. The worst part was the ridiculous demands (example: all bugs should be fixable in 30 minutes or less) on top of the embarrassingly low pay.

> non-technical companies sometimes strongly undervalue IT or programming expertise

Half of this is actually the right way to do it. On one hand undervaluing IT in almost any company these days is a major problem waiting to blow up. IT isn't just an end, it's the means to do everything else. Using computers but ignoring any good IT practice under the excuse that it's not an IT company is like working from an office with asbestos, lead paint, and black mold because you're not a construction company.

But on the other hand non-technical companies, meaning ones without a strong IT culture and focus, should undervalue programming expertise. One of the worst things a non-tech company should do is deploy all kinds of custom IT solutions developed internally by their "programmers with expertise". Invariably (and I mean this in the most literal sense possible) they will end up with a patchwork of systems that nobody understands or maintains properly but which underpins all the core services the company needs or delivers.

I think your first scenario is a good illustration of undervaluing IT, with attendant eventual disaster.

Perhaps your second is IT being overvalued? You've described a situation where technologies are being deployed inappropriately by an organization ill-equipped to handle the ongoing effort required. This is the sort of silver bullet thinking I would expect from leadership that does not understand IT beyond that it is powerful.

> You've described a situation where technologies are being deployed inappropriately by an organization ill-equipped to handle the ongoing effort required.

I took the archetypal "non-technical companies" you gave as an example earlier. If I understood your meaning correctly in the vast majority of those cases undervaluing "programming expertise" is probably the best thing to do. And by "undervaluing" I mean they such companies should not consider this as a skill they should rely on to build their IT around.

It's not that the skill is not useful in itself, just that it doesn't serve that type of company well, and valuing it suggests the companies are considering heading in waters that they're unlikely to successfully navigate.

Most of those companies will do things inappropriately because they are ill-equipped to handle this. For all intents and purposes "programming expertise" in such a company is like driving drunk. Sure you can get home safe anyway but that's not a reason to be proud of. Or you can crash but the real issue isn't that you couldn't cut it while driving drunk. You shouldn't be doing it to begin with.

I think there are two different kinds of IT value.

The first: I am a competent employee, who can do what needs to be done (in whatever technology).

The second: I am a forward-thinking planner, who surveys and keeps abreast of options and can identify, test, and deploy appropriate ones.

In my experience, it's the second that's lacking. Aka the "we can only deploy if Microsoft holds our hands through it" shops. Usually 1/2 because of lacking talent and 1/2 because of lacking / incorrect policies.

I've seen, but haven't seen too many, instances of "insert crazy state-of-the-art technology." Usually it's just institutional paralysis that prevents anything from getting done.

"Undervaluing", by definition, means "valuing something under its actual value to you." It doesn't just mean "value the thing less than you do now," or "value the thing less than the average."

So...no, undervaluing programming expertise is never a good thing, whether your particular needs are for a lot of programming or only a little. Either you need exactly zero programming—in which case undervaluing it is impossible—or you need some—in which case you need to value it the right amount.

Well you're technically correct but I was hoping my point was clear beyond the vocabulary nit-picking. This being said I also suggested "the right amount" of value such companies should put on those skills is none, because it suggest they have wrong priorities and/or unrealistic expectations of what they can achieve. You can't undervalue 0. Nit-picking works both ways but just lowers the quality conversation.

In general precision is important but in this case it doesn't make that much of a difference besides a linguistic discussion. Let's try to look beyond it and more at the point I was trying to make: In the companies referenced above, as I understand them, valuing "programming expertise" at all is setting yourself up for disaster. You'll be tempted to use it but pretty much by definition in those companies you have no ability to support the outcome long term. Even tech focused companies have a hard time keeping up with the custom solutions they develop and are struggling with technical debt.

If you worked in these companies you know how this goes and have seen the story countless times. IT manager of small IT dept has a "great idea", hires some people to implement it, and they get it sort of done with the limited resources. Pretty soon both the techies and the manager move on to greener pastures, leaving the solutions in the hands of someone with little to no interest in it but who has another "great idea". The best solutions are manageable ones and custom stuff is hard to manage in the best of cases. Programming expertise is like a live grenade, only useful in capable hands (which "non-tech" companies are almost without exception not).

> non-technical companies sometimes strongly undervalue IT or programming expertise

They might also be unable to know if a job applicant is good at IT or not? And listen mostly to how he/she describes him/herself, and how confident he/she sounds?

Meaning, the company in effect hires IT people a bit randomly, and then mostly finds people who aren't that good at their job.

And if the company started paying more, then, more competent people, but also lots of more so-so competent people, would apply for the job? And I wonder if the company then still ends up with a random mediocre IT people who are unable to really secure the network? Just that the salaries are higher?

I wonder if the underlying problem is that 99% of the population is unable to know if someone is good at software or not

Most non-tech companies don't have an IT department, they outsource.

Which means they rely on those companies to do the right thing, while not really prioritizing the work (i.e. not giving it much budget), or being able to critically evaluate the quality of the work being done.

So none of this is surprising.

Great point. + most of mgmt doesn’t see the real value in security until after the first (major) incident has occurred. (Has been my experience atleaste for < 50 employee orgs.)

This goes back well over a decade, but a talented Linux admin at a tech shop had to spin up a fresh Windows VM instance to use some MSIE-dependedent intranet app. By the time they'd completed the task ten minutes later, the instance had been pwned, on the office LAN.

It's a sh*tshow everywhere.

+1. Even when being told (for money!) to do the right thing most pay the consultant fee but don't act.

True story: A friend was pentesting a large company network in Germany, wrote his report and got paid. Years later, when being hired as head of IT security, he pulled out his old report and simply tried the default/easily crackable passwords he had discovered in the core infrastructure: They all still worked.

If his section about "use jump hosts" was ever useful for the company, it was because someone had that page open by accident, needed a place to put down his mug of coffee - et voila: His report even made a difference!

You're absolutely correct. You can do that!

There may be some room to question the general technical expertise and competence of a shop that runs a bunch of Windows 7 systems, though. IT running beyond the limit of their competency may not be capable of doing what you so wisely and rightly point to.

There may be some room to question the general technical expertise and competence of a shop that runs a bunch of Windows 7 systems, though

Or they may simply not have a choice.

My company has a particular automated machine that I have to work with once or twice a month. It is controlled by a computer that runs Windows XP. It can only run Windows XP because the company that made the software went out of business years ago.

Because of that, the control computer is not permitted on the public internet. When I interface with it, it's using a dedicated laptop through a VPN to a remote session which then accesses the control machine on a dialup connection. It's slow as heck, but since I only have to do it once or twice a month, I deal.

Just before the pandemic, we looked into replacing the circa 1995 automated machine with a new one. Because of the nature of the machine, and the local government regulations about replacing it, the cost would have been little over one million dollars. Not going to happen.

Everyone hates it. But that's why my company's IT department, which tries hard to keep up with the times, has a single Windows XP computer in its stable.

which regs tells you what computers you can buy?

which regs tells you what computers you can buy?

Not all machines are computers.

Sometimes medical devices and similar come with a computer as part of a whole certified system. The regulatory framework does not tell you which computer you can buy, precisely, but it does tell you what certifications your system must have to be used for a given purpose.

Changing out the part for an unapproved one, obviously, voids the certification.

I should also mention that it isn't in-house IT, but a separate company, and the whole thing was set up in a rushed effort late on a Friday afternoon the week before the whole working from home business would start (our management slept on it until the last minute), with a lot of other companies requesting the same support from the IT company at the same time. Not that it completely excuses everything, and as you can tell from the Windows 7 PCs it was never the most secure setup, but simply to explain some of the reasons behind the mess.

This has all the hallmarks of an organization that views IT as a cost center rather than an enabler. Such an organization will tend to resent any spending on IT, so it's unfortunately not a surprise that it has likely scrimped and saved its way into ineffectual IT.

VPNs ?

Some? I've never seen anything newer than Windows 7 on a corporate PC. I'm sure they're out there somewhere but none of the companies that I've worked at in the last 9 years has ever had Windows 8 or newer.

The last Windows 7 I saw in production was on Wednesday. An attorney with a lot of secrets to protect had them on his notebook.

He isn't entirely oblivious about security, has his hard drive encrypted and encrypts some of his calls, but the non-updated system is a disaster waiting to happen.

I have to use Windows 7 daily at my current job at a bank (connecting via VDI). I forgot to wish the operating system happy tenth birthday a couple weeks ago.

Amazon was on Windows 10 in 2020 (and probably earlier; I don't remember when I upgraded while I was there).

> there are some PCs still running Windows 7.

A humble brag!

There are some very elderly machines out there.

Reply on news.ycombinator.com