Hacker News Reader

Comment by sys32768 | Hacker News Reader

I was just thinking the other day that a non-profit wiki for sysadmins would be invaluable.

It could cover all the basics but also feature case-studies of real-world examples of solving problems, so there could be a sort of knowledge base too that would attract seekers and lead them into the foundational content.

10 or 15 years ago, I remember being able to find detailed problem solving information on Google. Today the search results are a morass of affiliate and SEO content multiplied by plagiarism served from a mountainous dung heap of user-generated blather.

View on HN

I'd love to share security experience, suitably redacted, for experience learned from past engagements...it's easy to do at the water cooler, but that audience is limited.

Worked in info sec for a while now. Allow me to explain how every one of those stories go.

"We told them that you can't be running a production service on a Windows 7 desktop underneath the developers desk. They responded there was no budget for a server this year and that they couldn't take the time to port it anyway since they were too busy. We went to management and they told us to stop bothering the developers and they didn't give a damn about security that was our job so fix it. [3 minutes later] so anyway after they exfilled with the passwords and the social security info of all the employees we managed to get things restored from our 3 month old backups, and the CEO fired everyone in security. So that's why I'm currently in the job market."

"Ya so we got this meeting invite from some PM and get to his meeting with like 3 execs two dozen devs and enough middle management to make a B2B salesman weep for joy. They start the meeting by thanking everyone for the past two years of diligent work and the nights and weekends and promised to reimburse everyone for the legal costs associated with the ongoing divorces. Finally they ask us as security if we can give it the final approval so it can go into production at midnight. We explain we've never even heard of this project till now and what the hell is going on. Then one of the anonymous herd of grey suited PHB explains that they didn't invite us to meetings or ask for our help because they needed to "move fast and break things" and that security would've just slowed down their rockstar ninja wizard developers. Meanwhile my coworker has been poking at this for the past 10 minutes of the meeting and says there is no way in hell this thing is ready to ship. When asked why he pointed out that passwords were being sent in plaintext via a GET parameter in every request, every field was a SQL injection vulnerability and for some reason he was able to randomly kill processes by PID running on the server if he created a username that had a non ASCII character. The PM who called the meeting said we couldn't let good be the enemy of perfect and they were shipping anyway, which was met with thunderous applause. Well then you know what happened after, the lawsuits have mostly died down and the good news is my defense proved I didn't have any personal liability."

100x this.

If you’re not in an org that takes this stuff seriously, don’t walk, run.

They take it seriously enough to spend millions of other peoples money to cover thier ass with handwavy hire-a-bunch-of-security engineers and then lock them away with thier toys and completely ignore them until they need used as a scapegoat.

Where I work it’s a pretty respectable setup. Security efforts aren’t half assed.

So I’m staying.

I think a LOT of this can be distilled down to a pessimistic anecdote...that doesn't mean they're not relevant.

Like how the 3rd part vendor likes to make passwords like %companyName%%YearOfEngagement%%symbol%

and how that might be bad, especially if your NAS admin console is discovered to be internet facing.

I blame responsible disclosure. If your wide open infrastructure and customer data is not fair game for anyone who wants to host warez and bankrupt you, then the risk of security vulnerabilities is just another low priority business risk, we'll deal with it when it happens. It's not an existential risk.

Costs of ongoing divorce - ahha, made my day!

This; something open ended, between a wiki and stackoverflow, would be a wonderful resource to offer curious minds.

For anyone wishing collaborate on this, I want to help or at least be in the loop so I can contribute an article or three! Let's band together.

Email in profile.

I was just thinking the other day that a non-profit wiki for sysadmins would be invaluable.

That would be awesome. I also know that some non-profits are actually looking for help, mostly due to remoteness and lack of connections. A non-profit wiki with the sysadmins with a section on non-profits that need help would be amazing.

I admire the idealism but I don't see it working.

This is exactly the kind of thing the ServerFault.com community talked about back in 2009-2010 when it launched-- creating "canonical" questions, etc. I was keen to answer questions about products and concepts that were important to me. I think a lot of other people were, too.

In the beginning there were well-researched and thoughtful questions, and there was a lot of fertile ground to write about basic concepts. Then it became like Stack Overflow-- "Shut up and give me teh c0dez!" kinds of questions. Then it became Not Fun(tm) anymore.

You can see how well it "worked".

Hehe so how did they assess which answer should be canonical? how did they manage the different answers?

Because this is still what we should be doing but we have got to be a bit smarter about it than just appointing experts.

Good catch! The questions were canonical, the answers were voted on the by community. I edited my post to use the right word.

Canonical questions: https://meta.serverfault.com/a/1987

Yeah I think this is a great idea, the trick is: how do we organize the knowledge?

The reason I ask is because I am working on that question (heyho! :) so my answer is that we need a way to prioritize the information so that people don't drown in it and that there is a clear way forward. Making these assessments about information sources should be a foundation in how we communicate so that we don't get as bad a case of tragedy of the commons as other wikis have.

I am on board. Pretty much running DevSecOps 24/7 anyway ;)

A place to share old war stories would be appreciated. There was a post about an intern live upgrading and it reminded me of the pain of doing things like sendmail major version shifts without any tape backups available.

Thing I miss the most is having an IRC channel of trustworthy netizens. You know, someone to just request a ping from, or test out a service quickly!

Oh those places still exist, for example I would trust #cl-school or the people on the guix matrix.

#greybeards on https://web.libera.chat/ is now live come join me ;)

That's a fantastic idea. I got my start in tech by being a Jr Linux Admin and I haven't had the opportunity for mentorship beyond a few roles.

I've learned a lot since in the last five years, but I still have a lot of respect for the IT Greybeards.

Reply on news.ycombinator.com