Comment by AtlasBarfed | Hacker News Reader

Comment by AtlasBarfed | Hacker News Reader

I'm guessing upper management prioritized the update of these devices with downstream management rather than overburden them with other stuff.

So in the end, this is just one piss poor managed division abusing another piss poor managed division. Who gets the heat? Probably the lowest level people.

Why "wipe" them? That seems unnecessarily punative.

You can see the "don't give a shit I work with a predatory organization" oozing from everywhere.

The security guy is trying to claim that they've sent out many many notices, but really this is just an excuse to abuse other people in a machiavellian abusive organization.

"Service Desk is now aware that everyone else except them was aware, and now IT is absolutely incandescent." Whoops, missed an email and a meeting in there bucko.

And it's the SECOND company where this was "implemented" or "specced"? This sounds like someone checked a box or compliance or ass-covering upper management slid this under the table, but all the people it ACTUALLY AFFECTS didn't get any input or opinion on the matter. And when push came to shove over funding it that person had probably moved on to bigger and better things.

So since you get to do it, you seem to be gleefully doing it. Great job.

Don't shoot the messenger.

If compliance and legal say to wipe the laptops, and everyone with a budget was aware of it for a year, it's not reasonable to put the disaster on whoever was in charge of implementing policy.

This is not a Petrov situation, you're not saving the world by going out of your way to be the person that will defy Compliance today, just because the policy is really dumb.

The people locked out would be shortsighted to blame the random security guy. They joined a big company with a very strict compliance machine, not a startup where you move fast and break things, then ask legal for forgiveness.

Big organizations are dysfunctional, news at 11. Don't blame a random IC for executing policy after considerable warnings. If communication is so thoroughly broken internally, and no one wants to take responsability for necessary spending, it's not the job of some random security guy to fix that internal dysfunction.

What exactly are you suggesting this person does? The policy to wipe clearly came from the company's compliance department. They warned them over and over what was about to happen, and went above and beyond doing it with multiple meetings and phone calls.

Exactly. In this situation all you must do is warn people of the risks and document, document, document. Which the article writer seems to have done.

> Why "wipe" them? That seems unnecessarily punative.

There was something in the thread about the devices coming out of support by manufacturer, which was already extended by a year.

> Why "wipe" them? That seems unnecessarily punative.

Potentially leaving company confidential material on non-compliant devices is not something Compliance department would want to allow

A gleeful feeling does come across, although the poster does claim it's not schadenfreude. They also mention they think plenty of notice was given out to various middle managers.

There are better ways to handle this, when sending the messages out. If the deadline for compliance was 31 Jan, then when sending comms out say the deadline is 31 Oct, and machines would be wiped after that. Then start wiping them, 10% of machines on 1st November, another 10% on 8th November, etc.

I think we can charitably call it watching a trainwreck unfold.

There is not necessarily any Schadenfreude in watching and reporting it. No one really needs to be taking pleasure, it's just hard to not pay attention to a train crash occuring in slow motion.

It's very natural to want to talk about something this stupid/bad. Rubber necking is extremely human.

I agree. Not a single concern for boots on the ground that are likely already squeezed, and now has the apparently abusive compliance and security departments fucking them over.

Now everyone in the affected chain gets a black mark on their "permanent records" and gets exposed at a time when likely layoffs are coming.

What I don't hear is "why can't they upgrade, and how can we help them upgrade", it's WE TOLD YOU, NOW YOU SUFFER.

Here's the kicker: it's 1600 devices. Ok, so they've been told for 13 months to do this. Well, let's do some math. That's 260 working days. Oh look, about 1600 working hours. So if you guys had simply upgraded a device an hour over the last year, this wouldn't have been the problem. Yes, that's not fair, but neither is what the person doing.

Security is the military arm of compliance. Finger pointing at compliance is a bit mendacious. Saying LOL it's not my fault, it was compliance. NOW WATCH ME DROP THE HAMMER BOOM.

I mean, I guess the guy is saying LOL I'm outsourced and not even in the company HAHAHA. Still, eff this guy for taking a bit of glee in this.

If I were uncharitable and cynical I would claim that it looks like somebody has a goal to implement central device procurement and management and have built a system to enable that to happen.

> Here's the kicker: it's 1600 devices. Ok, so they've been told for 13 months to do this

That is not really how I read it; the devices got an year extension because people had already failed to refresh them within the standard cycle. From the sounds of it these are typical workstations etc, their support cycles are very predictable and if you bought some crappy ones without predictable lifecycle that is on you too. That extension should have been wakeup call, the process had already failed then.

Not sure if the devices are laptops or phones, so assume $400/device and $50/hour time, that's about a $700,000 dollars.

"If you had simply spent nearly three quarters of a million dollars of your own money, done 40 weeks of volunteer overtime on top of your normal job, without any purchase approval, without the authority to do that, and no guarantee of seeing that money back, this wouldn't have been a problem, so fuck you"

is a terrible take all around.

> "What I don't hear is "why can't they upgrade, and how can we help them upgrade""

We know why they can't upgrade, because the departments responsible for purchasing the upgrades won't agree to spend the money. This isn't something which can be helped by more technical input.

> "Finger pointing at compliance is a bit mendacious"

"mendacious: not telling the truth; lying." - nope, wrong. Legal and Compliance say it must be done and you must do it, and have the authority to do that. Pointing fingers at them is honest and appropriate, that is where the instruction is coming from (legal) and the reason why the instruction exists (compliance with internal or external regulations).

Except the tale all falls apart when the service desk had no idea this was going to happen

Clearly the compliance team (or whoever is implementing it) has failed in its communication

I'm not saying the guy is the second coming of Hitler. I mean is it his job to care? Not really. Is the absurdity humorous? Maybe he communicated it wrong? It's twitter.

It's more that security teams tend to have uncooperative, aggressive, authoritatian, and punative dispositions. I think ye old security industry had its roots in three letter government agencies which are used to conformance, policy hammers, and enemies of the state.

But when you add that to an organization already rife with infighting, dissatisfaction, and frustration, it will just lead to more resentment and your employees become your enemies.

The biggest security threats these days aren't leet hackers exploiting 0days, or even the county password inspector conning his way in. It's overworked angry pissed off employees leaving the door open. It's like Princess Leia said: the tighter you squeeze, the more people you lose.

> Why "wipe" them? That seems unnecessarily punative.

You're proposing to remove the devices from the cloud management service, probably including admin lockouts and anti-malware software, but leaving all the data on them?

It seems to me that compliance was fully aware of what was going to happen and wanted to set an example. An expensive example, but apparently still spare change for the company, so it was well calibrated.

Don't fuck with compliance I guess?

Reply on news.ycombinator.com