abarringer

On the contrary given a sufficiently broad timeline the value of every company drops to 0.

I find that if you treat an employee like a race horse they won't turn out to be an old nag. Obviously there are outliers but generally there is a positive feedback loop.

Enforce the use of https://www.rescuetime.com/ may help.

We have a cluster of four nodes that were all setup and brought online within hours of each other. The entire cluster could blow up within a couple hours if not patched.

The patches are not available yet.

The 6.0 download hasn't been updated. It's still 6.0.6. https://www.forticlient.com/downloads

Since most drives are started and used concurrently this bug would blow any RAID set up. There's a dark day coming for some sysadmins.

I've often thought.. If you feel like everything is under control you clearly don't know what's going on. It seems the higher I go in a company the more this is true.

When I was a junior being handed design or detailed work specs it seemed like part of an over-arching grand plan. Now I realize.. we just hang on and try to stay alive; albeit with-in something resembling a meta-narrative.

We are crafting a new Server cluster and it looks like the Gen4 PCIe will give us a 40% performance boost for what is basically NVMe over Fabric using Mellanox 100Gb cards (Azure HCI aka S2D). Next year we will be building out another cluster and will hopefully use Mellanox 200Gb cards which is only possible due to Gen4.

Performance tests here https://www.servethehome.com/amd-epyc-7002-series-rome-deliv...

Whitelist outbound access from your network. It's not perfect and it can be painful to deploy, particularly gems, but it stops several categories of attacks.

I received a price quote on HPE ECC Server RAM this week from HPE that is $230 per 64GB stick. So make that $500 with shipping and tax for 128GB.

Both replies to me earlier comment mentioned vendor lock in. Is there any greater vendor lock-in then integrating AWS thousand and one services? Is it really riskier to trust MS to not kill a product then Google? Is the answer really to write everything yourself from the OS up?

I don't disagree that MS could do any of what you mentioned but I'm not sure AWS/GCP etc wouldn't be as likely to as well.

Just because you run windows doesn't mean you like it. SQL Server, vendor app requirements etc. A windowless world is about as likely as a paperless bathroom and for the same reasons.

Also, not sure what huge risk you are talking about here besides licensing pricing?

Two cars at $706 a month each.[0]

[0] https://www.nerdwallet.com/blog/loans/total-cost-owning-car/

At my recent overnight stay at a large hospital the Nursing staff were very aware of the necessity of good sleep. They worked hard and went out of their way to create an environment where I was interrupted as little as possible. Their first exit interview question was "How well did you sleep? And how can we improve that?"

Who's your favorite author on business/leadership?

I work in the Credit card industry. Account origination fraud using the real address is a thing. The bad guys hire mules to check mailboxes daily until the card arrives. This would greatly simplify that task.

I'd like to see an AI driven predictor of which Google service/api will not exist in five years so we can go ahead and not use it now.

This is why we did not consider GCP when we were looking at moving some of our services to the cloud. Never know when Google will discontinue or drastically change pricing on services.

When I left AVG Technologies (now owned by Avast) I figured they would try to screw me on this. I copied a line out of the employee handbook, that I had to sign a receipt for and acknowledge I had read, that said "All accrued unused vacation will be paid out in full on an employees termination" sent that line to HR and asked them if they would pay my vacation if I left. They replied, you work in FL which does not legally require us to pay it so no. Anyways, I showed my direct supervisor the email from HR, worked two weeks then took three weeks off. When "I got back from vacation" I turned in my notice and walked out even though the handbook said a two week notice was required... because FL is a right to work state and you do not legally have to turn in a two week notice. We each enjoyed our own groups at AVG but "Corporate" was just evil.

We just got blindsided with a $16,500 charge from Experian for a security audit. Previously they accepted out PCI letter now they insist on selecting an auditor and sending them onsite for us to continue using their API. Maybe this will become the norm gong forward? Any vendor you get PII from will insist on you paying for an audit of their choice?

Looks good, but I expected uBlock to be on the list?

Troy and Krebs should team up to create a security hall of shame and only remove companies when issues are fixed.

We have security vendors who have sslv2 enabled and they can't understand why that's an issue.

We have huge fortune 250 companies that we exchange full credit card data with that have TLS 1.0 enabled with Symantec certs and only two weak ciphers. I sent them an ssl labs report and they accused me of breach of contract for hacking the site.

This list of security and finance related vendors that are double facepalm worthy is just astonishing.

Assigning a 1.1.1.1 to a local modem interface? Cox: that ain't noth'n here hold my beer" and watch a 10.x traceroute go seven hops out the door and resolve somewhere on their network.

I've been in and out of the hospital a bit lately (broken back). That seems downright cheap. I average about $4,000 an hour when I'm in. The most recent "study" took an hour with one low paid tech using one ultrasound machine and it cost over $2,000. CT Scan? 15 minutes $7K. Heck, they charged nearly $800 to "start an IV" when they didn't even start it, it was the ambulance EMT that put it in (billed separately) they just injected morphine into it. If you don't have good insurance you are one small slip away from bankruptcy.

heh yea, but no. All our clients are banks. I spent a good part of the day working on a project to convince them to upgrade their browsers to something that supports TLS1.2.

It depends on your vertical. It can take years to get the first deal in the "Enterprise" space even with very strong industry connections. It took us a few years to ink the first deal and many enterprise deals we work on are multi-year courtship dances. Hopefully you have a very long runway for takeoff.

We had a generator that ran a two hour test every Thursday. It ran fine one Thursday, the next day we had a power outage and it failed to start because a capacitor went bad.

yes, lots of sites offline for me. I'm in Atlanta GA.

Are you using Qualys? It seems they are having major issues with header checks starting around Oct 1st. Tenable however still passes sites without HPKP. Getting our vendors, like fortinet, to implement all the security headers Qualys now demands will be impossible so we are checking other ASV's to see how they respond to our sites. Just for jollies you should go check pci.qualys.com's security headers.

Clearly you don't have diabetes.

Everyone responds differently to the same inputs. My BG spikes hundreds of points if I eat a banana. It drops 50pts an hour when sitting in intense sun. Make sense? No.. is it repeatable, for me, yes.

Would ubiquitous sensors help me identify more of these patterns? Absolutely.