Live data from Hacker News

Cleaning Up Dead Bodies in AWS IAM

noq.dev

51–60 of 69 posts

Re: Cleaning Up Dead Bodies in AWS IAM

#51
post #34

Earlier quoted context omitted.

[flagged]

[flagged]

Those are not the rules of your game.

If you thought logins didn't matter, you'd create one and stick with it. You're going to extra effort because you know they do.

And still, you dodge the question. You claim to be incisively dissecting other people's motivations via various negative assumptions and broad-stroke insults. But you can't even glance at your own motivations, even as you work to hide them under a series of new accounts. Which tells us a lot about your game.

Re: Cleaning Up Dead Bodies in AWS IAM

#53

Earlier quoted context omitted.

You guys have it so wrong. Their job is to get you to do things. With slide decks. Presentations. Speeches. Roadmaps. Stories. Visions. Carrots. That’s their job. As well as to aggregate the litany of statuses into an über status at the end of the week/month/quarter so that their higher ups see work being done. What they do is different from what you do so you only see them not doing what you’re doing, not what they…

In a working org you are right. In many orgs measurement of work takes precedence over actually achieving work.

[flagged]

Re: Cleaning Up Dead Bodies in AWS IAM

#54
post #16

Earlier quoted context omitted.

“Getting shit done” is 3D chess we play to convince ourselves there is a goal when it’s just more low effort toil.

Work is work they give me a paycheck to write code. Rather write some code than deal with a chickenshit leader who wants 100 iterations of project plans for work we will never do or generating reports that no one will ever read. Being paid to sit at a computer and not doing real work all day is more torturous than simply having actual tasks and work to do.

That's my view. Going to pointless Zoom meetings and updating associated spreadsheets is much worse than actually doing real work. Of course, much of the "real work" is also quite uninteresting, but that's life.

Re: Cleaning Up Dead Bodies in AWS IAM

#55
post #26

This website is marketing nonsense. I need to understand the technical underpinnings of it. Why does this help me?

If you don't see how it helps you, you probably don't need it. Either because it's not a problem you have or deal with, or because the site doesn't flag up anything with you.

While there's merit to that idea, we don't want to discourage people learning, do we?

Ideally we'd learn about other people's problems BEFORE they become our problems so we're prepared to deal with them. Or we can just want to expand our realm of knowledge.

Re: Cleaning Up Dead Bodies in AWS IAM

#57

Earlier quoted context omitted.

I find interesting the last example with find and ldap queries. I'm not too familiar with ldap, but i do use find frequently. Could you expand on the example and what happens and why it's bad?

Certainly! In this case, they were interested in files that were too permissive. I don't have a good example of the command, but it was basically looking for 'worldly' permissions that were too open. It's important to note the users/groups could be discarded/ignored. They were using 'find ... -exec ls -ld {} \;' , which does an LDAP lookup on each result to resolve UIDs and GIDs to names. They could have made the pro…

I think correctly configuring nscd should prevent this, ie it should cache some of these name lookups for a period of time. As long as it is properly setup for LDAP to hook into it.

https://linux.die.net/man/8/nscd

Re: Cleaning Up Dead Bodies in AWS IAM

#58

Earlier quoted context omitted.

Certainly! In this case, they were interested in files that were too permissive. I don't have a good example of the command, but it was basically looking for 'worldly' permissions that were too open. It's important to note the users/groups could be discarded/ignored. They were using 'find ... -exec ls -ld {} \;' , which does an LDAP lookup on each result to resolve UIDs and GIDs to names. They could have made the pro…

I think correctly configuring nscd should prevent this, ie it should cache some of these name lookups for a period of time. As long as it is properly setup for LDAP to hook into it. https://linux.die.net/man/8/nscd

I suspect you're right, I'm not as familiar with our configuration (or the service) as I'd like to be

The 'ls' output is honestly superfluous, though - 'find' will report the paths.

I won't even get into how these are batched/time limited. If not this, it'd be something else eventually

Re: Cleaning Up Dead Bodies in AWS IAM

#59
post #22
post #13

Earlier quoted context omitted.

This comment opened my eyes in a strange way to my boss (dir of infra). This is so on the nose for how he operates it was almost painful to read.

Most folks (certainly not all!) at the Director level and higher by definition spend their entire day talking about work other people are doing rather than doing it themselves. It's the nature of the beast, especially if you operate with a manager only having one or two small (3-6) person teams to manage. You can get a flatter org chart where managers have 15 or 20 direct reports, which makes it impossible for the ma…

Studying span of control, managerial time allocation, and corporate promotion criteria becomes more interesting the further I get into my career. They literally define (or change) companies.

Re: Cleaning Up Dead Bodies in AWS IAM

#60
post #31

Earlier quoted context omitted.

You guys have it so wrong. Their job is to get you to do things. With slide decks. Presentations. Speeches. Roadmaps. Stories. Visions. Carrots. That’s their job. As well as to aggregate the litany of statuses into an über status at the end of the week/month/quarter so that their higher ups see work being done. What they do is different from what you do so you only see them not doing what you’re doing, not what they…

You're describing the theory of managerialism. Or maybe it's better to call it the dogma. But it's definitely not always the reality. Large companies have huge inertia. And these days we also have low average CEO tenure and frequent executive position changes. The upshot being that what a given executive does can be almost entirely disconnected from productive improvement without notable short-term harm to the compan…

That’s why it’s a theory and not a law. You can attempt the same management game and get wildly different results depending on the team, the ask, the tenure, you, the company, you name it. Often what works one place, doesn’t work elsewhere. Not because they lack the understanding but because of Conway’s law.
Post reply on HN