Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I'm not burned out, I'm pissed off

myname.website

Post reply on HN
Print view View original

271–280 of 335 posts

Re: I'm not burned out, I'm pissed off

#271

Post by Thriptic »

dogman144 wrote: post #202

1) Increasingly, if you want to be in infosec, you have to learn how to code on the level of a SWE. This is how to not lose your mind when constantly addressing sec issues that others (devs) are entirely responsible for fixing. 2) Department of No doesn't have to be a thing, it just takes some emotional intelligence and pragmatism. 'Always saying no' is as much the fault of the sec eng as it is the system. If you hav…

I agree with everything you said. To expand on point 3, when you are pitching a security change, know your audience. Most people hear security change and they think another inconvenient pain in the ass that I'm going to have to deal with. That changes if you can show them benefits to people or to the business that are not security related. For example, traditional approach:

Boss: You are advocating spending a lot of money on a configuration management solution, why?

Sec: Well it can help prevent heterogeneity in our environment which can lead to different versions of software being run, some of which may be old and buggy and therefore exploitable.

Dev team: So now we need to do change management meetings and institute even more controls? No, this will slow us down!

Ops: Sigh, another fad system we will have to support, learn, and test.

Boss: This seems like a lot of money and inconvenience for a theoretical problem, no.

Better approach:

Boss: You are advocating spending a lot of money on a configuration management solution, why?

Sec: Because it's a win for the business. Our Dev teams can avoid dependency hell and be confident that code they develop on their machines is going to work in production because our production environment will mirror the development environment. This will let them ship faster and spend more time doing real work. Ops will be able to scale much faster and spend less time dealing with configuration issues. Imagine being able to develop a config and spin up 50 servers with it at the same time while you sit back and sip a soda! No more fixing damaged boxes, just replace them! No more fighting with the dev teams! Oh yeah, we also get a security benefit for free while making our lives easier as we won't have to deal with heterogeneous software running on our boxes which presents a security vuln. The ROI for the business will be large.

Everyone: wow sounds great, let's do it!

Re: I'm not burned out, I'm pissed off

#272

Post by tinus_hn »

pdpi wrote: post #165
tinus_hn wrote: post #154

Earlier quoted context omitted.

Also the defeatist ‘everything can be hacked if they try hard enough’ attitude, applied as a defense.

I genuinely believe that’s a better starting point though. It is absolutely true that everything can be hacked if they try hard enough, so the question is — how hard do they need to try, and what resources do they need? As you reach an answer to that question, you either consider that level of investment a credible threat you need to worry about (in which case you invest in tightening things up) or you don’t (beers a…

That is not the defense of ‘I don’t need to improve security because nothing is secure anyway’ though. Or ‘It’s acceptable to keep making the same dumb mistakes over and over because nothing can be secure anyway’.

Re: I'm not burned out, I'm pissed off

#273

Post by pdpi »

tinus_hn wrote: post #272
pdpi wrote: post #165

Earlier quoted context omitted.

I genuinely believe that’s a better starting point though. It is absolutely true that everything can be hacked if they try hard enough, so the question is — how hard do they need to try, and what resources do they need? As you reach an answer to that question, you either consider that level of investment a credible threat you need to worry about (in which case you invest in tightening things up) or you don’t (beers a…

That is not the defense of ‘I don’t need to improve security because nothing is secure anyway’ though. Or ‘It’s acceptable to keep making the same dumb mistakes over and over because nothing can be secure anyway’.

Yup, agreed. My point is that I find it easier to talk a defeatist into a somewhat proactive security practitioner (everything is hackable but the point is to deter, delay, and mitigate, not outright stop all attacks), but it's a lot harder to talk a security absolutist into backing down because their initiatives are a net negative.

Also, the nuanced posture can look like the defeatist attitude if you don't pay attention to the details —and, on the flip side, you need to pay attention to those same details to tell a proactive attitude from security theatre.

Re: I'm not burned out, I'm pissed off

#274

Post by parliament32 »

>I'm mad that I sat on a call representing my company's (not cloud native) cloud offering listening to Cisco tell us that the only way to get logs from god damned IRONPORT in the cloud was to use syslog! OVER THE INTERNET. FOR SECURITY LOGS.

Why is this an issue? This is how syslog works on literally every device ever, you set a destination and it streams it over UDP with optional authentication/encryption. If you want to do something hokey like consume logs over an api (what?) set up a syslog gateway and configure log retrieval how you like. You can't be mad at a vendor for not supporting your crazy log consumption scheme -- logs are push (generated), not a pull or sub or whatever you're trying to do.

A normal setup would be to have a logging cluster (elasticsearch or similar). Feed logs into it via syslog or logstash or beats or whatever other bajillion plugins there are, then get logs out via the ES api (or even better, do your analysis straight in ES).

The author just sounds mad he has to do actual work instead of attaching one product to another and collecting a paycheque for it.

Re: I'm not burned out, I'm pissed off

#275

Post by RugnirViking »

0xffff2 wrote: post #182
ilteris wrote: post #173

Earlier quoted context omitted.

This comment nails it. Is there anyway to fix this problem? Not the burnout as that's the symptom but the cause, bad structure.

I'm a software engineer in a research environment. GP sticks out to me because it's nearly the opposite of how it works for me. I as the architect/lead software engineer make basically all of the important decisions about the software. I have a project manager and about 6 researchers who are, theoretically, my customers, but they all know that they're not software engineers so they tell me what they need and defer al…

On your average project, how many people write code? I'm guessing less than 6. The op is talking about problems that generally start to manifest once the number of programmers are more than the amount of people that can reasonably crowd around the same computer/whiteboard discussing architecture at once

Re: I'm not burned out, I'm pissed off

#276

Post by parliament32 »

dogman144 wrote: post #202

1) Increasingly, if you want to be in infosec, you have to learn how to code on the level of a SWE. This is how to not lose your mind when constantly addressing sec issues that others (devs) are entirely responsible for fixing. 2) Department of No doesn't have to be a thing, it just takes some emotional intelligence and pragmatism. 'Always saying no' is as much the fault of the sec eng as it is the system. If you hav…

>Department of No doesn't have to be a thing

This is the key. Mastering "yes, but" will not only make people like you more, but will also change your personal outlook on situations and avoid burnout like the author. Even if you don't realize it, there's a very different emotional impact between "I had to say no to that proposal" vs "I presented the options for that proposal, and they decided to not go through with it". For lack of a better term, it's no longer "your fault".

From the article:

>No, we can't do that. No, it doesn't support that. No, the vendor doesn't allow for that. No, you don't have the right license. No, no, no. Isn't the point of technology to enable businesses? So why am I saying no so often?

Because you're shit at communicating. Yes, we can do that, but you'll need to (pay for X || do Y || get Z to do this other thing). Yes, but your current vendor doesn't support that, although vendor Q does. Yes, but your current license doesn't do that, you'll need this license instead.

The joke is once you present the "effort" required to do what they want to do, 80% of the time they'll give up on it anyways. It's the same end result. But you didn't have to say no!

Re: I'm not burned out, I'm pissed off

#277

Post by pastage »

CathedralBorrow wrote: post #84
varjag wrote: post #82

Earlier quoted context omitted.

Probably under stubbornness. Whatever good things Windows has going, it's not the UI.

I didn't say that. I disagreed with the statement of fact that Linux had passed Windows UX-wise in many ways around 2004. Also, I wouldn't conflate UI and UX.

So would a few areas be true for you? "many" has ben true for 25 years for me and 15 years for many end users I know. UX is very much an opinion.

Re: I'm not burned out, I'm pissed off

#278

Post by parliament32 »

alecco wrote: post #99

Ah, syslog. Around 18 years ago I was part of an group developing the next syslog protocol with security in mind. My company (one of the top infosec firms at the time) had a product doing this already. The standards group was a mess. Some other company without any credible security credentials was just forcing their bad implementation (TCP (!) and yet another protocol layer). They were backed by Microsoft and some ot…

Don't know about what group you're talking about but it ended up well: no need for a new protocol, just wrap in TLS with mutual cert authentication. TLS/TCP is fast enough nowadays that the overhead doesn't matter, and it saves you from having yet another standard.

Re: I'm not burned out, I'm pissed off

#279

Post by tanseydavid »

lidHanteyk wrote: post #237
finnthehuman wrote: post #185

I'm a recovering security guy. When I listen to security people rant, I can see their points and it's a bit of fun, I like a good rant. But I get the impression that they're continuously discovering new and exciting ways that individual facets of individual pieces of software (and the processes around them) suck. All without ever accepting that the entirety of the software ecosystem sucks (and that they're rarely mov…

There is a paper on "balls of mud" that I feel is essential reading for our discipline. http://www.laputan.org/mud/

Thank you for reminding of this paper.

It is fascinating to me that the content (written 20 years ago) reads like an up-to-the-minute description of the madness of IT today.

The continual repetition of anti-patterns is so widespread and commonplace that it is clear to me that expediency will almost always win-out against any engineering prudence.

Expediency gets assigned highest priority -- typically without any real reasoning. The negative effects accrue slowly but consistently -- and correcting for the shortcoming gets consistently more difficult.

The condition is then self-perpetuating.

Re: I'm not burned out, I'm pissed off

#280

Post by CathedralBorrow »

pastage wrote: post #277
CathedralBorrow wrote: post #84

Earlier quoted context omitted.

I didn't say that. I disagreed with the statement of fact that Linux had passed Windows UX-wise in many ways around 2004. Also, I wouldn't conflate UI and UX.

So would a few areas be true for you? "many" has ben true for 25 years for me and 15 years for many end users I know. UX is very much an opinion.

> UX is very much an opinion.

I'm certainly not going to object to you having that view, but if that's how you see it then it's not a very interesting discussion is it? Would be like discussing whether the Beatles were better than the Rolling Stones "in many ways".

For what it's worth, I believe you are very wrong. But I understand and kind of appreciate this view, largely because it keeps me employed.

Post reply on HN