Live data from Hacker News

ServiceNow Insecure Access Control to Full Admin Takeover

x64.sh

31–40 of 81 posts

Re: ServiceNow Insecure Access Control to Full Admin Takeover

#31
post #4

Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…

Replace ServiceNow with Adobe and you've got a real villain.

There are far worse products in the same space than ServiceNow.

Edit: glad to see someone else already mentioned SAP.

Re: ServiceNow Insecure Access Control to Full Admin Takeover

#33
post #14

Earlier quoted context omitted.

You could be wrong... I worked at a place where we had like 20-30 different ERPs and they got SAP as a way to centralize the entire thing on one platform. However, during the migration they managed to recreate interfaces that resembled the old workflows people were used to, effectively having 20-30 customized SAP UIs with a common backend. It became such a clusterfuck the vendor (SAP) who we paid MASSIVE amounts of m…

Thanks, appreciate the perspective. But I've been implementing peoplesoft for, dear god, quarter of a century now, so I'm familiar with that unfortunate pattern. I guess I'm more wondering is service now inherently so bad it's unsalvageable, or is it a matter of good vs bad implementation, and resulting business transformation (or lack thereof :).

It’s like, navigating through servicenow immediately tells you that the people that build it were used to doing RPC, and didn’t quite understand how HTTP or HTML worked. It goes downhill from there.

I think at some point they decided to hire a few frontend engineers to do some form of SPA, but now it’s so badly integrated that…

Jank! Jank everywhere!

Re: ServiceNow Insecure Access Control to Full Admin Takeover

#35
post #4

Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…

You should have seen the platform it replaced. ServiceNow was essentially "let's rewrite HP Service Manager from scratch to remove the legacy debt." Service Manager was what you get when you develop a mainframe green screen application using a low-code RAD system and then try to maintain it for 20 years. Amusingly, I'm consulting with a company now whose business model and product strategy is "a rewrite of Service Ma…

I recall that once upon a time, Service Manager was a client side app using the same GUI framework as Eclipse. Which made it very heavy, using tons of memory for an app that you only used now and then. I am not completely sure it was Service Manager, but quite sure. Then it was made a web app, 15+ years or so ago. Compared to that, ServiceNow is a dream to use.

Re: ServiceNow Insecure Access Control to Full Admin Takeover

#36
post #4

Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…

I think you have a skewed perception of value add. ServiceNow conquered the software as a service industry like no other and will be around for decades to come. Developers and Admins may not like it because its development with bumpers for kids. End users dislike it because of the developers and admins. There may be some worth looking in the mirror to be had before you point the finger at a software platform for shor…

> Developers and Admins may not like it because its development with bumpers for kids. End users dislike it because of the developers and admins.

What about not liking it because they have a bad data model with insufficient validation leading to silent data loss and various cases where you can create a record you don’t have permission to use? Or not having decent full-text search in 2023? Or needing ~10-15MB of JavaScript to simply load?

I agree that enterprise IT departments make it worse but it wasn’t like it was starting from a position of good unless you recently emerged from cryosleep and haven’t updated your views on software engineering since 1993.

Re: ServiceNow Insecure Access Control to Full Admin Takeover

#37
post #4

Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…

Have you ever heard of Cherwell?

shivers

Re: ServiceNow Insecure Access Control to Full Admin Takeover

#38

Almost exactly a year from report to disclosure. I'm sure it varies a lot, but is that a normal timeline for something this severe?

My experience with this sort of enterprise software is that if you are a user, there is usually someone higher up the org chart than you that is worried such a disclosure will damage his relationship with his mate. My point being, much like Oracle, the usual timeline is that you never go public.

Yes - I worked at a place which had that experience with them. Massive outage: down for weeks, data lost, etc. We paid millions for “support” and had very little to show for it. Things escalated, and their regional VP took our senior VP out to the corporate box to discuss it over football. Monday morning, word came out to stop talking about the problem where possible. A bunch of people worked nights & weekends to get it patched up but didn’t even get thanked by anyone above their immediate supervisor.

Re: ServiceNow Insecure Access Control to Full Admin Takeover

#39
post #4

Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…

I worked there for exactly two months. After 15 days, I could not receive another offer and put in my notice fast enough. Ended up giving them four days. And I'm usually very careful about not burning bridges.

I feel like if you’ve worked at a place for less than. 2 months, there really shouldn’t be any obligation to give two weeks notice. Unless it’s a tiny company and you were hired as like their staff engineer or something. The chance you’re actually on something that matters instead of ramping up is very low.

Re: ServiceNow Insecure Access Control to Full Admin Takeover

#40
post #4

Of all the shitty enterprise software vendors, there is no platform I hate more than ServiceNow. What an abomination of something seemingly so simple made into something so horrendously complex and bloated. I was trying to explain to some new ServiceNow AE why we wouldn't be buying more product from them. Literally everyone who uses the product hates it - developers, admins, end users. It behaves like it is constantl…

I think all that generally applies to enterprise software like that, no? SAP is absolute garbage but it ticks various C-level agenda items (mainly the act itself of investing in ERP modernization) and so it sells regardless. Servicenow I belive makes it harder for employees to get help and thus saves labor. Enterprise software isn't for you or me, that's why we hate it.

Definitely feels like SAP is in the "nobody gets fired for buying it" category too, at least in my little slice of industry.
Post reply on HN