Anon witnesses excellent security
-
This post did not contain any content.wrote last edited by [email protected]
Honestly, a policy of "no free-of-charge software installed on workstations except FOSS" might improve security a bit and probably without doing all that much damage to the day-to-day workings of the company.
For that matter, if my employer instituted a policy of "no software except FOSS", my own particular job probably would be a surprisingly small adjustment. As long as they were willing to do the work to set up infrastructure and/or let us switch to FOSS alternatives that require third-party server providers as necessary. About all I can think of that's installed on my work machine that's proprietary is:
- Zoom
- A paid corporate VPN client
- A random program that I use to authenticate to Kubernetes clusters in use where I work (so I can use Kubectl)
- Chrome
- The Client Management software my company uses (the software they use to remotely administrate the company-provided machines -- force install shit without telling you, spy on you, nag people who have computers that aren't actually used to return them, wipe your computer if you report it stolen, etc)
- And, of course, bios, proprietary firmware blobs, etc
Beyond that, I honestly can't think specifically of anything else proprietary installed on my work machine. My personal computers have far less proprietary software installed than the above list.
-
Not just pick up the phone and harass someone but to also have someone to press a lawsuit against if things go really wrong. With free software the liability typically ends at the user which means all they can do is fire the employee and eat the loss. Suppose now corporate paid for it, well now there is a contract and a party that can be sued.
I hear that a lot but would that actually work? Sure, you will get a redhat level 1 support employee within the hour for a severity 1 ticket. But does the actual contract (which I don't have access to) make any legally binding guarantees regarding the time-to-resolution? I seriously doubt it. Which is to say -- your legal team will be SOL.
They also won't take responsibility for any fuckup on your part if you install a bad driver or deviate from the admin guides in anyway (which is why Legal says for a minor issue you can't apply a patch from StackExchange, you must raise a ticket and wait 3 business days for RedHat to tell you to apply the patch from StackExchange).
Getting phished definitely falls in this category BTW. Vendors may or may not help you but they certainly won't accept any liability.It's still a good enough safety net to have for corporations with no trustworthy in-house expertise as vendors do have an incentive to keep their customers happy and most will help to the best of their abilities (which often isn't as much as one might think...), but it's hardly a legal panacea. If you need guarantees against catastrophic financial losses, that is what insurance is for.
-
Honestly, a policy of "no free-of-charge software installed on workstations except FOSS" might improve security a bit and probably without doing all that much damage to the day-to-day workings of the company.
For that matter, if my employer instituted a policy of "no software except FOSS", my own particular job probably would be a surprisingly small adjustment. As long as they were willing to do the work to set up infrastructure and/or let us switch to FOSS alternatives that require third-party server providers as necessary. About all I can think of that's installed on my work machine that's proprietary is:
- Zoom
- A paid corporate VPN client
- A random program that I use to authenticate to Kubernetes clusters in use where I work (so I can use Kubectl)
- Chrome
- The Client Management software my company uses (the software they use to remotely administrate the company-provided machines -- force install shit without telling you, spy on you, nag people who have computers that aren't actually used to return them, wipe your computer if you report it stolen, etc)
- And, of course, bios, proprietary firmware blobs, etc
Beyond that, I honestly can't think specifically of anything else proprietary installed on my work machine. My personal computers have far less proprietary software installed than the above list.
Not related, but did you ever use k9s? Quite nifty CLI tool to control Kube, albeit not on a very advanced level, it helped me a lot to not get drowned in Kube commands.
-
This post did not contain any content.
My org told me “you can’t install open source software”
Everyone uses Firefox
I just want OpenShell
-
I majored in Anthropology in college. I should have done Misanthropology.
You did; just need to apply it.
-
You did; just need to apply it.
I'll try that. Fuck you.
-
I'll try that. Fuck you.
They grow up so fast sheds tear
-
Bought some of the higher end negate routers for work. 1u rack mount. Five locations all linked with fail over tunnels. I run our filter and monitoring on them as well . Pfblockng works great for general purpose filtering. When you filter porn you really need a lot of ram. The intel boards they have are a little finicky on the type of SFP you can install but other than that they work great.
Running a 1U work gave me! Haven't messed with it much, just works.
-
So they essentially hired you for no reason and then had to come up with something for you to do?
Yeah, I really don't understand why they hired me. It was a contract role and they ended it early once they ran out of things for me to do. Last day I drove home laughing the way home I was so fucking happy to leave that place.
They really sucked afterwards though since they wouldn't even say if I worked there or not while I was job hunting, so I spent the next few months unemployeed.
-
Javascript is a part of Java, duh!
I literally had the "Java is to javascript as car is to carpet" conversation with my dickhead boss. He didn't get it and I had to explain to him that you don't drive a carpet to work.
-
Every day I wake up I thank God I'm not an MBA
Sometimes I wish I was a piece of shit so I didn't need to worry about money.
-
It's not more secure, it's so they can offload blame and have people to sue if/when something ugly happens. Liability control, essentially.
We had to pay for fucking Docker container licenses at my last job because we needed an escalation to the vendor in case our SMEs couldnt handle things (they could), and so we had a vendor to blame if something out of our control happened. And that happened: we sued Mirantis when shit broke.
Hey PS: search engines do return a result for a suit against that company so potential self-doxxing territory (but maybe you’re open in your comment history IDK)
(Don’t have a PACER login so couldn’t tell what was up with the suit that came back when I checked this morn, also could’ve been an unrelated suit)
-
Won't stop some people.
There is famously little money in open source those projects can spend on legal battles
-
This post did not contain any content.
This has nothing to do with security, and everything to do with liability.
You can't really sue an open source project using a proper license, they disclaim any liability or warranty, meaning the buck stops with you.
If you hire a software development firm and pay for them to build software for you, you will have a different license, the software company can just repackage open source software into their own UI and branding, take the money and declare bankruptcy if their customers try to sue them.
The customers are mostly happy, they get to tick the box that they have a support contract for the software and a company is liable if shit hits the fan. The software development company is happy, they get money for doing very little actual work.
The open source project probably doesn't know about the abuse of the license and thus mostly doesn't care.
-
I literally had the "Java is to javascript as car is to carpet" conversation with my dickhead boss. He didn't get it and I had to explain to him that you don't drive a carpet to work.
Maybe your boss was from the middle east and didn't understand your point...
-
Donate cost back to vim
wrote last edited by [email protected]That sounds like a vim-vim situation for everybody, to me
-
This post did not contain any content.
Had that discussion before. Was attacked because I use a f&os lib from GitHub instead of a paid and licensed one, the latter somehow meaning it's error free. Spoiler alert: it wasn't. Or at least their usage wasn't.
-
Don't forget your new 32 character/symbol/number/nordic rune passwords that will need to be changed every 17 days.
Oh you gonna love those new directives for SSL certificates we got cooking!
-
Whenever I hear about shit like this I wonder if I should just start a company and package free software lol. Could like donate a bunch of the profit to the actual projects.
The issue here is you'd be selling it to morons who, when shit inevitably happens, would sue your pants off. So that means having lawyers that can protect you, probably on staff. Not sure it's worth it. You'd need to do the maths I guess
-
This has nothing to do with security, and everything to do with liability.
You can't really sue an open source project using a proper license, they disclaim any liability or warranty, meaning the buck stops with you.
If you hire a software development firm and pay for them to build software for you, you will have a different license, the software company can just repackage open source software into their own UI and branding, take the money and declare bankruptcy if their customers try to sue them.
The customers are mostly happy, they get to tick the box that they have a support contract for the software and a company is liable if shit hits the fan. The software development company is happy, they get money for doing very little actual work.
The open source project probably doesn't know about the abuse of the license and thus mostly doesn't care.
I've been in these meetings and you're on the money. Insurance (the concept, not necessarily the product) is almost always the reason any time you see some stupid policy.
When I was young and naive I thought the technologically correct way to do things was the best. In the business world that's seldom the case, though.
