Hacker Newsnew | past | comments | ask | show | jobs | submit | ws66's commentslogin

The Pattern Jugglers are real!!!


Shared passwords should always be an exception. Prefer SSO. However the exception will always exist, in which case:

Some suggest using KeePass or equivalent, but I advise against it - too easy to copy and leave with the vault and very difficult to audit.

Find a solution that audits who had access to such password. And do your audits!

Consider rotating your shared passwords frequently, especially any high privileged ones.

If your risks warrant it, check for a PAM (privileged access manager) that acts as a middlemen and fully hides the password.

I realize I am not really answering your questions, so I'll stop here. But... SSO and proper directory management!


My POV - no, and I would not recommend trying this. Some questions to consider: Your security: How would you ensure your (and your family's) security if you are really, really, on a allotment of land, let's say free from any form of government (no taxes)? You would take care of your own security with your own guns and such? Well, now you have to spend money to buy those - where do you get it? And maybe you are able to protect yourself from some individuals, but what of organized gangs - if your land is not governed, then there are no law - good luck!

Your security again, but this time from the point of view of insurance? Your home is on fire, how do you deal with this? Are there any firefighters available? How do you pay for this service? Your house is completely burnt, were you insured?

In the end maybe it can work if you plan on living in a cave with almost nothing (nothing to lose!) - but watch out for other people that may be interested by in having your cave! Strongest person (or organized group) wins...


…and now it’s all serious business… I am referring to criminal gangs and ransomware.


It may be counter intuitive, but from my point of view, when you start managing individual contributors, YOU start working for them. Even though you are able to delegate work, a good part of your job is to clarify what needs to be done, how, etc... Especially that you are moving from solo to team based, you are also managing and clarifying requirements (stories or whatever) for your team. It's something you were possibly doing in your head previously, now you need to formalize it, because... communications! You help them do what they are good at, remove roadblocks, organize work between team members, plan work ahead of time, etc...


> It may be counter intuitive, but from my point of view, when you start managing individual contributors, YOU start working for them.

A surprisingly large number of managers think that ICs work for them. This is the single biggest reason why managers are hated so much.


It goes the other way too, plenty of ICs think they work for their manager. How do you convince them otherwise?


I’m a really big fan of giving ICs a goal and letting them plan and execute how they’ll get there on their own. If they have questions I’m there and if they’re going down a dark hole, I pull them out of it. But otherwise, I just get out of their way.

It’s kind of sad because you can tell pretty quickly who has always been told what to do. In the beginning they’ll struggle so you can’t just leave them to drown. When they get over that, they need almost constant affirmation. It can take years which is fine. But it often operationalizes itself as really talented people who get stuck as intermediate developers.

So it turns into two competing management problems. How do you convince them that management works for them? And how do you groom them into leadership positions? The first is the easier of the two.


> So it turns into two competing management problems. How do you convince them that management works for them? And how do you groom them into leadership positions? The first is the easier of the two.

1. How to convince someone that management works for them?

By constantly affirming in team meetings publicly, that I - the manager - am here for you, to help you. Then, you build trust by demonstrating your support every week.

2. Grooming into leadership positions?

You only groom people who want to be there. Not everyone wants leadership positions. People who want it will seek it. Often these people are ladder climbers that you will need to filter through.


A variation of "what are you going to do?" or "how would you solve X?" helps the IC to come up with a plan of how to address the feature/issue/whatnot. This creates space for them to take the initiative and after a while they grow and get used to do it, but it can take 1-2 years.

For some people who've been told what to do for most of their careers it's important to not leave them in the deep end on their own. It takes a mix of coaching and guiding them. The aim is that at each step they are faced with something that is both challenging and achievable.


I think that there are people who are capable of working mostly independently when simply given goals and people who are not (yet?) and should be given clear instructions on what to do and how to do it - and IMHO the key part is to accept that both are okay, especially in different roles, and you "just" have to understand which is which and appropriately match the roles, levels and management style to these people.


Well thats what ics and workers generally speaking are told - that they work for managers. A rather uniquely flawed concept.


Send them to graduate school.


Are you professing that we should pass on everone that doesn't have a perfect record?

I mean, is there someone with a perfect record?

I think you learn and grow to be good, to take care of others, and this process goes with mistakes that impact yourself and others... You cannot expect someone to be always 100% perfect all the time.

As for myself, I did tons of shit that I am not proud of, so you should pass on this comment as well...


>Are you professing that we should pass on everyone that doesn't have a perfect record?

This is the entire focus of western American Christianity. The pervasiveness of this is built into our culture, and as a result the world culture (because we exported this insanity)

So what you get is a worldwide society of people who will use any human failing of a leader as proof of why all of what they did is wrong.

Pillaging Christians starting with the Inquisition created a perfect reference person for which everyone should be compared to which makes everyone not good enough ever. Only through the weekly blessing that you have to attend and confess to can you be temporarily saved from certain forever death

It's just so embedded into western culture that the source is not even recognized as the source.


> Pillaging Christians starting with the Inquisition

Not sure what that's supposed to mean. Strange spell-check error?

I'm not a Christian, but I think that Protestant purity culture is a likelier culprit than Catholicism. Claims of moral pollution and calls for banning don't come from the pulpit, but from an "enlightened" public that can "think for itself."


Your comment is excusing groping people as not being "perfect"? Please explain.

If you've done tons of shit that you're not proud of, I'll probably pass on your book too.


I am not excusing him groping people. But I see someone coming to terms and acknowledging the mistakes and harm he did.

Sharing his experience and talking about the mistakes he made and how bad it was is just a net positive for all - I mean he is still a role model and can influence young people - so I see no value in cancelling him. I would agree with you if he was still groping or promoting such behaviour, which doesn't seem to be the case.

I know all this doesn’t fix anything for the victims, and it is terrible for them.


From someone smarter than me: people think they need backups while in fact they need restores…


That’s one of my preso jokes. “Backups are a worthless waste of time! Restores, on the other hand…”



In the late 1990s, W. Curtis Preston wrote a book called “Unix Backup and Recovery”. A later version was just named “Backup and Recovery”. Both were published by O’Reilly.

He was saying similar things at that time (e.g., “Backups are worthless, Restores are priceless”), and I’m certain he wasn’t the first.

But you’d have to ask him who was saying things like that before he did.

Disclaimer: Curtis was a co-worker of mine at the time, and I was a technical reviewer of the book in question.


Beautifully succinct.


The article slightly annoyed me by saying, “Why one does backups? To have a copy of data at hand if something goes wrong.” Not, I think, the best way to put it, per your comment.


Openssh also supports OCSP, which can be used to more efficiently manage revoked certificates.


This completely ignores the defence in depth principle. Yes it is good that users use strong, unique passwords, but we know the password store can get compromised. A second factor provides additional protection, but it is not foolproof. The network analogy of this post: why use a network firewall, we just need to keep our devices patched and up to date!!


>Yes it is good that users use strong, unique passwords, but we know the password store can get compromised.

The point of the article was that there is no downside if your password is unique. They will have your data on that particular site. The rest of the sites are just as secure as they were.

There is no depth here...


This to me looks like another form of privatizing profits, and socializing losses [1].

[1] https://www.investopedia.com/terms/p/privatizing-profits-and...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: