sylver_dragon

It’s a matter of circumstance. Authoritarianism is only useful in situations where time pressures make the slow, deliberate decisions of democracy unworkable. Combat is a good example of this. When the shells are raining down around you, there isn’t really time to hold a vote on how to proceed. So, in such situations there is usually a chain of command which is given authoritarian control. Other emergent situations will also often require similar levels of top-down control. The person in charge may not make the best or fairest decisions in the heat of the moment. But, inaction will almost certainly be a worse choice.

The other side of this is, when the situation isn’t emergent, a democratic (well, really semi-democratic, but I’m going to use “democratic”) system is likely the best choice. And those democratic systems would be wise to prepare for the emergent situations by identifying and designating the people who will be handed dictatorial control when the fecal matter hits the air circulator. And the system for identifying when the emergency has ended, how dictatorial power is unwound and how the performance of the person handed that power is to be judged.

The reason I hedged with “semi-democratic” is that a truly democratic system can have issues too. The classic “tyranny of the majority” problem. As any majority could override the rights of a minority in a truly horrible fashion. The solution being things like constitutional democracies, where the power of the majority is limited in specific ways (e.g. unrevokable rights).

No, but the country has problems. It’s always had problems. Even with all of the economic hardship and political strife we have today, most people are safer, healthier and have better prospects today than they have had in most of US history. It’s by no means perfect and we have a lot of work to do. But, giving up and checking out has never improved anything. It also doesn’t help that we have a steady drip-drip-drip of negative information fed to us by our phones and algorithms. We are also facing one of the largest Constitutional Crises in US History, with the President pushing the boundaries of his Constitutional powers. Even if nothing breaks, we are likely to see many changes from all this. Hopefully, those changes result in better guardrails on the Presidency. And maybe even a repudiation of the Roberts Supreme Court. But, such a future is hard to see when we are in the middle of the storm.

I even have hope for the slight voting majority which put Trump back in power. It’s easy to dismiss those folks as a bunch of <insert invective terms here>. And some of them almost certainly fit those descriptions. However, there are a lot of them which are just scared and confused by the FUD sandwich being fed to them by the 24-hour news cycle, social media algorithms and politicians looking for easy votes. It’s going to be hard work to pull them back off the brink. And if you’re not up to that work, I understand. It’s hard to want to put in the effort for folks who seem so far gone. I’ve spent a lot of hours arguing with folks with whom I disagree wholeheartedly. It’s tiring and I can only take so much before I decide it’s time to move on for a while. But, I would rather keep up the argument than let the country slide into full blown autocracy.

So ya, I have hope. It’s a grim hope and one which recognizes that we could lose. But, giving up now feels premature.

When people stop believing that justice is possible via the government system, they will seek it through other means. It doesn’t make it right, but it does provide a warning that the system is failing.

ServiceNow is very much aimed at the managers. It’s good at reporting metrics like SLAs, ticket counts and anything else management dreams up to track metrics on. The interface for analysts putting data into it is slimy shit on toast. I swear, one of the questions I plan to ask, the next time I’m interviewing for a job is, “what do you use for security case management”. If the answer is “ServiceNow” or “ServiceNow Security Incident Response (SIR)”, that’s going to be a mark against that company. The only thing worse than ServiceNow ITSM is ServiceNow SIR. It’s all the terrible design of ITSM, but with basic security case management features implemented by clueless idiots.

That depends on the use case. For drive encryption, a centrally assigned and managed password is fine. It provides for protection of data at rest while also ensuring that a single point of failure (the user) won’t remove access to the data contained on the encrypted volume. Since it’s not intended to prove identity, that risk needs to be mitigated by a different control.

At most organizations I have worked at (both IT and cybersecurity), decryption keys will be centrally managed. With some technologies (e.g. Bitlocker), it’s possible to have multiple passwords which can be used to decrypt the drive, and it could be possible for the user to have one only they know. However, there isn’t a logging mechanism to verify which password was used to unlock the drive, leaving the issue of non-repudiation. This could probably be fixed by having some sort of system which logs which user unlocked the drive, but that would be a very hard thing to do securely. Any such log would need to be in a space the bootloader can reach and write to, and now that location needs to be secured in a way which prevents a malicious actor from modifying the log. At that point, we’re quickly arriving at having TPM and we might as well go whole hog and just do TPM and secure boot. Which is a great bit of technology; but, now only proves that the system hasn’t been tampered with.

As a tangent, the reason most organizations centrally manage drive encryption keys is the need to unlock the drive, in the event the user is no longer able to. If you win the lottery, turn your laptop in and run off to parts unknown, the organization may want to unlock the laptop to recover anything you were working on. So, they need access to the decryption key.

Ultimately the problem is that the encryption password and your user account password are solving different security problems and there isn’t a lot of good overlap between the two.

I have a 6 year old phone which gets charged overnight as I sleep. It still makes it though the day. What the heck are you running which is chewing up your battery so badly?

If the device is encrypted and single-user there is no good reason to require further login after the first.

The reason is non-repudation. Ignoring the fact that the drive’s encryption should have been handled by TPM and not be bothering the user, the drive encryption password does not establish who is using the laptop, only that they know the unlock password. Unfortunately, those unlock password are usually centrally assigned and managed, which means that they are not something that only the user knows. Also, it doesn’t have a good second factor. If the laptop is stolen, there is nothing keeping an attacker out, if they know the password. Their account, on the other hand, should have a password only the user knows. Yes, central IT can reset the password, but this creates logs which show the reset and can be used to prove that the password was reset, and who reset it. And the user’s password can be backed up with a second factor. So, a stolen laptop isn’t an easy on-ramp to the organization’s network.

As for logins after that, it gets harder to justify. OS, email and most web portal logins should be handled via SSO. For most users, this should mean that their drive gets decrypted via TPM, they type their password into the OS login prompt, deal with 2FA and that’s it. For users with admin access to stuff, there will be a separate login step when they need to elevate permissions, but that should largely be limited to IT staff and developers. For the original poster, it sounds like their organization’s IT is being run on a shoestring by someone who either doesn’t know or isn’t allowed to do it well.

I’ve not returned an item over it, but I’ve often wondered if there was a market for a company which de-LEDs items.

As in most social media apps, downvote and move on. Personally, I have a list of channels I subscribe to and mostly just stick to watching the content they produce. None of that is reaction videos, which I agree are lazy and stupid, but I guess some people like them or they wouldn’t keep making the rounds.

I just want to stop feeling imposter syndrome. I’m nearing 50, at work everyone seems to think I am one of the most competent people they have met in my field. I get the hard problems, get dragged into lots of projects as a technical consultant. And yet internally, I forever feel like I’m “faking it until I make it”. Like I’m one question away from being unmasked as a kid playing at knowing what I am doing. Consciously, I know I am not and that I’m actually pretty good at this. But, every time I get a meeting request from my boss, I still get a moment of panic thinking, “this is it, I’m about to be fired”. That’s what I want from “growing up”, to just not feel that feeling constantly.

Also, I want to be independently wealthy when I grow up. Fuck this whole work thing.

The cost to have them is basically zero. The benefit that they can provide for visibility and clicks is non-zero. So, with a positive ROI, why not have them?

So much this. I was having a discussion with one religious zealot and he kept insisting, “he’s your god too” when I referred to yahweh as “his god”. No asshole, I don’t subscribe to your fairy tales. Though, in a nod to keeping the discussion civil, I limited my responses, to “no, I don’t subscribe to your beliefs.” Getting upset, yelling or insulting only plays to their ability to project victim-hood. So, it’s important to stay calm and keep the conversation rational and focused on the failures of their explanations. You will never convince the delusional to give up their delusions, but you can convince the other people around, who aren’t fully delusional, to question the delusions.

It was the auto-hiding replacement for the task bar. You opened it by moving the mouse pointer to the upper right or lower right corner. But unless you remembered where it was at, you’d get stuck asking, “where the fuck is the start menu”. It especially sucked when you were a normal version of windows and RDP’d into a Sever 2008 box and couldn’t use the Win key.

Then no one would have noticed and sysadmins everywhere wouldn’t have their PTSD triggered by the words “charm bar”.
Shit, now I need whiskey.

You missed
winMe: you can’t change the thing because the OS already crashed.

You can delete them?

And people wonder why CCTV footage is always low res and grainy. I worked at a site with something north of 100 cameras and a requirement for 30 days storage. Their server room was mostly just racks and racks of hard drive chassis all wired up to the DVR system.

Step one: Document, Document, Document.
Step Two: Did we cover documentation yet?
Step Three: Complain, with documentation, to the apartment management.
Step Four: Document.

Recordings such as video and audio are useful. Just keeping a log of all such interactions can help as well. But, you want to have the documentation to prove your side of things. If things go really sideways and you end up in court, the judge won’t give a fuck about what you say, only what you can prove. Be ready to prove your claims. As we say in the DFIR world, “logs or it didn’t happen”. Then, start complaining to management. And document (keep a written log, you probably won’t be able to record) your interactions with management. All logs should include date, time, who you spoke with, what you spoke about and any actions which management said they would take or actions you said you would take. If it’s an option, keep your communications with management in email. Both the sending and received emails will be timestamped and the headers will provide a reasonable record showing that the emails were to or from management controlled email servers and addresses. And they log what was talked about quite nicely.

Ultimately, the goal is to move this from being your problem to management’s problem. And it’s possible that your problem neighbor is also someone else’s problem. If management has three tenants all complaining about the same neighbor, they have more impetus to take action against the problem. Of course, this assumes a neutral management, which can be an open question. But, this is likely the least costly way to resolve the issue.

Not humming, but I do make noise intentionally. I’m a big guy and understand that I could be threatening to women in the wrong circumstance. I also walk fairly quietly just as a matter of the way I walk; so, I’ve scared folks on more than one occasion by “sneaking” up on them unintentionally. So, if I think I am doing that, I’ll land a few footfalls hard and flat to make my foot slap the ground and alert the person of my presence before I get too close. I also try to give space to strangers while walking. Things like moving to the other side of the sidewalk/street, slowing down or speeding up to pass. Basically, trying to not look like I’m stalking them.