Recently in opinion Category

Smartphone ecosystems have definitely reached the level of complexity where we have to worry about hostile apps. And they're following the pattern shown by the Internet over the years in that there are classes of hostile actions:

  • Known/Allowed, also known as ad/revenue streams. App owners have to pay the bills somehow, and purchase fees only go so far.
  • Known/Disallowed, also known as malware following known exploits. For this we have scanners.
  • Unknown, apps doing things they shouldn't, by ways that aren't in the scanners yet. Evil, evil little beasties.

If there is one lesson about information security that has been true since the beginning, is that it's the victim's fault for getting owned. Really, look at the press following hacks: hacks are entirely the fault of the defending entity for not being good enough. If you just followed accepted security standards, this would never happen. Never mind that transitive trust models in very complex IT infrastructures are nearly impossible to fully secure, especially ones that involve humans, it's still the victim's fault.

Those 'accepted security standards' are somehow lacking in the app-stores, especially Android. It's like the app-owners don't really want you to secure yourself.

What would be very nice in these phone OS security system would be selectable permission filters. Don't want to allow bluetooth-access to any applications except those you whitelist? Don't want to share your contacts with an app that seemingly has no need for it? A limited version of this is in iOS, but as I'll get to in a moment it only goes so far.

There are two methods of denying access to capabilities, and we already have a good example of this two-tier model in the firewall world:

  • Notifies connections of no-connection.
  • Pretends there is nothing there.

The first method is nice for applications since they learn quickly to stop trying. The second is nice for defenders because it means potential attackers have to wait for timeouts before marking a IP:Port tuple as up/down. When it comes to phones, there are two ways to deal with selectable permissions:

  • Notify the app that they don't have rights to that thing. Apps know they're being banned.
  • Lie to the app and provide a stub service that returns nothing or a simple carrier-signal. Apps will have to do tests to see if they're banned.

IOS uses the first model. If you've ever seen a, "turn on bluetooth for an enhanced user experience," modal, that's what happened. I believe that Apple standards say that applications have to honor those settings in that they still run and don't quit in a huff over not getting your identity goodies. You may not be able to do much, but they'll still run.

Android currently doesn't have selectable permissions (out of the box; there are some apps that try to provide it), you decide whether or not an app can be allowed to do it's full list at the time you install it. This can be problematic, especially if circumstances require that you install certain apps, but you want to disable certain capabilities. Such as having only one phone with both work and email on it, and you'd rather they didn't wipe it when they fire you.

That's where things like XPrivacy can come in handy. This only runs on a rooted device, but it provides the stub-services needed to prevent apps from quitting in a huff over not getting the ability to remove accounts on the device, lie about Bluetooth/NFC/Wifi access and state, or falsify 'network' location data. Things like XPrivacy allow us to provide those very 'accepted security standards' that reduce victim-blaming after incidents. It would be awesome if this came stock, but we can't have everything.

Way back when I first got into Group Policies, which was just after Group Policies were released, one of the things we mooted about the BoF den was a simple thing we could do to tell users that they were on a managed station. What we came up with was pretty simple: manage the desktop background.

No, we didn't put an all-seeing-eye on it. That would be creepy, don't be silly. We used a logo of the company.

It made sense! A simple cue, and we'd save RAM (back in those days the desktop background took more than trivial RAM). We were happy.


It turns out, that's not how you build a happy user-base. By doing so, we told people explicitly everything you do can and will be used against you in an HR action. People don't like to be told they're being monitored.

You know who likes to be told they're being monitored like that? No one.

You know who we want to be monitored that way? Prisoners and people likely to become prisoners.

No one wants to be thought of as a prisoner, or likely to be one.

In fact, later GPO guides specifically discouraged doing things like managing the desktop background or theme. It could be done, but... why would you want to? Desktop theme is one very low impact thing on the system and the single biggest thing the user can customize to their preferences. It's a very low challenge to the system to increase user experience by a great amount. Let them customize and don't worry about it.

But still manage their IE zones, certificate enrollment policies, software distribution methods, and event-log reporting.

They can make their jail-cell a pink polka-dot wonder, far better than bare cinder-block! It's still a cell, but without that camera in their face, they're happier about living in it.


It looks like consumer-focused big-data stuff is suffering the same faults as early GPOs did: they're being too obvious about the surveillance.

"Hello, Mister ${mispronounced last name}," said the sales-clerk I'd never met before. I sighed in resignation, vowing to factory reset my cell-phone. Again. One of these days I'm just going go cash only.

Or another one I almost guarantee will happen:

TSA Customer Service
@sysadm1138 We noticed you were in DFW security line for 49 minutes. We would like some feed back about that, https://t.co/...

Er, wait. That's Big Brother. Sorry, dial slipped. Let's try again.

VIctorias Secret
@sysadm1138 We noticed you spent time in our DES MOINES, IA store. If you have time, please take a short survey about your visit. https://t.co/...

You've probably run into this one, but hitting a random website, and then that site haunts your web-ads (for those of you who don't run on AdBlock-Strict) for weeks.

They haven't figured out that a large percentage of us don't like being reminded we live in a panopticon. Give me my false illusion of anonymity and I'm happy!

It's all about the user-factors. What's good for the retailer, is not always good for their consumers. Obviously. But the best kind of thing like that are things that aren't obviously not-good for the consumer.

User-factors, people!

A minimum vacation policy

| No Comments

A, "dude, that's a cool idea," wave has passed through the technology sector in the wake of an article about a minimum vacation policy. This was billed as an evolution of the Unlimited Vacation Policy that is standard at startups these days. The article correctly points out some of the social features of unlimited-vacation-polices that aren't commonly voiced:

  • No one wants to be the person who takes the most vacation.
  • No one wants to take more vacation than others do.
  • Devaluing vacation means people don't actually take them. Instead opting for low-work working days in which they only do 2 hours remotely instead of a normal 10 in the office.

These points mean that people with an unlimited policy end up taking less actual vacation than workplaces with an explicit 15 days a year policy. Some of the social side-effects of a discrete max-vacation policy are not often spelled out, but are:

  • By counting it, you are owed it. If you have a balance when you leave, you're owed the pay for those earned days.
  • By counting it, it has more meaning. When you take a vacation day, you're using a valuable resource and are less likely to cheapen it by checking in at work.
  • There is never any doubt that you can use those days, just on what days you can use them (maintain coverage during the holidays/summer, that kind of thing).

Less stress all around, so long as a reasonable amount is given. To me, this looks like a better policy than unlimited.

But what about minimum-vacation? What's that all about?

The idea seems to be a melding of the best parts of unlimited and max. Employees are required to take a certain number of days off a year, and those days have to be full-disconnect days in which no checking in on work is done. Instead of using scarcity to urge people to take real vacations, it explicitly states you will take these days and you will not do any work on them. For the employer it means you do have to track vacation again, but they're required days, don't create the vacation-cash-out liability that max-vacation policies create, and you only have to track up to the the defined amount. If an employee takes 21 days in a year, you don't care since you stopped tracking one they hit 15.

The social factors here are much healthier than unlimited:

  • Explicit policy is in place saying that vacations are no-work days. People get actual down-time.
  • Explicit policy is in place that N vacation days shall be used, so everyone expects to use at least those days. Which is probably more than they'd use with an unlimited policy.
  • Creates the expectation that when people are on vacation, they're unreachable. Which improves cross-training and disaster resilience.

I still maintain that a max-vacation policy working in-hand with a liberal comp-time policy is best for workers, but I can't have everything. I like min-vacation a lot better than unlimited-vacation. I'm glad to see it begin to take hold.

Categories

| No Comments

Humans are curious critters. We keep trying to pick apart reality to figure out how it works. Part of that is to break reality up into smaller chunks so it makes sense. Abstractions improve understanding and allow further refinements to the model. It's what science is based on.

Biology is a continually vexing problem, though. In many ways, it's a continuous function we keep attempting to turn into a discrete maths problem. Taxonomy, the naming of species, is a great example of this. Early classification methods relied on similar morphology to determine relatedness, and that gave us a nice family tree. Then we figured out how to sequence genomes and we learned how wrong we were; they're now moving whole species/phylum branches around. It turns out nature sometimes solves the same problem the same way through completely unrelated species.

What sparked the rearrangement? A new way to classify. A new method was picked to be more accurate, and changes had to be made.

Topically, take a look at OS classification of non-mobile consumer computing devices (what used to be called desktop-OS). You can see this on any web-visitor analytics platform. Some break it down like:

  • Windows
  • OSX
  • Linux

Others get more specific, breaking it down to versions within OS:

  • Window XP
  • Windows 7
  • Windows 8
  • OSX 10.6
  • OSX 10.7
  • OSX 10.8
  • OSX 10.9
  • OSX 10.10
  • Linux

For some reason they don't break apart the Linux versions. Perhaps because it's such a small segment of the market and highly fragmented at that. Still more detailed charts go down to Windows service-pack levels. OS version is a discrete space, but in order to provide a brief chart some simplifications are made. Each analytics application makes its own classification decisions.

Less topically, lets take a look at a fictional made-up species, the Variegated Civet. Take the physical sex of this critter. The original population study was done in 1906 and an odd sex ratio was observed, 1.3 females to every male. As with all studies of the time, external morphology studies were used to determine sex with a few dissections as a cross-check.

Fast forward a bunch of years and genetic studies become financially doable for an appropriate sample-size of the population. It reveals a funny thing. Some of the females are genetically male. This raises eyebrows and further studies reveal the cause. A significant percentage of males undergo gonadogeneis at puberty, not in-utero, which skewed the original study's sex ratio.

A new classification technique, genetics, reveals an interesting feature in a specific population. It also raises the question of what how to differentiate pre-puberty males with fully formed gonads from those who will do so later. A third sex may need to be created to explain this species.

We're undergoing an attempt to change the cultural classification method for gender in humans. For ages it has been based on physical morphology and came in two types. Nature being nature, there are plenty of ambiguous presentations to make the classifier problem harder (intersex); but not enough to prompt the creation of a third gender. Those weird-cases were assigned into one or the other, which ever was closer, in the opinion of the classifier (sometimes nudging things along with a bit of surgery). For ages gender was a synonym of sex.

That's beginning to change, and it's not been an easy thing to bring about. For one, gender is becoming more widely seen as discrete from sex. For another, gender is at the early stages of redefining its classifier away from external morphology and/or chromosomes and into self description. Self-description brings it away from a discrete function (binary, trinary) and into more of a multi-axis graph.

It takes a long time for a change like this to take hold, and there are fights being had. Vital Records only record one of these, and it's still legally entangling both sex and gender. Maybe in some future time driver's licenses will have both sex and gender fields on it. Or maybe those fields will be left off all together (the better option, in my opinion). Chromosomes are not truth, as nature's continuous function ensures there will always be an exception (complete Androgen Insensitivity Syndrome is the big exception to the XY = Male 'truth').

The work continues.

No, I'm talking about that fancy wristband some of you wear, the one that talks to a smartphone. That's a monitoring system, but for your body.

We're IT. We do monitoring systems, so lets take a look at this one!

Getting stuck in Siberia

| No Comments

I went on a bit of a twitter rant recently.

Good question, since that's a very different problem than the one I was ranting about. How do you deal with that?


I hate to break it to you, but if you're in the position where your manager is actively avoiding you it's all on you to fix it. There are cases where it isn't up to you, such as if there are a lot of people being avoided and it's affecting the manager's work-performance, but that's a systemic problem. No, for this case I'm talking about you are being avoided, and not your fellow direct-reports. It's personal, not systemic.

No, it's not fair. But you still have to deal with it.

You have a question to ask yourself:

Do I want to change myself to keep the job, or do I want to change my manager by getting a new job?

Because this shunning activity is done by managers who would really rather fire your ass, but can't or won't for some reason. Perhaps they don't have firing authority. Perhaps the paperwork is too much to bother with firing someone. Perhaps they're the conflict-avoidant type and pretending you don't exist is preferable to making you Very Angry by firing them.

You've been non-verbally invited to Go Away. You get to decide if that's what you want to do.

Going Away

Start job-hunting, and good riddance. They may even overlook job-hunt activities on the job, but don't push it.

Staying and Escalating

They can't/won't get rid of you, but you're still there. It's quite tempting to stick around and intimidate your way into their presence and force them to react. They're avoiding you for a reason, so hit those buttons harder. This is not the adult way to respond to the situation, but they started it.

I shouldn't have to say that, but this makes for a toxic work environment for everyone else so... don't do that.

Staying and Reforming

Perhaps the job itself is otherwise awesome-sauce, or maybe getting another job will involve moving and you're not ready for that. Time to change yourself.

Step 1: Figure out why the manager is hiding from you.
Step 2: Stop doing that.
Step 3: See if your peace-offering is accepted.

Figure out why they're hiding

This is key to the whole thing. Maybe they see you as too aggressive. Maybe you keep saying no and they hate that. Maybe you never give an unqualified answer and they want definites. Maybe you always say, 'that will never work,' to anything put before you. Maybe you talk politics in the office and they don't agree with you. Maybe you don't go paintballing on weekends. Whatever it is...

Stop doing that.

It's not always easy to know why someone is avoiding you. That whole avoidant thing makes it hard. Sometimes you can get intelligence from coworkers about what the manager has been saying when you're not around or what happens when your name comes up. Ask around, at least it'll show you're aware of the problem.

And then... stop doing whatever it is. Calm down. Say yes more often. Start qualifying answers only in your head instead of out loud. Say, "I'll see what I can do" instead of "that'll never work." Stop talking politics in the office. Go paintballing on weekends. Whatever it is, start establishing a new set of behaviors.

And wait.

Maybe they'll notice and warm up. It'll be hard, but you probably need the practice to change your habits.

See if your peace-offering is accepted

After your new leaf is turned over, it might pay off to draw their attention to it. This step definitely depends on the manager and the source of the problem, but demonstrating a new way of behaving before saying you've been behaving better can be the key to get back into the communications stream. It also hangs a hat on the fact that you noticed you were in bad graces and took effort to change.

What if it's not accepted?

Then learn to live in Siberia and work through proxies, or lump it and get another job.

"Over the next few decades demand in the top layer of the labor market may well centre on individuals with high abstract reasoning, creative, and interpersonal skills that are beyond most workers, including graduates."
-Economist, vol413/num8907, Oct 4, 2014, "Special Report: The Third Great Wave. Productivity: Technology isn't Working"

The rest of the Special Report lays a convincing argument that people who have automation-creation as part of their primary job duties are in for quite a bit of growth and that people in industries subject to automation are going to have a hard time of it. This has a direct impact to sysadminly career direction.

In the past decate Systems Administration has been moving away from mechanics who deploy hardware, install software and fix problems and towards Engineers who are able to build automation for provisioning new computing instances, installing application frameworks, and know how to troubleshoot problems with all of that. In many ways we're a specialized niche of Software Engineering now, and that means we can ride the rocket with them. If you want to continue to have a good job in the new industrial revolution, keep plugging along and don't become the dragon in the datacenter people don't talk to.

Abstract Reasoning

Being able to comprehend how a complex system works is a prime example of abstract reasoning. Systems Administration is more than just knowing the arcana of init, grub, or WMI; we need to know how systems interact with each other. This is a skill that has been a pre-requisite for Senior Sysadmins for several decades now, so isn't new. It's already on our skill-path. This is where System Engineers make their names, and sometimes become Systems Architects.

Creative

This has been less on our skill-path, but is definitely something we've been focusing on in the past decade or so. Building large automation systems, even with frameworks such as Puppet or Chef, takes a fair amount of both abstract reasoning and creativity. If you're good at this, you've got 'creative' down.

This has impacts for the lower rungs of the sysadmin skill-ladder. Brand new sysadmins are going to be doing less racking-and-stacking and more parsing and patching ruby or ruby-like DSLs.

Interpersonal Skills

This is where sysadmins tend to fall down. A lot of us got into this gig because we didn't have to talk to people who weren't other sysadmins. Technology made sense, people didn't.

This skill is more a reflection of the service-oriented economy, and sysadmins are only sort of that, but our role in product creation and maintenance is ever more social these days. If you're one of two sysadmin-types in a company with 15 software engineers, you're going to have to learn how to have a good relationship with software engineers. In olden days, only very senior sysadmins had to have the Speaker to Management skill, now even mid-levels need to be able to speak coherently to technical and non-technical management.

It is no coincidence that many of the tutorials at conferences like LISA are aimed at building business and social skills in sysadmins. It's worth your time to attend them, since your career advancement depends on it.


Yes, we're well positioned to do well in the new economy. We just have to make a few changes we've known about for a while now.

A taxonomy of IT users

| No Comments

Over the years I've seen a small collection of fake-names crop up in the sysadmin space. Here is a list:

BOFH
An oldie, but a Sysadmin who has gone over to the dark-side.

Fred
Originally coined by Laura Chappell, Fred is the User From Hell. Or, The Power User who Isn't. Fred knows everything, or rather, thinks they do. They're wrong, but don't know it, and it makes your life all too interesting. Fred may be a manager, a peer, or a frequent-flier in the ticket queue.

Leeroy
Originally from a famous Warcraft video, this is the peer who just deploys stuff because it's cool. They... haven't learned (the hard way) how this can go wrong, so aren't naturally suspicious. This could be the rose-colored glasses of youth and exuberance, or it could be a trusting nature. They'll learn.

Brent
Coined by The Phoenix Project, Brent is the person that ends up with their hands in everything one way or the other. They may be a single-point-of-knowledge, the only person who knows anything about topic X, or just the person that gets handed the weird stuff because, well, "Brent probably knows". A lot of us are a Brent, and it sure as heck makes getting long vacations approved difficult. There may be more than one of them, depending on topics.


I used to be a Leeroy, then I learned better.

I've been a Brent (oddball-stuff troubleshooter variety) at my current and last three jobs.

Right now people have figured out that I know how to use Wireshark to discover oddball problems, so I'm having to do a lot of packet analysis lately to rule out oddball problems. This isn't something I can cross-train on very well, but I'm going to have to find a way; people's eyes tend to glaze over when you get into TCP RFCs and it's easier to make me do it and not have to learn for themselves.

Having watched recent events unfold, I'm beginning to wonder what effect employment contracts are having on how companies and their employees respond to catastrophic reputation-loss events. A certain well known open-source company is undergoing this right now, which is why I'm thinking about it. Because they're big enough to have had lawyers go over their employment agreements for more than just intellectual property clauses, I'm guessing it's also picked up a few other goodies along the way.

The Setup

  1. $Company does something.
  2. $Activists say, "Hey, that's bullshit."
  3. $Supporters say, "Dude, not cool."
  4. $Defenders say, "Hey, no biggie, eh?"

Steps 2-4 can happen in 30 minutes these days. At this point the news is still expanding. But now the interesting things start to happen. As the $Defenders and $Supporters+$Activists start hammering on each other in social media the ranks of both camps increase and at some point, somewhere a subset of $Employee chimes in and after a while maybe $Company.Officer actually gives an official statement. By now the shit-storm is well and truly engaged.

Free Speech Means Freedom From Arrest (but not binding contracts between private parties)

Bloggers like me have known for over a decade now that mouthing off about one's employer is a great way to get fired. Some companies actually have clauses in their employment contracts that read, in effect:

You will only talk about the $Company in glowing terms. Or else.

The language is actually written like, "under no circumstances will you do or say anything that will reflect negatively on the company," but this works for now. This is called a non-disparagement clause, and is perfectly legal. What's more, it's common practice to use severance agreements to bind outgoing employees to those same clauses (if they weren't already bound by the employment agreement) in perpetuity to ensure that the now-ex employee doesn't mouth off about their old employer; less of a risk for voluntary departures, more of one for involuntary ones.

Your free speech has a price. Maybe it's $10K. Or $20K. $30K? $30K and 4 months health-insurance coverage to carry you to your next position? Okay, $75K, 5 months, and 10K shares of preferred stock. Have a nice life.

Shit-storm Meteorology

So you're in the $Activist+$Supporter camp and $Company is being strangely silent on the topic of what bonehead thing they did. The only people from the company talking about the thing are firmly in the $Defender camp, which only cements your opinion that they're just not getting it and are hopelessly out of touch.

What if you're a $Supporter that is also $Employee? If you have a non-disparagement agreement in your contract voicing that opinion is to risk your job and future employability. Unless you're also in $Company.Officer, speaking up is a very bad idea no matter how loudly the $Activists are crying for redress (in fact, speaking up even if you're a $Defender is a bad idea, but it's less likely to pothole your career-path). The Cyclone of Suck accelerates.

Stopping the Cyclone

It is possible to avoid the cyclone, or at least minimize it. It requires a fast response from $Corporate.Officer in a way that even the $Activists can recognize as meaningful. This is a hard step to take since it usually requires admitting fault (and thus, liability) which is why the first statement is almost always something like...

There there, we're not evil. We promise. We do good things too.

...and is lambasted by the $Activists as not addressing the problem. This is likely to accelerate the cyclone, not spin it down.

Another way to slow it down requires hard choices made by $Supporters who are also $Employees, by voluntarily severing employment due to whatever happened, refusing a severance agreement (and thus accept a period of no pay-check or even unemployment benefits), and saying why they left. It works better if more than one make this grand flounce.


This is just a theory of mine for how "never trash-talk your employer" clauses intersect with online debate. When I see people getting ever louder in indignation that some company or organization is remaining silent on some contentious topic, I do wonder if that's because the very people who would give the desired response have been preemptively legally gagged.

Not a bad observation

| No Comments

A friend of mine recently posted some job stuff and he had a good observation:

I investigate businesses that pay employees under the table. I ensure that unemployment insurance is paid by the employers, protecting the employees and ensuring they get unemployment insurance if they get laid off (if they get paid under the table they don't get unemployment).

I have been picking up a lot of businesses who are avoiding taxes (surprisingly, or maybe not, software companies are a big issue, along with housecleaners and dog groomers/sitters/walkers).

Emphasis mine.

You know, that's an interesting point and doesn't surprise me much. He does his work in the Seattle area, which is one of the major tech-hubs. And one thing tech-startups are known for is distributed offices. Take a 10 person company with people in 6 different states, no one who has run a company like that before, and you have prime conditions for dropping the ball on unemployment reporting and payment.

So you fired the slacker living in Waukegan, Illinois. Did you report their earnings in Illinois, where they live, Wisconsin, where the shared-office they 'worked' out of was, or Washington State, where HQ is?

aaahhh.... lemme get back to you on that.

As he tells me, that can be a very expensive mistake to make depending on how long the misunderstanding was in place. Your payroll vendor may or may not know WTF they're doing with a startup-style distributed office, so don't rely solely on them. Work location and residential location are different things. You can work in Vancouver, WA but live in Portland, OR; you pay Oregon income taxes, but will earn Washington unemployment if you get laid off.

Other Blogs

My Other Stuff

Monthly Archives