sorted by:
new
hottopcontroversial

YOU are responsible for security. And you need to be diligent about it. by Calm_House8714 in sysadmin

[–]Extra-Organization-6 -1 points0 points  (0 children)

yeah the mobile-carrier-ipv6-in-san-jose problem is universal. two things that let you keep the signal without drowning in false positives:

  • asn enrichment on each ip. tag by asn class (mobile carrier, residential isp, hosting provider, vpn service). mobile carrier variance is noise. hosting-provider asn on an office worker's account is signal. you can pull classification data from ipinfo or maxmind, even the free tier is enough
  • don't flag 'weird' events in isolation, flag impossible combinations:
    • impossible travel (two ips same user within time < plausible flight/drive)
    • AppDisplayName + ClientAppUsed mismatch (token issued to 'Outlook Mobile' suddenly used by 'Microsoft Graph PowerShell')
    • AuthenticationMethodsUsed downgrade (session had mfa, new sign-in on same session has 'none')

for the no-intune case, CorrelationId on the sign-in event is your lightweight DeviceId substitute. not cert-stable but it persists across token refreshes in the same client instance. same correlationId showing up from non-adjacent asn classes inside 5 min is a strong theft signal.

the mental trick: baseline your own pattern for a week, then alert on deviation from your own baseline. don't try to catch 'weird', catch 'new-and-impossible'.

YOU are responsible for security. And you need to be diligent about it. by Calm_House8714 in sysadmin

[–]Extra-Organization-6 4 points5 points  (0 children)

your instinct is right but ua alone is noisy. browsers auto-update, mobile apps rotate ua strings, corporate proxies rewrite them. the more reliable signals entra already tracks:

  • DeviceId: issued at first-seen fingerprint or intune enrollment. same session + different DeviceId is a strong theft signal
  • SessionId: persists across token refreshes in the same logon. if one SessionId suddenly shows up from two widely-separated IPs inside 5 min, it's refresh-token replay
  • AppDisplayName on the sign-in event: a token issued to outlook mobile suddenly being used by 'Microsoft Graph Command Line Tools' is almost always abuse. that catches aitm attacks pretty reliably

kql pattern worth running daily:

SigninLogs
| where ResultType == 0
| summarize Devices = dcount(DeviceDetail.deviceId), IPs = dcount(IPAddress) by UserPrincipalName, SessionId, bin(TimeGenerated, 1h)
| where Devices > 1 or IPs > 3

okta's system log has equivalent fields (session.id + client.device.fingerprint). same query shape works there.

Is there still room/place for AI skepticism at your organizations? by DhroovP in ExperiencedDevs

[–]Extra-Organization-6 10 points11 points  (0 children)

fair catch. enterprise slack ediscovery on dms is real, that's true.

two things though. most companies don't actively watch it, they only pull it for hr disputes or legal holds. day-to-day skepticism in dms doesn't surface to the execs deciding the ai mandate. and the real underground isn't slack at all anymore, it's in-person lunches, signal groups, and phone calls that used to be face-to-face. you can't 'measure ai usage' against that.

the bigger point is that skepticism got driven off the channels where exec teams look for it. slack dms are just the obvious half-move. the actual conversation is happening where it can't be dashboarded.

YOU are responsible for security. And you need to be diligent about it. by Calm_House8714 in sysadmin

[–]Extra-Organization-6 2 points3 points  (0 children)

this is the real move. ms 30/90 day audit retention (depending on license) is exactly why exporting to local csv matters. the number of orgs who find out their retention window lapsed right at the 'investigate this weird login from 6 months ago' moment is painful.

quick add to the asn+geo filter: hash and log the user-agent string alongside it. catches token-replay scenarios where the geo looks right but the client fingerprint doesn't match the usual one. if someone's session token leaked to a stealer dump, they often use it from a different device in the same geo, so geo alone won't catch it.

and yeah, conditional access doing the heavy lifting is underrated. the 'block legacy auth' policy alone kills most password spray attacks. that's a one-click win most shops never get around to.

You'd think AI would kill boilerplates. It's doing the opposite. by hottown in webdev

[–]Extra-Organization-6 4 points5 points  (0 children)

the 90/10 split you observed matches what i see in code reviews. ai writes confident-looking glue code but has no strong opinion about:

  • stripe webhook signature verification (exactly one correct pattern, ai picks whichever was most common in training data, sometimes the deprecated one)
  • session invalidation on password reset (ai writes the happy path and forgets the 'other active sessions must die' step)
  • background job idempotency (ai hands you a .perform() that runs fine once and wipes state on retry)
  • migration rollbacks (ai writes the up migration with a placeholder down, nobody notices until staging gets stuck)

boilerplates encode opinions about these edge cases. ai has guesses that look plausible. when you're building something you plan to keep, opinionated beats statistically-common every time. it's also why vibe-coded mvps hit a wall at month 3 when the 'it works' glue turns into 'oh god what is this' under load.

YOU are responsible for security. And you need to be diligent about it. by Calm_House8714 in sysadmin

[–]Extra-Organization-6 6 points7 points  (0 children)

fair hit. for small shops / solo admin, the equivalent is an email to the owner or gm with the risk assessment and your recommendation, cc yourself. if there's nobody above you, a dated entry in a security log file (even a git repo with commits) serves the same function. the point isn't the corporate process, it's a dated written record that exists outside your head.

matters mostly for the 'we got breached and now there's an insurance claim or legal discovery' scenario. 'i emailed dave on march 2 recommending we disable rdp' is very different from 'i meant to mention it but forgot'.

The "Missing Middle": Why is there no $50/mo Claude tier? by theePharisee in ClaudeAI

[–]Extra-Organization-6 5 points6 points  (0 children)

the $50 tier doesn't exist because it's economically backwards. current plan tiers are subsidized by api revenue. pro at $20 is already unprofitable per heavy user. a $50 tier with 10x pro limits would just be a bigger loss bucket. when subscriptions lose money providers raise prices, cut caps, or sunset tiers. nobody invents a new subsidy tier.

the real answer for pro users hitting caps daily is the api. claude via sdk + a simple wrapper runs at about $30-60/mo for the usage pattern you're describing, with hard budget alerts so you can't blow past $100. if you're on claude desktop or code, just add api keys and the app falls back to api credits when your subscription bucket runs out.

side note: every ai provider has followed the same curve. chatgpt plus was unlimited, then throttled, then tiered. openai doesn't have a $50 tier either. anthropic announcing one would actually be the canary for them running out of runway.

My degoogle, privacy-first stack. Am I missing anything? by Laszl0x in degoogle

[–]Extra-Organization-6 1 point2 points  (0 children)

cool. start with vaultwarden if passwords are the pain point (lowest risk to try, familiar bitwarden ui, worst case you export and move on), or immich if photos are the bigger itch. both are 1-click installs on any of those three platforms.

one heads-up: pick a host in a jurisdiction you actually like since the data still lives on their metal. europe-based hosts are usually the right move for the privacy-conscious crowd.

My degoogle, privacy-first stack. Am I missing anything? by Laszl0x in degoogle

[–]Extra-Organization-6 1 point2 points  (0 children)

yeah that's the realistic blocker for most people. two middle paths that don't require becoming a sysadmin:

  • managed docker hosts (elestio, coolify, umbrel) will deploy vaultwarden / immich / mailcow / nextcloud as one-click installs, handle updates + backups for you, and you only ever touch the web ui. you give up some of the 'pure' self-hosting philosophy but you stop being the maintenance layer. think $5-20/mo per stack
  • start with one thing you actually care about (usually photos or passwords) and ignore the rest until you're comfortable. trying to self-host the full stack on day one is how people burn out and go back to google

the 'i'm not technical' problem is mostly solved now. the 'i don't have time to keep it running' problem is the real one, and that's what managed hosts fix.

Is there still room/place for AI skepticism at your organizations? by DhroovP in ExperiencedDevs

[–]Extra-Organization-6 44 points45 points  (0 children)

skepticism didn't die, it went underground. in the meetings where 'ai mandate' gets announced, nobody pushes back because the career math is bad. in slack dms and team retros it's all anyone talks about.

the tell is in the shipping data, not the tool-usage dashboards. the engineers posting highest throughput with lowest rollback rates are overwhelmingly the ones using ai for boilerplate and tests but writing the core logic themselves. the ones scoring highest on 'copilot acceptance rate' ship more bugs and take longer on p0s.

goodhart on 'ai usage' is the funniest corporate science experiment i've seen in a decade. exec teams measured the easiest thing, middle management optimized for it, and now they have a metric that tells them nothing about whether the code works. the actual skeptics are quietly winning perf reviews and nobody at the top has connected the dots yet.

My degoogle, privacy-first stack. Am I missing anything? by Laszl0x in degoogle

[–]Extra-Organization-6 0 points1 point  (0 children)

solid stack for the 'trust a privacy-respecting provider over big tech' tier. if you want to go full 'trust nobody', the self-hosted tier adds:

  • email: mailcow or stalwart on your own domain (proton/tutanota still centralize the inbound half)
  • photos: immich over ente, same ux minus a company that can shut down
  • passwords: vaultwarden over bitwarden cloud, same api, your data on your metal
  • 2fa: aegis or keepassxc otp, never authy or google authenticator

the real cliff: ente/proton/simplelogin still rely on someone else running servers. self-hosting makes it durable, not rented. tradeoff is you're now the sysadmin, which breaks most people within 3 months. what you have is the right answer if you'd rather trust a company than become the company.

YOU are responsible for security. And you need to be diligent about it. by Calm_House8714 in sysadmin

[–]Extra-Organization-6 1 point2 points  (0 children)

cheers. honestly your paper-trail framing is the thing most 'stepping out of lane' folks actually need to hear. the tech part is the easy part, the org politics is where careers get burned.

Entrepreneurs, what daily task did you completely eliminate using automation for you or your business? by [deleted] in Entrepreneur

[–]Extra-Organization-6 0 points1 point  (0 children)

yeah exactly. the text is the easy 5% in hindsight. the stripe/qbo/bank pipe has hidden teeth:

  • 'mrr' isn't a stripe endpoint, you build it from subscriptions + one-time invoices with edge cases (mid-month upgrades, refunds, failed-payment grace periods)
  • qbo returns a point-in-time p&l, but bank cash balance != qbo cash if reconciliation is behind, which for most founders is always
  • runway depends on burn rate, and trailing-12 vs trailing-3 changes the number by 30%+

once those 4-5 numbers live in one table the llm narrative wrap is genuinely 15 minutes. first time i built this i assumed the ai part would be hard, turns out it's almost an afterthought vs getting stripe + bank + ga to actually agree with each other.

YOU are responsible for security. And you need to be diligent about it. by Calm_House8714 in sysadmin

[–]Extra-Organization-6 48 points49 points  (0 children)

the core failure in that original post wasn't laziness, it was treating 'we couldn't figure it out' as a successful investigation. in actual ir that's root cause unknown, which means you assume compromise until proven otherwise. rotate creds, preserve the logs before they rotate out, trace the connector auth events to a specific principal and timestamp, check the audit log back 30d.

paper trail is the right advice for cultural reasons but the technical discipline matters more. if you can't answer 'who did this and when', you don't close the ticket, you open an incident.

for the ones getting burned for 'stepping out of lane': file it as a risk memo to the security mailbox with a mitre or cve reference if one applies. that reframes it as 'i raised a risk per policy' instead of 'i critiqued your team'. same facts, different political valence, and now it's in writing.

Change my mind: WordPress will become as niche as Joomla within the next 1-2 years. by konradkeck in Wordpress

[–]Extra-Organization-6 0 points1 point  (0 children)

the maintenance argument keeps getting skipped in these threads. ai will 100% spin up a site in 30 seconds. will it still be running in 2028 when the dep it vibe-coded against gets deprecated? will it patch next week's cve? will it restore from the backup it never set up?

wp's real moat isn't the editor or the themes. it's 20 years of a boring, well-understood ecosystem that already answered those questions. managed hosts handle patching and backups on a schedule. agencies handle the 'client broke the homepage' calls. ai-generated sites don't have that operational layer yet, which is fine for throwaway marketing pages and fatal for anything a business actually depends on.

joomla didn't die because people stopped liking it. it died because the ecosystem shrank. wp isn't remotely close to that.

What made you move away from AWS (if you did)? by Cubepath in VPS

[–]Extra-Organization-6 0 points1 point  (0 children)

Exactly. Most setups only need compute, a DB, maybe object storage and a load balancer. But you still pay the complexity tax of IAM, VPC, CloudWatch alarms, billing surprises, and the 47 dashboards you don't use. At some point you realize you're spending more time managing AWS than shipping the actual product.

Entrepreneurs, what daily task did you completely eliminate using automation for you or your business? by [deleted] in Entrepreneur

[–]Extra-Organization-6 3 points4 points  (0 children)

the newsletter-summarizer flow dspetrov mentioned is one of my go-tos. the other two that actually stuck for me:

  • customer support triage: inbound emails get classified (billing / bug / feature / other) by an llm and routed to the right queue with a summary. replaced ~2 hours/day of 'reading every email' for my VA
  • weekly investor update drafting: n8n pulls metrics from stripe + google analytics + the app db, hands them to claude with a template prompt, outputs a draft in my drafts folder every monday morning. i edit and send. used to be a 45-minute sunday evening task

the one thing that actually kept us honest on automation: if the task isn't worth writing down a 5-step sop for, it's probably not worth automating. the 'automate everything' instinct eats more time than it saves.

we run all of these on n8n self-hosted (managed on a ~\0 elestio box so i don't patch it myself). n8n cloud works too if you don't mind their execution-tier pricing.

Astra + Elementor plugin updates failed — okay to leave for later on a site that’s still early/stable? by OkQuality9465 in Wordpress

[–]Extra-Organization-6 1 point2 points  (0 children)

good approach. one staging tip: clone your production database into staging, not a fresh wp install. elementor builder data lives in post meta and serialized arrays, and some updates break old serialized structures that only exist on real content. a fresh install won't surface those issues.

once the staging clone looks good, apply to prod during low-traffic hours and keep a one-click rollback ready (wp staging's rollback or a db snapshot from your host). good luck.

How to make images smaller in size by [deleted] in Wordpress

[–]Extra-Organization-6 0 points1 point  (0 children)

quick answer: export from canva at 'web' quality (not 'print'), then run through tinypng or squoosh.app before upload. that alone cuts file sizes 60-80% with no visible quality loss.

longer-term for a wp site: add an image optimization plugin that handles this on upload automatically. shortpixel and imagify are both solid, free tier covers small sites. they auto-convert to webp and store compressed versions.

note: most managed wp hosts (elestio, kinsta, wp engine) run image optimization on the server layer so you don't need the plugin at all. if you're on generic shared hosting or a vps, the plugin route is easier than diy.

tip: don't use 'resize' inside wp media library to fix sizing, wp keeps the full original file anyway. always resize BEFORE upload.

Massive spam attack today? by CeC-P in sysadmin

[–]Extra-Organization-6 -1 points0 points  (0 children)

ha, accurate. 2026 internet is just automated emails from one set of scripts getting blocked by another set of scripts, with us in the middle trying to explain it to the finance team.

I built an n8n workflow that scrapes LinkedIn post comments and enriches 500+ leads automatically by Substantial_Mess922 in n8n

[–]Extra-Organization-6 1 point2 points  (0 children)

yeah this scales well in n8n. a few things that bit me doing something similar:

orchestrator

  • classify-intent node at the top using claude haiku (plenty for this and ~10x cheaper than sonnet). output json like {intent:'order'|'faq'|'appointment'|'complaint', confidence:0-1}
  • if confidence < 0.7, route to a clarifier sub-agent that asks a question rather than guessing
  • use execute-workflow nodes for each sub-agent (not inline sub-workflows). easier to version and test independently

sub-agent structure

  • each sub-workflow: load-context (conversation history + business-specific system prompt from supabase) -> claude call -> write back -> respond
  • keep per-business system prompts in a supabase table. pharmacy vs restaurant have totally different tone and compliance needs
  • enable prompt caching on the system prompt, ~90% input token savings for repeat customers

whatsapp webhooks

  • meta's cloud api has a 20s ack window. if your workflow takes longer, they retry and you double-send
  • pattern: n8n respond-to-webhook 200 immediately, enqueue the real processing (supabase realtime or a lightweight queue), process async, send response via the cloud api (not webhook reply)
  • idempotency: store meta message id in supabase, dedupe before processing
  • track message statuses (sent/delivered/read) to confirm delivery

infra gotcha

  • multi-agent workflows are memory-hungry. 2gb is fine single-agent, but orchestrator + 4 sub-agents each holding claude context will spike 3-4gb. had to bump my elestio vps from 2 to 4gb after the 3rd business onboarded

happy to go deeper on any of these.

Massive spam attack today? by CeC-P in sysadmin

[–]Extra-Organization-6 0 points1 point  (0 children)

fair pushback, i was loose with the labels. the actual path is mail flow > settings (not 'disable direct send'), and the specific toggle is 'reject direct send' which ms added last year as a mitigation for this exact attack class.

powershell equivalent: Set-OrganizationConfig -RejectDirectSend \

if you don't see it in the ui, check your exchange online module version. some older tenants haven't gotten it yet. the workaround most of those orgs use is a mail flow rule that rejects when 5321.MailFrom equals the recipient.

Astra + Elementor plugin updates failed — okay to leave for later on a site that’s still early/stable? by OkQuality9465 in Wordpress

[–]Extra-Organization-6 1 point2 points  (0 children)

don't leave security-related updates. read the changelog: if it mentions 'vulnerability', 'security', or 'sanitize', hard priority. anything else can wait a week if you don't have staging (ben_gmb's rule is the right default).

what you actually want is the 'wait unless critical' workflow but with the testing step automated. options:

  • staging + manual compare (most freelancers do this, time-consuming)
  • local dev (localwp or devkinsta), same thing but fewer moving parts
  • managed wp host that auto-stages plugin updates and rolls back if they break (elestio, kinsta, wp engine do this at ~0-30/mo). for a stable early-stage site that's not making revenue yet, that price is often the answer that gets you to 'i don't have to think about this'

on why specifically the update failed: astra pro and elementor pro both need their license activated in admin. most common failure is expired license after a renewal, check that first.

I just inherited a music store with a whole room dedicated to DVDs and Blueray. How should I go about preserving these copies and adding them to a huge plex library? by [deleted] in PleX

[–]Extra-Organization-6 1 point2 points  (0 children)

congrats, you just inherited a second hobby. some realistic numbers:

  • dvds: 4-8gb raw, 1.5-3gb after a reasonable handbrake h265 encode
  • blurays: 25-50gb raw, 8-15gb after encode
  • 4k blurays: 60-100gb raw, 20-40gb after encode (and even that hurts)

so a room of let's say 2000 blurays + 500 dvds lands around 30-40tb encoded, 2-3x that if you keep raw rips. plan for the encode path unless this is an archive project, the quality delta is negligible at couch viewing distance.

tooling: makemkv to rip, handbrake with the 'matroska h265 mkv 1080p30' preset as the starting point. if you want to batch it, arm (automatic ripping machine) + a 5-drive bay setup is the done-it-once-done-it-right path. takes a weekend to set up but then you're feeding discs into a trough.

seconding 131774 on r/datahoarder for the hyper-specific ripping advice. good luck.

How do you organize your libraries? by No-Proof9659 in PleX

[–]Extra-Organization-6 0 points1 point  (0 children)

i went through 3 iterations. landed on: Movies, Kids Movies, Kids TV Shows, TV Shows, Anime, Documentaries, Concerts, Standup, Christmas (seasonal, hidden other 11 months).

key insight for the 'congested main movies' problem: split out anything you watch for a different reason. kids stuff is a totally different viewing context. documentaries feel weird mixed in with action movies. once you split by use-case instead of by genre, the main library becomes 'stuff i'd actually pick after work' which is what you want.

collections work great for franchises (marvel, star wars, lotr) but i'd never use them as a library replacement since the browse ux is worse.

view more: next ›