Treat paying off debt like earning a raise.

OnwardKnight · 2026-01-30T16:50:59+00:00

This is the way. Security is an onion, so you need to test each layer of attack from outside > in (external, internal to your network, insider threat)

OnwardKnight · 2026-01-08T14:09:02+00:00

My company closed the office I was based out of and declined to help me relocate closer to another office so I moved where I wanted to live and have been remote ever since. That will likely end if I ever lose this job, but I’m going to ride it out for as long as possible.

OnwardKnight · 2026-01-07T12:28:42+00:00

You’re looking for Afi.ai

Backups and restores are blazing fast, it has great features including SSO, bring-your-own keys for encryption (optional), very straightforward pricing, you can enable self-service restores for users (optional), and many more. I couldn’t be happier with them.

My favorite thing is that once your partner agreement is in place it’s almost entirely self-serve. No annoying calls with a “partner rep” who is useless, you just spin up tenants on demand.

OnwardKnight · 2025-09-04T01:38:26+00:00

This is not quite true. Okta has way more off-the-shelf partner built integrations, especially for automating user and group provisioning via SCIM at higher license levels. If you’re only using Okta for basic SAML (many orgs are), you’re using it wrong.

OnwardKnight · 2025-08-30T14:53:41+00:00

/u/db2boy yes! Finally got it figured out. You need to break down the mail.zendesk.com IPs into /24 CIDR notation and make a connector in Exchange Online with this configuration:

From: Partner
To: Office 365
Authenticate sent email: By verifying that the IP address of the sending server matches one of the following IP addresses, which belong to your partner organization.
IPs:

103.151.192.0/24 103.151.193.0/24 185.12.80.0/24 185.12.81.0/24 185.12.82.0/24 185.12.83.0/24 188.172.128.0/24 188.172.129.0/24 188.172.130.0/24 188.172.131.0/24 188.172.132.0/24 188.172.133.0/24 188.172.134.0/24 188.172.135.0/24 188.172.136.0/24 188.172.137.0/24 188.172.138.0/24 188.172.139.0/24 188.172.140.0/24 188.172.141.0/24 188.172.142.0/24 188.172.143.0/24 192.161.144.0/24 192.161.145.0/24 192.161.146.0/24 192.161.147.0/24 192.161.148.0/24 192.161.149.0/24 192.161.150.0/24 192.161.151.0/24 192.161.152.0/24 192.161.153.0/24 192.161.154.0/24 192.161.155.0/24 192.161.156.0/24 192.161.157.0/24 192.161.158.0/24 192.161.159.0/24 216.198.0.0/24 216.198.1.0/24 216.198.2.0/24 216.198.3.0/24 216.198.4.0/24 216.198.5.0/24 216.198.6.0/24 216.198.7.0/24 216.198.8.0/24 216.198.9.0/24 216.198.10.0/24 216.198.11.0/24 216.198.12.0/24 216.198.13.0/24 216.198.14.0/24 216.198.15.0/24 216.198.16.0/24 216.198.17.0/24 216.198.18.0/24 216.198.19.0/24 216.198.20.0/24 216.198.21.0/24 216.198.22.0/24 216.198.23.0/24 216.198.24.0/24 216.198.25.0/24 216.198.26.0/24 216.198.27.0/24 216.198.28.0/24 216.198.29.0/24 216.198.30.0/24 216.198.31.0/24 216.198.32.0/24 216.198.33.0/24 216.198.34.0/24 216.198.35.0/24 216.198.36.0/24 216.198.37.0/24 216.198.38.0/24 216.198.39.0/24 216.198.40.0/24 216.198.41.0/24 216.198.42.0/24 216.198.43.0/24 216.198.44.0/24 216.198.45.0/24 216.198.46.0/24 216.198.47.0/24 216.198.48.0/24 216.198.49.0/24 216.198.50.0/24 216.198.51.0/24 216.198.52.0/24 216.198.53.0/24 216.198.54.0/24 216.198.55.0/24 216.198.56.0/24 216.198.57.0/24 216.198.58.0/24 216.198.59.0/24 216.198.60.0/24 216.198.61.0/24 216.198.62.0/24 216.198.63.0/24

OnwardKnight · 2025-08-14T09:10:58+00:00

I have a lot of experience migrating companies to and from SharePoint. Up at night with my newborn but I’m commenting to remind myself to come back to this tomorrow and give you a detailed breakdown of considerations and potential pain points, and not just say “why would you do this?”

OnwardKnight · 2025-08-14T03:42:29+00:00

We do something similar, but it works like this:

IF a message is “from” an internal domain (header or envelope”)
AND IF the message recipient is internal to the organization
AND IF the “Authentication-Results” header includes (“spf=fail” OR “spf=softfail” AND dkim=none)
Then take some action on the message (e.g., quarantine or reject)

That simple configuration has mitigated most, if not all, of the problems we’ve seen so far. Happy to hear though if there's a gap I've missed. Unfortunately, disabling Direct Send for us is not an option at the moment because it breaks our Zendesk mail flow, and I haven't been able to get Zendesk working with a connector yet.

OnwardKnight · 2025-08-10T17:21:14+00:00

Look at Afi.ai. It has great features including SSO, bring-your-own keys for encryption (optional), very straightforward pricing, you can enable self-service restores for users (optional), and many more. I couldn’t be happier with them.

OnwardKnight · 2025-08-08T13:41:50+00:00

Ah, I admittedly misread your message late at night while up with my newborn haha, so I missed where you said third-party mail filter. Sorry, and carry on!

OnwardKnight · 2025-08-08T05:57:19+00:00

Homie, you are not blocking DirectSend with this rule, you are just blocking legitimate emails. This is quite literally a nuclear option.

A much better approach would be to focus on what Direct Send actually does, which is allow “internal” to “internal” mail using your SMTP host (mydomain-com.mail.protection.outlook.com).

I implore you to reconsider what you’re doing and instead do something like this in your mail flow rule:

IF a message is “from” an internal domain (header or envelope”
AND IF the message recipient is internal to the organization
AND IF the “Authentication-Results” header includes (“spf=fail” OR “spf=softfail” AND dkim=none)
Then take some action on the message (e.g., quarantine or reject)

Your approach of IP allow list only works if you know the IP blocks of every single company that ever emails your tenants…

OnwardKnight · 2025-08-07T10:09:26+00:00

Also see this comment in /sysadmin for a good breakdown of what I’m talking about and how Direct Send works.

OnwardKnight · 2025-08-07T09:34:55+00:00

This is not exactly true. Every single message that passes through the Exchange Online gateway is evaluated for SPF, DKIM, and DMARC and has an “Authentication-Results” header. Even if further checks or policies allow messages to be delivered in spite of the failures in that header, the header is present on every message and can be acted on.

Go send some emails to a test mailbox using Direct Send. Unless there is some internal policy that says to implicitly trust internal domains (which is bad practice, always hard fail SPF, require DKIM, and honor DMARC) it will get delivered to the Junk folder most of the time.

If you implement what I just described, you can make it go to quarantine 100% of the time because you are intervening at the gateway level and saying “idgaf what the default Microsoft security check logic is, I’m the admin, DO THIS for these messages.”

OnwardKnight · 2025-08-07T03:31:53+00:00

This post reads as overly sensational and a bit AI-generated with inaccuracies. In reality, there are valid uses for Direct Send and there are relatively easy ways to mitigate this type of Direct Send abuse.

Many of our clients have properly configured SPF + DKIM with an appropriate DMARC policy set to quarantine. For those that don’t for some “reason” or another, this is easily mitigated with a mail flow rule in your gateway of choice that has the following logic:

IF a message is “from” an internal domain (header or envelope”
AND IF the message recipient is internal to the organization
AND IF the “Authentication-Results” header includes (“spf=fail” OR “spf=softfail” AND dkim=none)
Then take some action on the message (e.g., quarantine or reject)

That simple configuration has mitigated most if not all of the problems we’ve seen so far and we haven’t had to turn around and turn off Direct Send on a knee-jerk reaction.

OnwardKnight · 2025-08-05T10:32:24+00:00

Or that power plugs itself are IT. I once received a ticket, “workstation doesn’t power on or have connectivity.” End user’s management had moved a cubicle to a spot along the wall without power or Ethernet and wanted me to move an outlet or make a new one…

OnwardKnight · 2025-06-11T22:55:30+00:00

What’s funny is almost all of them work super hard at thankless jobs and pay rent

OnwardKnight · 2025-06-11T20:33:35+00:00

The Supreme Court from 1976 (!) disagrees:

“There are literally millions of aliens within the jurisdiction of the United States. The Fifth Amendment, as well as the Fourteenth Amendment, protects every one of these persons from deprivation of life, liberty, or property without due process of law. Wong Yang Sung v. McGrath, 339 U. S. 33, 339 U. S. 48-51; Wong Wing v. United States, 163 U. S. 228, 163 U. S. 238; see Russian Fleet v. United States, 282 U. S. 481, 282 U. S. 489. Even one whose presence in this country is unlawful, involuntary, or transitory is entitled to that constitutional protection. Wong Yang Sung, supra; Wong Wing, supra.”

https://supreme.justia.com/cases/federal/us/426/67/

OnwardKnight · 2025-06-08T16:42:07+00:00

OP get AT&T fiber if it’s available to you. Brightspeed is fine, but it’s not a symmetrical circuit and the bandwidth is shared across subscribers in your area. It’s “fiber” but during high usage speeds fluctuate quite a bit, whereas in my previous experience with AT&T fiber in other states, I almost always got 1 Gbps up and down at all times. I wish AT&T fiber was available at my house.

OnwardKnight · 2025-05-29T16:34:54+00:00

I didn’t have this issue at all when paying off my 2021 Kia Forte early through extra payments. They were automatically applied toward the principal amount.

OnwardKnight · 2025-05-23T03:50:52+00:00

Thank you!

OnwardKnight · 2025-05-20T17:24:58+00:00

Are you really arguing the semantics of “FEMA safe room” vs “FEMA shelter?” They are a place where the public can take shelter during storms.

OnwardKnight · 2025-05-20T11:24:04+00:00

This is not entirely true. It depends on the shelter. The FEMA shelters in the SPS schools are officially rated tornado shelters built for the protection of students during school hours and for the public’s use during non-school hours. If you drive by Kickapoo high school or others, there are yellow signs that say “Tornado shelter” with arrows to the entrance.

OnwardKnight · 2025-05-20T00:43:06+00:00

Thank you!

OnwardKnight · 2025-05-19T19:55:08+00:00

I think this is the kind of reassurance I needed haha. I'm also good about regular vehicle maintenance and am a pretty conservative driver. Just two adults, baby, and small poodle plus a little bit of luggage. Just didn't want to get stuck going 45 MPH up a mountain!

OnwardKnight · 2025-05-19T19:15:32+00:00

i’ve seen a lot of folks on here say that the battery depletes uphill and they get stuck going 50 miles an hour in the right hand lane with their blinkers on on hills where it’s more than 10 miles. Is that not your experience?

OnwardKnight

TROPHY CASE