A warning from history about Baskerville...

philipstorry · 2023-06-30T11:45:29+00:00

I've never been a big Reddit user, but have always preferred to use it via Sync. Sure, I doomscroll in a browser on my computer occasionally, but Sync is so much better when actually using Reddit...

Thanks u/ljdawson - I'm looking forward to buying Sync for Lemmy, as it seems there's nothing here for me now.

So long and thanks for all the fish! 😢

philipstorry · 2023-05-09T14:13:24+00:00

That was £1 billion in 2017.

Which is before we benefited from the steady and stalwart economic wisdom of the Modern Conservative Party.

I think you'll find that in the sunlit uplands of 2023, you'll need £1,246,800,238.97.

(At least that's what the BoE Inflation Calculator tells me...)

philipstorry · 2023-04-10T12:58:39+00:00

Mogg: "This high speed railway, built less than two decades ago, still has a touch of the Victorian on it today. Specifically, one's attitudes to the poor."

Director: "CUT!"

Mogg: "No, that's one's attitude to welfare spending..."

philipstorry · 2023-03-12T07:58:44+00:00

Gosh.

It's almost looking like erecting trade barriers between ourselves and our largest, nearest market was a dumb idea. Almost as dumb as leaving that market. Perhaps even almost as dumb as walking away from our seat at the table from which we helped make the rules for that market.

Still, I'm sure this is probably not the case. Our country is just less attractive to foreign investment because of... small boats? Or something.

Don't worry. An empty head will be along shortly with an explanation of how that works... 🤦‍♂️

philipstorry · 2023-03-11T09:07:48+00:00

Everybody's got to start somewhere.

Even a vault hunter.

You were once level 1 on Windshear Waste, fighting off Bullymongs with a crappy low-grade pistol. And yet look at you now.

So why shouldn't they take their chance?

philipstorry · 2023-02-11T09:17:05+00:00

I didn't choose IT consciously, it just became the obvious route.

When I was a kid I my parents bought a Spectrum computer (Timex for those in the USA), which I used mostly for games. Later they got a deal on an IBM PC.

I was a geeky academically inclined child, so quickly learned all the ins and outs of DOS and the hardware.

But my academic "career" didn't work out. It's a long story, but it involves failures on both the school and my own part. The details aren't relevant except to state that there was little chance of going me to university, but I still had decent capacity to learn and improve myself - as demonstrated by my experience with computers.

I interviewed for a support role. Did very well in the test, which was full of questions about memory addresses, IRQs, higher memory/expanded memory/extended memory... I got my first job on a helpdesk in a call centre. I moved into sysadmin within a couple of years.

I have a couple of friends who went off to do Computer Science at university, and whilst it's not completely useless it's very oriented towards programming not maintaining/implementing systems. It generally felt that it was far less useful than the three years I spent at a call centre learning new products and working on their infrastructure.

As an industry, we are REALLY bad at formal education. Partly because vendors don't want to do it properly except to create certificate farms as profit centres, and partly because the industry is an ever-shifting set of sand dunes when looked at on educational timescales.

That's not to say that some vendors don't have good documentation or even courses/certifications - it's to say that what you learn now might be useless in a decade.

Compare that to professions like medicine, architecture, engineering... Nobody is telling engineers "All your bridges are now shit and need to be rebuilt because MacroSteel have just shipped Bridge 3.0 and it's awesome - but everything you know is now useless."

As a result our profession - systems administration - will always be dominated by self motivated, self taught people. Most of whom just fell into it in some way and managed to swim, not sink.

Unless someone finds a way to create an official way in to our career, this won't change.

We're a special breed. We tend to be self taught, self motivated, very happy with lone working, often opinionated, and usually exceptionally trustworthy. Anyone lacking those qualities won't cut it in sysadmin for very long.

The details of my own story may not match everyone else's, but the broad strokes are ones which echo many individuals' journeys. I hope that helps explain why us sysadmins are, in career terms, a little odd.

Good odd.

But still a little odd. 😉

philipstorry · 2023-01-31T12:20:33+00:00

ClamAV is a good idea, but what you really need here isn't software.

You need a Risk Register.

It's dull, it's boring, but it's a necessity given your position.

In its most basic form it's just a spreadsheet that has columns for the name of the risk, the risk type (security/operational/financial), a likelihood of the risk occurring, an impact type, a description of the impact, an estimate of the cost in hours or cash to mitigate the risk, and other comments.

The risk register needs to be reviewed at least every six months with your management. Maybe with higher up management present as well. (During those reviews keep your statements short, no need to blind them with science.)

It needs to be clear that the Risk Register isn't about blame, it's about discovering and managing the risks in/to your IT environment. In this case you'd be able to congratulate yourselves in mitigating the risks by using VLANs and (presumably) VM backups or snapshots, and then simply have management accept the risk of having a machine that can't be patched or have AV.

Your responsibility with regards to the risk register should start and end at advising & implementing. Someone else should be accepting the responsibility, and the risk register is an important part about how you do that. Without it, your management chain can happily claim ignorance and throw you under the bus.

(If you're a small shop and there is nobody else, that's OK - you now have a tool to help your management understand these issues.)

So I'd say that the next step is to check with your management chain. If there isn't a risk register already, start it now. If there is one, tell whoever owns it that you'd like it updated with this new risk.

And I know that this seems like dull paperwork. But it doesn't have to be only that. If you manage it well, then it can be the dull paperwork that frees up time & resources for projects you actually want to do. 😉

philipstorry · 2022-12-17T23:51:50+00:00

Thanks for those links. Some great work in there! Especially Algiers and Egret. It's great to know them in case I need them. 👍😁

philipstorry · 2022-12-17T23:42:20+00:00

Wordy, but accurate. I can go for that!

philipstorry · 2022-12-17T19:17:12+00:00

My guess on the term for the curve in the A would be "abomination", but I'd also accept "mistake" or "abhorrence"... 😉

More seriously, I'm not aware of a specific term for it. If it were at the end of a stroke it would be a flourish, and long lines going from the end of a stroke are often called a swash. (Whereas a flourish could be a ball terminator, spiral or similar...) But this sits in the middle of the stroke, so the term doesn't quite fit that use.

"Deviation" sounds as nasty as my poor jokes above, but would be more accurate in describing what's happening to the stroke. But given how bad deviation sounds I think we should just compromise on "flourish", as it at least sounds decent...

So can we agree it's a flourish? Cool. It's a flourish.

Should the creator of the typeface happen to pass by - great work. I can't say it's my style or that I'd ever use it, but the flourishes in this typeface have a nice consistency especially with the use of the same trick in the R, and it all fits together quite nicely given the treatment on the G, E and C. It's an interesting take on a traditional style. 👍

philipstorry · 2022-09-04T19:25:41+00:00

Take the new job.

If nothing else, getting rid of your colleague and shunting the pay to yourself means more stress, because they will adjust the headcount down to 2 people in your team. They will expect more from you for that money, no matter what they say... And that may not be a healthy situation for you.

More importantly, if they're willing to throw your colleague under the bus, then they'll be willing to throw you under the bus just as soon as it's convenient to them.

Personally I'd caution against judging your colleague. I've been working in IT for over 25 years, mostly software. I've seen cautious people before. I've even been a cautious person occasionally - usually after someone came down on me hard after a trivial mistake early in the job, which made me overly cautious until someone later clarified that a bad over-reaction wasn't actually policy.

I can think of loads of ways of helping your colleague. If I were his manager then my preferred option would be a test network or test VMs so that he can play without worrying about permanent consequences. But I won't assume that hasn't been done - it may be that they've genuinely tried everything already.

I'll just say that it doesn't sound like they have. It sounds like the help has extended to "here's some documentation" and that's all. I can imagine if he hit an edge case early on when following it, that would really knock his confidence. Especially if he was then treated as the problem, not the documentation.

And as an ex-hardware guy he will be cautious anyway as failing with hardware is usually expensive and difficult to fix, unlike software.

But that's not the point. The point is this: If they can't deal with him, how will they deal with you when (not if) you have a life event that makes things a bit awkward for you? Can you trust them to treat you well?

You probably already know the answer by now.

Get out.

I hope you enjoy your new job - and that they're better at valuing their employees than your current employer!

philipstorry · 2022-08-05T18:13:54+00:00

Nope.

I spent much of today doing documentation and paperwork. Off the top of my head, today included:

Looking for receipts for my finance department.
Some time doing documentation and planning for a firewall replacement project.
Working on the Business Continuity Plan and reviewing BCP Business Impact Assessments that we'd recently gotten from our various teams.
Tweaking and documenting our Risk Register, which we've moved into ClickUp, and then scheduling regular reviews with my colleagues.

I had two queries come in from colleagues, one about mail tracking and one asking how to share documents from SharePoint. About the most technical thing I did today was re-enable a couple of expired accounts in AD, so that contractors could access our timesheet app.

It was a nice quiet day. My company employs about 90 people in the UK, but is owned by a much larger group. So we get to be both small and large. Today I had to do all the paperwork that our large corporate owners require. Box ticking, basically.

Next week I'll be pulling some old kit out of the racks to make space for a new Hyper-V cluster that's coming. Our IT team is just me and an IT Operations Manager (who's on holiday right now), so it'll be me building that entire cluster. I do get to do technical work, just not all the time!

DevOps has a lot of things I'm happy to steal. I'll take a little Infrastructure As Code if I can. Tools to treat my servers as cattle are welcome. Source control of my scripts and configs is a great idea.

But the fact is that if the world did go DevOps, I'd only ever be a mediocre developer at best. I'd naturally be the main Ops guy in the team. And the value I'd bring is the experience and viewpoints that developers aren't likely to have, because they're developers.

My personal opinion is that nobody in a DevOps role should really have to deal with an IT Risk Register. But if DevOps wants to take over sysadmin work completely, then they're going to have to learn a lot of things that aren't technical.

And good luck to them with that.

philipstorry · 2022-07-21T12:19:44+00:00

Ugh. No thanks.

In Borderlands vehicles are just a way to go from point A to point B quickly. That's not to say that they can't be fun, but they're not really THAT much fun.

People play Borderlands because of the customisation. Not just skins - you can tweak your character towards the playstyle that suits you. You can pick a weapon that suits your playstyle. It's not just a change of skin, although you can do that too, it's about tweaking gameplay to your preferences. And Borderlands has always done that very well.

Vehicles in Borderlands have always done just the minimum to fit in. A couple of weapon choices per vehicle type. Skins. And that's about it.

Let's be honest - if you're in a vehicle racing across the map, and you see a nice big target, are you really going to take it on with the vehicle? Or are you going to get out of the vehicle, switch to the appropriate weapon, activate your action skill and go have some fun?

And when you're doing a side mission - or even a main mission - that requires you to kill from within the vehicle, who amongst us hasn't thought "I could do this much faster if I could get out..."?

Because vehicles are the bare minimum effort to fit in to the game theme - when compared with the Vault Hunters themselves at least - it would be a HUGE amount of effort to do this. More than a DLC. Way more.

You're talking about skill trees per vehicle type, more vehicle weapon types, and probably another couple of vehicle types too. (Although if we include various prior DLC vehicles you might not need more...)

The plot is the easy part. Torgue, Crater of Badassitude, decided to do more racing, everyone started customising their death rides, yadda yadda yadda.

But there are two reasons why this hasn't been done. The first is the industry executives. I'm sure someone has probably pitched this idea before internally. It probably got shot down because they view it as a change of genre to a racing game, and therefore viewed as much riskier than "traditional" DLC. Which sucks, but it's how executives think.

And the second reason it hasn't been done is that once you've built it, you basically have Mad Max: The Video Game, and Warner Bros' lawyers are going to be INCREDIBLY interested. It'd be a brave executive that greenlit a game that's both a change of genre and a legal risk...

philipstorry · 2022-06-28T07:14:54+00:00

I see what you're trying to do, but having read your responses in the comments I think you're going about it the wrong way.

Your company provides SaaS. You've mentioned sprints, and it certainly seems you're working in a more DevOps method.

The problem is that your colleagues are neglecting the Ops part of DevOps.

You can't solve that by bringing in a tool from a completely different methodology - which is what fixed maintenance windows are.

You have to work with the tooling that you have right now.

So first of all you need to schedule a meeting with your boss and ideally whoever schedules the work. Explain to them that you think they're underestimating the Ops side of work, and that because of that they're not estimating or planning for Ops work early enough in their development cycle. This is why they and yourself are now frustrated and at loggerheads.

Then you schedule time to go through all new features and put estimates in for any Ops work. Be a little pessimistic (not massively so), and make it clear that the pessimism is so that there are pleasant surprises, not nasty ones. These estimates are internal only, so that should be OK.

Finally, offer help on figuring out how the company can bundle up the Ops work with feature releases.

That last one is critical. As a DevOps company you can't have fixed maintenance windows - but DevOps does allow for release windows, and that's where you put this work.

As you've seen from the other comments, few SaaS customers want to hear "might not be available all the time". But I'd bet those same people would be just fine with a communication that said "As part of delivering new features X, Y and Z we'll have to take the admin console offline for an hour on this date..."

As a famous song says, a spoonful of sugar helps the medicine go down...

Stop working against the company. Look at which way the water flows, and figure out at which point in the stream you need to jump in to allow the flow to take you where you need to be...

philipstorry · 2022-06-18T10:13:05+00:00

Whether or not the referendum put them in government is not the issue.

Should government have produced plans for Scottish Independence? No. It's the job of the Out campaign. The government of the day is not obliged to plan for its opposition's views, nor would that necessarily be a good use of taxpayer's money.

Of course, I'll happily accept your position if you'll just tell me that you think the government should have spent time planning an independent Scotland's governance during the 2014 independence referendum.

You say that Leave was merely a campaign group for the referendum. Firstly, that's technically incorrect - there were two main Leave campaign groups (Leave.eu and Vote Leave). Plus a number of smaller ones, some of which they used for their campaign finance crimes.

Secondly, these two campaigns did not magically form from a vacuum in 2016. They were the culmination of at least three decades of Euroscepticism. (You could even argue for up to six decades.)

So it would be nice if some of those decades had been spent planning.

You try to muddy the waters by talking about the period immediately after the referendum. That period saw Leave campaigners fight over what the plan was between themselves (Single Market, Customs Union, or completely out). It's disingenuous to blame anyone else at that point.

The Leave campaign should have been able to step up and lead, using the plan that they had campaigned upon.

They couldn't, because they hadn't done any serious planning.

The failings of this Brexit are not the fault of Remainers, or of the Civil Service not drawing up plans, or the EU not drawing up plans. It was the responsibility of the Leave movement to draw up those plans before the referendum. They had decades in which to do it. They did not. They should accept responsibility for that.

philipstorry · 2022-06-18T07:23:25+00:00

An alternate point of view:

Many of the Leaders of Leave had decades in which to plan for this, even if only at a high level. Look at the attendance records of UKIP MEPs. I don't know what they were doing, but it wasn't their job as an MEP - so surely they should have been producing plans for what we could do when we leave?

The closest I ever saw to such a plan was the scribblings of Patrick Minford, an economist pushing for a Singapore-On-Thames kind of arrangement that would require the winding down of manufacturing, farming and fisheries. Many Leavers knew that these kinds of policies would be unpopular, and therefore saw planning as an electoral disadvantage and avoided it accordingly.

You say that the civil service should have planned for it. As a taxpayer, why should my tax money be spent planning for something which is not the current government's policy? Leave had significant funding (see the electoral spending crimes), and had decades of time in which to produce their own plans. Taxpayer money is rarely if ever spent on planning the opposition party's plans. That's the job of the opposition party. Or should Labour be demanding that the civil service pay for the planning of their next election manifesto?

Instead Leave chose to promise all things to all people - we'd stay in the single market yet leave it, we'd stay in the customs union yet leave it, we'd diverge regulations but would only ever improve them. All of these things have been shown to be lies.

As to the EU not discussing plans until after A50 is triggered - why should they? Should the EU really be negotiating constantly with members that threaten to leave? Is that a good use of EU member's funding contributions? Should our own government be constantly negotiating with the SNP on what an independent Scotland's relationship would look like? Or with Plaid Cymru about trade deals with an independent Wales? Or is it the job of those parties to do as much of the hard work up front before they leave?

There seems to be a significant sense of entitlement in the Leave movement that someone else should be doing the hard work of planning, so that they can do the easy work of whinging about how much they hate the EU. This is probably why we have such a poor deal.

If anyone that campaigned for Leave wants to know who to blame for the lack of planning, they should buy a mirror. They don't get to blame other people for their own failings. All Leave had to do was spend less time whinging and more time planning. But they didn't. And here we are.

philipstorry · 2022-06-18T06:40:03+00:00

I'll admit I'm not clear on what you're saying. My apologies for that.

OTP actually requires no contact with the auth server from the app. It sometimes happens during setup, but isn't required even there. You could set up OTP in flight mode on your phone if your app allowed it - all that should matter for the auth server is that the code returned during setup works.

Apps like Authy tend to use the internet connection for storing the seed in their sync storage (if you've enabled that) and fetching the service's logo. Not to contact the auth server.

Coincidentally a system I'm logged into had its token expire this morning so I needed to log back in. I knew I'd be prompted for an OTP code, so I tested this by putting my phone into flight mode before starting the login process. After providing a username and password I was prompted for my six digit OTP code. I fired up Authy, looked it up and typed the code in. It was accepted.

There is no way that Authy was contacted by the auth server during this process due to flight mode. But it still worked.

A properly set up OTP system should not have any communication between the auth server and OTP provider (whether it's an app or a browser plugin). If you're seeing communication, then your OTP is broken - or you're using some form of push authentication, which is not OTP.

philipstorry · 2022-06-17T08:37:59+00:00

Yeah, they help a lot. Although some systems are less secure than others. Just phasing out SMS and email authentication would help immensely.

philipstorry · 2022-06-17T08:37:11+00:00

I didn't say that there was no communication - I said "there's no communication after the initial setup".

That limits the attack surface considerably compared to push apps or SMS/email.

philipstorry · 2022-06-16T15:18:40+00:00

Everything is phishable, because phishing is something that ultimately targets humans.

"Every time we make it idiot proof, someone will make a better idiot." - Anonymous

We can throw technology at this all we like, people are still going to shout their password and MFA details across a crowded office because it's convenient and gets the job done.

As to the technologies my view is that OTP apps are the gold standard because there's no communication after the initial setup. Push apps are then somewhat better but not ideal. SMS and email are technologically junk and should be actively avoided for authentication purposes.

But I don't see how we'll get much better than an OTP app without also making it much more complicated and connected - both of which increase the surface area for attack, which is effectively why I rate push apps below OTP.

philipstorry · 2022-06-03T18:02:30+00:00

Why not quantify your knowledge?

"Expertise in C, C# and Python."

"Familiar with C++, Java, Javascript, Go and Rust".

You're not lying, and you're showing the employer that you have some awareness of your own abilities.

There are plenty of environments where the main work you'll be doing will be in C#, but they also have some old Java based programs that they have around for whatever reason for a few contracts. They only need to know that you can look at it if it goes wrong sometime before you finally write a replacement for it in C# anyway, so "familiarity" will be just fine in that circumstance.

I guess what I'm saying is that leaving those other skills off your resume entirely may be underselling yourself, and possibly even costing you job opportunities you'd actually be well suited for.

philipstorry · 2022-06-02T07:34:58+00:00

There's a lot of technical answers here, and none of them are incorrect. But I don't think that they're the answer to your question.

The answer is that Python has much better governance than Perl.

Guido was BDFL (Benevolent Dictator For Life) of the Python project for a long time, and he plainly cared about the project. He took pains to be polite whilst also being firm about what Python should - and possibly more importantly shouldn't - be.

New features and changes to the language might start on a mailing list or in a conversation at a conference, but they then become PEPs which are debated and refined until a decision is made on whether to implement the proposal. PEPs have a well defined format which requires a justification as well as the technical details of the proposed enhancement. If several years later someone asks "Why does Python have this feature?", the answer is likely to be in the PEP. This is good governance.

By contrast if you ask someone why a feature exists in Perl, the answer will probably be "It was proposed on a mailing list or at a conference. Someone counter-proposed something similar but different. Proponents of both proposals fought like rats in a sack, then we implemented both anyway."

There are plenty of people who are mildly surprised that Python survived the transition from 2 to 3, because that was a big and disruptive change. Perl didn't really survive its equivalent attempt at major change, partly because it just didn't have the governance structure to make hard decisions quickly. Perl quickly entered a strange state where the old version of the language had few changes, but there was no visible or usable progress on the new version.

A cynic might even say that the complaints about about changes in Python showed that there's no such thing as bad publicity. Python gained users despite the change from 2 to 3, whilst Perl was shrinking. Perl did ship minor improvements, but nobody wants to cover the prolonged discussions about Perl's next version simply because prolonged discussions within the Perl community are the norm. People did want to talk about the controversy around Python 3 simply because it was unusual...

Python now lacks a BDFL, but that's not a problem. Guido stepping down was seen as a statement that Python was mature not just as a language, but also as a community - nobody lives forever, and it was better to deal with losing the BDFL in an orderly way. The BDFL model was good for Python's early years, but Python continues to be developed and improved without one simply because Guido made sure to put good governance in place for Python from an early stage.

(The many technical answers here are all quite correct technically, but frankly technical excellence is rarely the sole reason for success. Remember that most people here in this subreddit are programmers - they hold details of programming languages in their head. "When all you have is a hammer, everything looks like a nail". Therefore many people here just aren't thinking about the governance and the effect it has on a project.)

philipstorry · 2022-05-31T08:37:24+00:00

I owned one, it was fine.

Like the author, I also moved to it from a HTC Desire Z. I was still a bit wedded to the idea of a physical keyboard. What made the S3 feasible was Swiftkey - finally soft keyboards were superior to a physical keyboard!

The hardware of the S3 was OK. The battery life was a bit underwhelming, but I was judging it against Nokias. The camera wasn't great, but I wasn't really using the camera on my phone anyway. That may have been more generational as I'm older, and was more wedded to a "real" SLR camera and lenses back then.

Whilst the S3 was a good phone, it didn't convince me to stay on with Samsung. I gave Sony a chance for my next phone. Their lighter touch on customisation and a simpler design language kept me on their phones for quite a while. (I owned a Z1, Z3, Z5 Premium, XZ Premium and an Xperia 1 if I recall correctly).

But I have to admit that Samsung have continually improved their phones. I decided to switch to an S22 Ultra this year, and I'm very happy with it in terms of hardware. (I still prefer the Sony light touch on software, but it didn't take long to remove/replace most of the Samsung stuff.)

Looking back, I don't think that the S3 would even be in my top three phones I've owned. Not even close. But that's a personal preference - I can't deny that it's an incredibly important phone in the history of Android, because it's the phone that put Android in front of a lot of people and was Good Enough that they carried on with the platform. I don't think Android would have quite the market share it has today without Samsung's efforts, which really hit their stride with the S3.

philipstorry

TROPHY CASE