• 10 Posts
  • 1.5K Comments
Joined 3 年前
cake
Cake day: 2023年6月7日

help-circle
  • Like most complex things, the answer is: it depends.
    In this case, it’s mostly about what the alleged crime is and what the role is. If someone was convicted of sexual assault of a minor and I’m hiring for a daycare, possible licensing issues and laws aside, I’d probably pass on that person. If I’m hiring an auto mechanic and the person was convicted of smoking weed, I’m only going to care that they aren’t operating heavy equipment while intoxicated.

    The other thing to consider is how much time has passed since the conviction. To use a real, related example, I knew a guy who held a US Government TS/SCI clearance and who had been through a full scope polygraph. For those unfamiliar, this basically means that he had access to highly classified material and he had also been through a multi-hour polygraph. And despite the dubious nature of those, they often winnow out a lot of people. He was also a major drug user in the 1970s and '80s. The list of drugs he didn’t do was probably short than the ones he had done. But, between being honest about it and the amount of time which had passed since he got clean, he had no trouble getting and maintaining that clearance. Who you were then and who you are now can be pretty radically different.

    Like any hiring process, it’s going to be a case by case basis. I’m actually involved in interviewing people for my current employer and the selection process hinges on many little things. You can have someone who is great on paper, but they have the personality of a raging walrus and that just kills their chances. You can also have folks who just have an off day, but it kills trust in that individual on the part of the interviewers. Hell, I’ve interviewed folks and immediately thought, “they don’t fit this role, but goddamn I wish they had applied when we were looking for this other role six months ago.” Interviewing people is weird, but I haven’t seen a better solution for selecting a candidate for many roles.





  • This is a bit over-wrought. The important question this article doesn’t deal with is: what are those FTP servers hosting? If it’s anything which should be secured, that is a problem. But, if all it is, is a public file repository, then the extra complexity of SFTP or FTPS probably isn’t worth the trouble. My current company has an FTP server which is exactly this. It hosts product documentation and is meant to be public. While they probably should have moved on and just dumped all of it in an S3 bucket with public read, the FTP server is what our customers know and have used for decades. If it ain’t broke and the security isn’t a problem, it’s not really a priority.






  • That does seem like bad design. If it’s causing you and your team an inordinate amount of time to constantly re-login, you may want to go up your management chain and try to quantify it. e.g. in an 8 hour day, you would expect to re-login around 24 times in the day. If that takes an average of 2 minutes per login that 48 minutes per day. Across 260 days (assuming a standard work year), that’s 12,480 minutes per year or 208 hours. Multiply that by the rate it costs to keep you employed. This includes both your pay and all the costs of employment, the common rule of thumb is to multiply your hourly rate by 2. So, if you’re paid ~$50/hr then it costs ~$100/hr to keep you employed. So, 208 hours of your time is costing the company ~$20,800/yr of lost productivity. That’s a significant amount of lost productivity and that is only accounting for 2 minutes per login and not the lost time as you deal with mental context switching. It’s not a cheap cost and is not increasing security by all that much.


  • Is the expiration every 20 minutes, no matter what; or, is the expiration after 20 minutes of inactivity? The two have different answers. The former sounds like a misconfiguration and you may want to reach out to your IT team and ask them about it, sometimes mistakes are made and it could just be you having a strange problem. The latter is pretty common and does serve a purpose. Inactivity timers deal with the issue of people logging in, and then walking away from their system. This is common enough that solutions like inactivity timers are used. There are cases where this is a problem and they need to be disabled, but those will usually be policy exceptions and will need to be requested and documented.

    If you’re getting logged out of your system every 20 minutes, that really sounds like a bug and not a security feature. Get in touch with your IT and/or security team about it.


  • Microsoft’s partner portal website mysteriously said his account had been deactivated, without specifying why.

    My money is on Microsoft’s AI based detections causing false positives again. I spend way too much time chasing ghosts from Defender. Their machine learning based signatures are especially egregious. You get an alert with a name like “Win32/Wacatac.b!ml”. That last “ml” bit denotes that it’s machine learning based. And then you get fuck all to help you determine why the alert fired. Sure, it might actually be a trojan. More likely, it’s a false positive. But who knows, because Microsoft won’t provide enough information to perform a reasonable analysis of the binary.

    And MS has been pushing CoPilot hard. It’s in everything and it’s happy to slop up answers for you. The accuracy of those answers though can be a bit spotty. I’d certainly never turn it loose on tools which can have business impact. But, I doubt Microsoft has any such reservations about letting CoPilot slop all over third party devs.








  • The real miracle in the Bible is that Joseph didn’t fuck for his entire marriage and was ok with that.

    According to Christian mythology Jesus has several brothers and sisters from Mary and Joseph. So no miracle there. One just has to wonder if they waited until after Jesus was born to start fucking.


  • He was one of the early authors of the Christian church and is the author of several books of the official Christian mythology. In the Christian Bible, the letters to the Romans, Corinthians, Galatians, Thessalonians and Philippians are all believed to have been written by him. There are several other books (also letters to various congregations) which are attributed to him, but there is some debate about the actual authorship.

    So, he’s kinda the OG Paul when it comes to Christian mythology.