loudwhisper

joined 2 years ago
[–] loudwhisper@infosec.pub 8 points 22 hours ago

Ahaha yes, that might be the case, but I started to lose hope if the top of the applicants (out of hundreds of rejected!) all exhibits this behavior. I can't help but feel that now we are looking for people with a mindset and skillset that is simply disappearing in the industry.

And as I said in another post, I perfectly acknowledge that if I stopped reading and investigating stuff on my own, I could absolutely keep my job by just mindlessly administering a few services and rephrasing CIS benchmarks...

[–] loudwhisper@infosec.pub 2 points 22 hours ago (8 children)

This is quite a trite argument from my point of view. Also, this is from the perspective of the business, which I don't particularly care about, and I tend to look from the perspective of the worker.

Additionally, the cloud allows to scale quickly, but the fact that it allows to delegate everything is a myth. It's so much a myth that you see companies running fully on cloud with an army on people in platform teams and additionally you get finops teams, entire teams whose job is optimizing the spend of cloud. Sure, when you start out it's 100% reasonable to use cloud services, but in the medium-long term, it's an incredibly poor investment, because you still need people to administer the cloud plus, you need to pay a huge premium for the services you buy, which your workforce now can't manage or build anymore. This means you still pay people to do work which is not your core business, but now they babysit cloud services instead of the actual infra, and you are paying twice.

Cloud exploded during the times of easy money at no interest, where startups had to build some stuff, IPO and then explode without ever turning a single dollar of profit. It's a model that fits perfect in that context.

[–] loudwhisper@infosec.pub 13 points 22 hours ago

Not when the skillset is essentially outsourced and you are left consuming the product of that skillset.

Understanding is nonnegotiable in security, IMHO.

You can't fail to understand how signature attestation works, if you are implementing it, to make one example I made in the post. Otherwise you end up verifying the signature in the CI (like that person claimed it should be done) and waste the whole effort. You can definitely still outsource the whole infra and scripting to Github, but you still need to understand. The problem is that when you can outsource everything, at some point understanding becomes an extra step.

[–] loudwhisper@infosec.pub 7 points 23 hours ago (8 children)

That's the thing! I think it wouldn't be conceivable that your "principal engineer" (real position for one of the people) doesn't understand the basic theory of the stuff they are implementing. Now it feels you can instead work years and years just shuffling configuration and pressing buttons, leading to "senior" people who didn't gather actual years of experience.

I don't want to pretend I am outside this logic. I am very much part of this problem myself, having started my career 10 years ago. I do despise cloud services though (if anything, they are super boring), so I tend to work with other stuff. But I could 100% just click buttons and parrot standard and keep accruing empty years of experience...

[–] loudwhisper@infosec.pub 3 points 1 month ago

Absolutely, but a much much lower risk than a stab. Since we are reasoning on the morals and not from a purely rhetorical point of view, we can't consider them the same. Also that's why I specifically said "slapping" in my example. Slapping is still physical violence, it's still an attack, but it's an example of something that doesn't warrant a potentially fatal response.

[–] loudwhisper@infosec.pub 4 points 1 month ago* (last edited 1 month ago) (5 children)

Stabbing has always the risk of being fatal. No slur deserves death.

Edit: to expand to that, being motivated and proportional are two principles that I find very moral. I agree that legal and moral are not the same, but in this case I think the law is absolutely aligned with my moral. Stabbing someone for a slap or a slur is completely disproportionate and I would absolutely not consider it justified. Being assaulted and fearing from your life, that is different.

[–] loudwhisper@infosec.pub 6 points 1 month ago (7 children)

Spitting on someone is an assault. Insulting someone is not. The two things are not comparable.

You don't blame the guy for striking her after getting spit in the face?

To be clear, I wouldn't escalate anything in general, if someone cuts in line or whatever, not worth picking a fight for such silly things. But if you spit to someone in their face, getting punched is something that it's well within the realm of things you should expect. From an ethical point of view, I probably wouldn't do either, but in general spitting is what turned this uncivilized event (from both parties) into a fight.

If a guy hits me even once and I knife him in self defense,

Self-defense laws vary a lot across countries. At least where I live, defense has to be motivated and proportional. If someone would slap you - for example - and you stab them, that probably wouldn't count as self-defense. I would personally disagree with you in that context, and probably a judge would too (at least here).

[–] loudwhisper@infosec.pub 2 points 3 months ago

Kubernetes is not really meant primarily for scaling. Even kubernetes clusters require autoscaling groups on nodes to support it, for example, or horizontal pod autoscalers, but they are minor features.

The benefits are pooling computing resources and creating effectively a private cloud. Easy replication of applications in case of hardware failure. Single language to deploy applications, network controls, etc.

[–] loudwhisper@infosec.pub 2 points 3 months ago

Yes if single node, kinda if 2-3 nodes, no for anything above that IMHO.

[–] loudwhisper@infosec.pub 1 points 4 months ago

That takes courage to say, after 90% of your comments have to do with (speculations on) me.

Anyway, good riddance.

[–] loudwhisper@infosec.pub 1 points 4 months ago (2 children)

I specifically quoted the part that I considered bad faith. I am OK with you thinking I am an apologist. I don't consider it bad faith (although I consider it wrong). What was bad faith was purposefully misinterpreting a sentence that was in a clear context so that you could use it for that patronizing statement.

This was a objectively true from my viewpoint

Nothing to say, it just sounds ironic to me. Again, I have no problem with your subjective judgment.

He was simply wrong for this statement.

And I respect your opinion.

that did more harm than good.

Now we ended up in an argument that has to do with result? I have never said that it was a good move. That it benefit the company or anything like that. What argument are you trying to challenge? I am judging the action based on my own morality, not based on whether it benefit him or his company.

You are just learning, and pointing out your own words is not bad faith

Strike two. Go re-read the sentence. I said that I didn't know anything about him before this debacle and that I ended up learning about him whole informing myself about it. For your convenience I will quote my own words:

I actually can't care less about him, and I barely know anything about him. My involvement is very limited to this case, and that is because wanting to understand inevitably forced me to learn certain things and inform myself.

This behavior (patronizing, intentionally misunderstanding other person sentences) for me is clearly a demonstration of bad faith. As usual, your accusation of bad faith did not specify any reason or quoted any part and i challenge you to do that.

Not that it matters to you, but next similar behavior and I will block you and move on.

[–] loudwhisper@infosec.pub 2 points 4 months ago

I agree with you on the principle. In this case I disagree with the premise. Years of actions I think easily out weight that tweet. If that's the only reason to be suspicious, then I don't think it's warranted.

view more: ‹ prev next ›