• 0 Posts
  • 10 Comments
Joined 1 year ago
cake
Cake day: August 5th, 2023

help-circle
  • Our system wasn’t quite as critical, thankfully, but the app owners failing to respond to “Hey, by the way, your service account for your data base is gonna be closed” is just gross negligence. My condolences that you had to take the brunt of their scrambling to cover their asses.

    For all the complaints I may have about certain processes and keeping certain stakeholders in the loop about changing the SQL Views they depend on, at least I acknowledge that plenty of people did heed the announcement and make the switch. It’s just that the “Oops, that mail must have drowned in my pile of IDGAF what our sysadmins are writing about again. Can’t you just give me the new password again, pretty please?” are far more visible.


  • We had that some time ago with a service account for a specific system where individual personal accounts weren’t (yet) feasible. The credentials were supposed to be treated with confidence and not shared without the admins’ approval. Yeah, you can guess how that went.

    When the time came to migrate access to the system to a different solution using personal accounts, it was announced that the service account password would be changed and henceforth kept under strict control by the sysadmin, who would remotely enter it where it was needed but never hand it out in clear text. That announcement was sent to all the authorised credential holders with the instruction to pass it on if anyone else had been given access, and repeated shortly before the change.

    The change was even delayed for some sensitive reasons, but eventually went through. Naturally, everyone was prepared, had gone through the steps to request the new access and all was well. Nobody called to complain about things breaking, no error tickets were submitted to entirely unrelated units that had to dig around to find out who was actually responsible, and all lived happily ever after. In particular, the writer of this post was blissfully left alone and not involuntarily crowned the main point of contact by any upset users passing their name on to other people the writer had never even seen the name of.



  • I can’t comment on the general trend, but this specific one seems a bit too circumstantial to be of use for a serious spying effort. You’d have to have the spyware running parallel to the apps usong passwords you want to steal in a specific way.

    The risk exists, which is bad enough for stochastic reasons (eventually, someone will get lucky and manage to grab something sensitive, and since the potential damage from that is incalculable, the impact axis alone drives this into firm "you need to get that fix out asap), but probably irrelevant in terms of consistency, which would be what you’d need to actually monitor anyone.

    If you manage to grab enough info to crack some financial access data, you can steal money. If you can take over some legit online account or obtain some email-password combo, you can sell it. But if you want to monitor what people are doing in otherwise private systems, you need some way to either check on demand or log their actions and periodically send them to your server.

    It would be far more reliable to have injection backdoors to allow you access by virtue of forcing a credential check to come up valid than to hope for the lucky grab of credentials the user might change at an arbitrary moment in time.



  • On the contrary, I am quite ideologically sympathetic. I’ve always used Open / LibreOffice, I no longer use windows, never had a Mac or iPhone or anything, I argued with stakeholders for making our university project FOSS rather than proprietary, the list goes on. I’ve spent enough time arguing with people why they should care about FOSS.

    I’m just also aware of my biases, and of the fact that most people are heavily biased by their UX. Most people don’t want to spend a long time thinking to understand, they simply want to use. And in that respect, bad==proprietary doesn’t universally hold up. Big companies can spend big bucks on user research, on figuring out what does and doesn’t work for their target audience, on developing features that appeal to people. They also can spend big bucks on marketing and cultivating a brand image so that people start to identify with their products, deepening the attachment.

    There is also an unfortunate side effect of FOSS when it comes to setting technical standards: If everyone can make their own, plenty of people will do that. Sure, many things have since been standardised, but how often has a common standard evolved as a side effect of some big corporation(s) adopting or outright developing it?

    I don’t need to preach to you about all the ways this sucks. The unfortunate pragmatic truth is that proprietary software is a poisoned, but quite appealing apple. The most common answer I got about FOSS is “yeah, it sounds great, but I don’t care, I just want something that works for me.”

    Even if their proprietary system of choice got so bad to use that they’d switch to an open one, that doesn’t mean they’d embrace the ideology. It just means that specific system does what they need it to. If iOS becomes unbearable, they may switch to Android, or perhaps to Windows phones, but they’re still gonna install and use apps that feel good to use, regardless of whether they’re FOSS.

    The fight against proprietary software isn’t going to be won on ideological grounds. I feel like some developers and advocates of FOSS miss that fact. If you want to be solid competition, worry about being a viable alternative first. Once people start to use a system that allows them to customise more, they may get intrigued by that liberty and become susceptible to the ideology behind, but unless they enjoy using it already, they’ll never engage with it deeply enough.



  • but but but but you’d get something good for it! You would never have missed it, but maybe you just didn’t know you wanted it? Come on, I’m sure consuming shit that will make you happy twice for two minutes each (once when clicking buy, once when getting and opening the package) will fill that hole in your soul! Spending money on stuff you don’t actually need is good!

    (That was sarcasm, if it wasn’t clear enough.)


  • I’m aware why iOS is bad, thank you. I still don’t wish restrictions on its users. That’s just not a nice thing to do.

    There’s also the argument of lasting improvement: If people switch to other systems, I’d rather see them do it out of a positive motivation (i.e. “this is better”) than a negative one (i.e. “the other one so bad I had to finally jump ship and find a different solution”).

    That motivation will bias your mindset, and a positive mindset will lead to a better user experience. If they just switch because it’s not as bad as the other, that will taint their experience. They’ll be inclined to think about what they miss, rather than what the other offers.

    Example: Me, trying to wrap my head around the communities thing here after leaving reddit. I miss the relative simplicity of finding topical subreddits, which is harder here both because there’s less traffic overall, and because I had a sizeable collection of subs there that I can’t simply migrate here. Part of me wants to return to the familiar hell, even if I rationally understand why it’s shit, and I feel that sours my experience with Lemmy so far.

    Humans tend to prefer the familiar, so if they leave iOS for something better, I want that better thing to land as well as possible, to encourage getting familiar with the new environment and expand their horizons, and to make future leaps in other areas less scary and off-putting.