<story><title>Hackers Were Inside Citrix for Five Months</title><url>https://krebsonsecurity.com/2020/02/hackers-were-inside-citrix-for-five-months/</url></story><parent_chain><item><author>PopeDotNinja</author><text>I used to work with a brilliant chip designer who couldn&amp;#x27;t find the start button on a Windows machine.  We all suck at something.  Personally, I think CSS is the devil and should we should nuke it from orbit.</text></item><item><author>BiteCode_dev</author><text>I work with a F500 oil company from time to time.&lt;p&gt;Half of the devs from there that I was in contact with were not capable of:&lt;p&gt;- googling a solution to a problem efficiently. When they hit a wall, they turned to me with an empty look like they were lost.&lt;p&gt;- read an error message to troubleshoot. A stack trace is utter mystery.&lt;p&gt;- use effectively the UI of their laptop. Some can&amp;#x27;t even Ctrl + S to save, they look up the &amp;quot;save&amp;quot; entry in the menu.&lt;p&gt;We are talking about people writing code every day, in several programming languages: fortran, c, c++, java, Python...&lt;p&gt;Because I&amp;#x27;m a freelancer, I don&amp;#x27;t care. I&amp;#x27;m paid extremely well to be very nice to them and solve all their problems.&lt;p&gt;But I&amp;#x27;m very glad I don&amp;#x27;t have to be held responsible for anything those people end up putting in production. And I have no reason to believe it&amp;#x27;s different in their security department.&lt;p&gt;However, and this is a good lesson to all of the geeks like me that think work is about doing the right thing: the output they produce is good enough in our society. Its cost&amp;#x2F;value hits the sweat spot. Business is not about doing things right, it&amp;#x27;s about being profitable.&lt;p&gt;If you have one scandal a year, but it costs you less than making sure you have a secure system, and you are not legally challenged, then you are golden.&lt;p&gt;In fact, the chances to have even one scandal are very low. Actual risks of failure or attack are low. And consequences in case of crisis are low too. People don&amp;#x27;t care that much about privacy, cyber-security, etc. And policy makers won&amp;#x27;t enforce their laws anyway, at least not to any extent that will endanger the company.&lt;p&gt;So if the software allows people to do their job IRL at a reasonable price, under an acceptable deadline, good enough.&lt;p&gt;In fact, David Goodenough is a very funny French meme: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=ho4W5LnFl6s&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=ho4W5LnFl6s&lt;/a&gt;</text></item><item><author>arminiusreturns</author><text>One thing I have learned as a sysadmin who has had the privledge to see the inside of hundreds of companies from medium sized law firms to F500 oil companies:&lt;p&gt;There is a lot more incompetence than you would ever want to believe, and it&amp;#x27;s not always where you think. I&amp;#x27;ve traced most of it to a failure of connection&amp;#x2F;communication between IT departments and C-levels&amp;#x2F;boards. The CTO&amp;#x2F;CIO and the person immediately below them (and the person immediately below them) are the &amp;quot;buck stops here&amp;quot; people for these kinds of issues, but often are either one of two types. 1) Too much MBA, not enough tech. 2) Too much tech, not enough MBA.&lt;p&gt;Both tend to have pretty similar results.</text></item></parent_chain><comment><author>neltnerb</author><text>True, I have a Ph.D. and am very skilled with electronics and embedded programming. If you handed me an iPhone I would have no idea how to read text messages (actual situation).&lt;p&gt;Same with the people I help technically at work. They&amp;#x27;re all brilliant scientists. They get confused by the difference between VGA, DisplayPort, HDMI, and DVI. Or get extremely frustrated when a button on the UI moves.&lt;p&gt;I think software developers don&amp;#x27;t quite understand how big a deal it is to a 70 year old when the button to do something moves. Probably a quarter of my day is often just figuring out how to reconfigure things to their liking or else spend an hour retraining them because of some unnecessary UI change in Windows 10, after which they will still forget and ask for help again.&lt;p&gt;God forbid you break apart an application into multiple programs or have online activation or a license server. I think I hear at least a daily rant about how you can&amp;#x27;t just &lt;i&gt;buy&lt;/i&gt; software anymore and now you can only rent it for a bit.&lt;p&gt;We have versions of software that are 13 years old because the publisher switched from an unlimited permanent license to a per-seat per-year license model. Rarely worth it when the instructors get confused by new software anyway.</text></comment>
<story><title>Hackers Were Inside Citrix for Five Months</title><url>https://krebsonsecurity.com/2020/02/hackers-were-inside-citrix-for-five-months/</url></story><parent_chain><item><author>PopeDotNinja</author><text>I used to work with a brilliant chip designer who couldn&amp;#x27;t find the start button on a Windows machine.  We all suck at something.  Personally, I think CSS is the devil and should we should nuke it from orbit.</text></item><item><author>BiteCode_dev</author><text>I work with a F500 oil company from time to time.&lt;p&gt;Half of the devs from there that I was in contact with were not capable of:&lt;p&gt;- googling a solution to a problem efficiently. When they hit a wall, they turned to me with an empty look like they were lost.&lt;p&gt;- read an error message to troubleshoot. A stack trace is utter mystery.&lt;p&gt;- use effectively the UI of their laptop. Some can&amp;#x27;t even Ctrl + S to save, they look up the &amp;quot;save&amp;quot; entry in the menu.&lt;p&gt;We are talking about people writing code every day, in several programming languages: fortran, c, c++, java, Python...&lt;p&gt;Because I&amp;#x27;m a freelancer, I don&amp;#x27;t care. I&amp;#x27;m paid extremely well to be very nice to them and solve all their problems.&lt;p&gt;But I&amp;#x27;m very glad I don&amp;#x27;t have to be held responsible for anything those people end up putting in production. And I have no reason to believe it&amp;#x27;s different in their security department.&lt;p&gt;However, and this is a good lesson to all of the geeks like me that think work is about doing the right thing: the output they produce is good enough in our society. Its cost&amp;#x2F;value hits the sweat spot. Business is not about doing things right, it&amp;#x27;s about being profitable.&lt;p&gt;If you have one scandal a year, but it costs you less than making sure you have a secure system, and you are not legally challenged, then you are golden.&lt;p&gt;In fact, the chances to have even one scandal are very low. Actual risks of failure or attack are low. And consequences in case of crisis are low too. People don&amp;#x27;t care that much about privacy, cyber-security, etc. And policy makers won&amp;#x27;t enforce their laws anyway, at least not to any extent that will endanger the company.&lt;p&gt;So if the software allows people to do their job IRL at a reasonable price, under an acceptable deadline, good enough.&lt;p&gt;In fact, David Goodenough is a very funny French meme: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=ho4W5LnFl6s&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=ho4W5LnFl6s&lt;/a&gt;</text></item><item><author>arminiusreturns</author><text>One thing I have learned as a sysadmin who has had the privledge to see the inside of hundreds of companies from medium sized law firms to F500 oil companies:&lt;p&gt;There is a lot more incompetence than you would ever want to believe, and it&amp;#x27;s not always where you think. I&amp;#x27;ve traced most of it to a failure of connection&amp;#x2F;communication between IT departments and C-levels&amp;#x2F;boards. The CTO&amp;#x2F;CIO and the person immediately below them (and the person immediately below them) are the &amp;quot;buck stops here&amp;quot; people for these kinds of issues, but often are either one of two types. 1) Too much MBA, not enough tech. 2) Too much tech, not enough MBA.&lt;p&gt;Both tend to have pretty similar results.</text></item></parent_chain><comment><author>Vesuvium</author><text>Let&amp;#x27;s start a css-less tech trend, shall we? :)</text></comment>