Best posts made by Carnival Boy

Loving the Marvin Gaye reference in the title.

I've never actually used them, but I've been to a couple of seminars by Sec-1 which were awesome. I really liked them. If I was going to do a pentest, I would want to use them. I recommend you go to one of their seminars as they're free and pretty intense and educational, and not salesy at all.

@IRJ said in Pentest - Who would you recommend?:

You definitely don't want a pen test, you need a security assessment. There will be plenty of things to fix, and after securing the network then you could do a pen test the following year.

Same thing. What do you think an assessment will do that a pentester won't (and vice versa)?

@Jimmy9008 said in Pentest - Who would you recommend?:

Or does nowhere offer that?

Of course. I've already recommended one company that offers this.

@scottalanmiller said in The Myth of RDP Insecurity:

I know the site there is this persistent myth that RDP is insecure and that the solution to its insecurity is to wrap it in a VPN. This seems very silly...
Azure itself exposes RDP directly because it is considered extremely secure.

The Azure portal says "RDP port 3389 is exposed to the Internet. This is only recommended for testing. For production environments, we recommend using a VPN or private connection."

I'm struggling to reconcile this statement with your post, unless I'm missing something?

@pchiodo said in MSP or VAR or just avoid:

A true MSP is working for you, in the best interest of your company and the bottom line. They don't care who provides the equipment or the product, just that it is the right fit for your company.

Why should they care that it's right for your company? They care about billable hours. Say you want a database but aren't sure which one. The MSP happens to employ a SQL Server expert on £60k a year. The MSP needs to sell that guy's expertise to make a profit. So they're going to recommend you buy SQL Server, regardless of whether that's the best database for you.

Everyone works for their employer, not their customer. So if you're employed by an MSP, that's where your loyalty lies. It's naive to assume otherwise.

@scottalanmiller said in MSP or VAR or just avoid:

One question... does the company in question sell things?

If yes, VAR.
If not, not a VAR.

That's it. The only question, and the answer is simple.

Define things? A VAR sells products and services, a pure MSP sells only services (ie labour). I don't see a massive destinction between a product (software/hardware) and a service (labour). To me, they are all "things" that you sell.

I now work for a Microsoft partner. We sell consultancy. We also sell Microsoft licences and support, so I suppose you would call my company a VAR, but I don't see it that way since the licencing side of the business is not our primary role. I'd see us more as an MSP or a software house. But I'm not really bothered about the distinction - we sell stuff, primarily labour.

I've tried to give up mapped drives and move away from a traditional file server to OD4B and Sharepoint, but ultimately I prefer the speed and convenience of mapped drives to a local file server, as do 99% of users. I just don't like OD4B/SP.

@scottalanmiller said in GDPR Requiring Centralized Password Management:

@carnival-boy said in GDPR Requiring Centralized Password Management:

@dustinb3403 said in GDPR Requiring Centralized Password Management:

@carnival-boy said in GDPR Requiring Centralized Password Management:

I don't understand what user/password management has to do with GDPR. My understanding of GDPR is that relates to restrictions on personal data held by companies, and rules on reporting data breaches to authorities in a timely manner. Neither of these seem to relate to AD or similar services? AD doesn't even generally hold personal data.

First and Last name of a person is personal data. But so is an email address, birthday, sex, sexual orientation etc.

Don't store sexual orientation in AD. Have processes to remove accounts for ex-employees in a timely manner. Job done.

I don't think anyone actually thinks AD is a problem. The question is just "how much of a requirement is it"?

Sure. I understand. But I think any standard, encrypted credentials management system is GDPR compliant. So Workgroups are fine.

Do you generally only give 2 weeks notice in the US?

Access is included in Business Premium isn't it? They added it in 2016 I believe

There's also Microsoft courses (and others) on the awesome edX:
https://www.edx.org/course?search_query=python

I don't know if these are different to the ones on Microsoft's websites.

I'm planning on learning Python to help my son who is studying it at school (with a useless teacher).

@scottalanmiller said in Comparing Office Suites:

As an MSP, when we talk to customers about their options, costs, and whatever, we find that LibreOffice is the most commonly deployed because once management looks at its features, easy of use, low unnecessary change rate, near zero IT costs (it deploys to every platform via free repos, it's the most broadly available, lowest overhead of any product we've seen) they generally override individual objections to wanting to keep whatever their person and not personally paid for products.

MS Office is super common, and universally hated. Nearly every customer we have with it loathes it and whatever factors are leading them to use it prove to be a weak link in some other product's armor. This is so dramatic that I'm working with a team to make software for whom a major selling point is that it does not use or require MS Office. Most of our customers that use MS Office do so either because it is deeply entrenched from a time before organizational level planning was done and/or the existing files are so entrenched in their workflow that updating would be problematic.

Interesting. I've never come across an organisation that doesn't use Office. And I've never come across one that hates it. Sure, everyone swears at PowerPoint when it doesn't do what they want it to, and years ago I had a few people bemoaning replacing their beloved Lotus 123, but never "hate".

My biggest issue with using anything else would be compatibility, as Word, Excel and PowerPoint files are routinely shared across organisations. How do people deal with that?

Plus, I'm not sure if Teams works with metadata. Which is the kind of thing that frustrates me a bit with Teams - its a front-end for SharePoint, but a hobbled front-end. Meaning you keep having to select "Open in SharePoint" to do anything complicated.

But generally I find the advantages of "going all in" with Microsoft outweigh the disadvantages.

I've also found Teams getting used more and more by companies compared with Zoom. At the start of the pandemic it was all Zoom.

My uncle ran a successful hardware distribution business employing dozens of people for over 30 years. His motivation was to generate work, security, and happiness, for owner and employees. He could have been more profitable, but chose not to.

I'll have to tell him he spent his life devoted to a hobby

But then he was a socialist. Maybe we just think about business differently in Europe? Scott likes to label things, but I'm not sure it makes any difference.

2 monitors, keyboard and mouse at work, and 2 monitors, keyboard and mouse at home. Then just use my laptop wherever I am.

Even with an established software house you're entering in to a very committed relationship. You're relying on one company for modifications, fixes etc for years to come at an unspecified cost.

At least with major ERP systems like Microsoft, Oracle or SAP you have a partner network to work with. So if you fall out with your partner, or they put up their fees unreasonably, or they go out of business, then you can simply move to another partner and carry on. That's much, much harder with bespoke software.

Sure, with typical ERP systems you will have customisations on top, either completely bespoke, or industry specific verticals. But that might only be 20% of the system, with 80% being standard. So moving to another ERP partner means the new partner only has to worry about the 20% of bespoke code, not a completely unknown system that is 100% bespoke.

And the reality is companies are simply not that unique. Many think they are, but the majority of unique business processes are not ones that add value but are a case of "we've always done it like this". Identifying unique processes that add genuine value, whilst standardising other processes, reduces the amount of customisation needed, reduces costs, and actually increases efficiency and business performance.

It's one thing writing a completely bespoke system, but who is going to design this for you? Sitting down a Production Manager (for example) with a blank piece of paper and asking what he wants is a recipe for disaster. Even if they had any idea what they wanted. A Production Manager might roughly know what an MRP routine does, but very few could actually design one from the ground up. It's an extremely complicated algorithm.

I'm no expert but "Ergonomic Keyboard" has always seems a bit gimmicky to me. Is there genuine science behind the designs? There probably is.

I think the most important thing is to use a wrist rest to lift her wrists higher up. If she hasn't got one already, I'd just get one of those initially.

Again, I'm no expert, but I wonder if wrist pain can be caused by general desk posture - does having the right chair at the right height have an impact? Is she taking sufficient breaks. Or is she hunched over in a bad posture typing away for hours at a time?

I dunno, I just wonder if these ergonomic keyboard were designed by health professionals or marketing teams.

But I'm a big fan of gel wrist rests. They're also great for whacking people over the head.