Absolutely. 100%
But don’t let perfect be the enemy of good. A fix that gets you 40% of the way there is still 40% less work you have to do by hand. Not everything has to be a fix for all situations. There’s no such thing as a panacea.
Comment on CrowdStrike Isn't the Real Problem
magikmw@lemm.ee 1 month agoThis worksbgreat for stationary pcs and local servers, does nothing for public internet connected laptops in hands of users.
The only fix here is staggered and tested updates, and apparently this update bypassed even deffered update settings that crowdstrike themselves put into their software.
The only winning move here was to not use crowdstrike.
LrdThndr@lemmy.world 1 month ago
magikmw@lemm.ee 1 month ago
Sure. At the same time one needs to manage resources.
I was all in on laptop deployment automation. It cut down on a lot of human error issues and having inconsistent configuration popping up all the time.
But it needs constant supervision, even if not constant updates. More systems and solutions lead to neglect if not supplied well. So some “would be good to have” systems just never make the cut, because as overachieving I am, I’m also don’t want to think everything is taken care of when it clearly isn’t.
timewarp@lemmy.world 1 month ago
You were all in, but was the company all in? How many employees? It sounds like you innovated. Let’s say that the company you worked for was spending millions on vendors that promised solutions but rarely delivered. If instead they gave you $400k a year, a $1 million/year budget & 10 employees… I’m guessing you could have managed the laptop deployment automation, along with some other significant projects as well.
Instead though, people with good ideas, even loyal to the company, are competing against sales and marketing reps from billion dollar companies, and upper management are easily swooned.
magikmw@lemm.ee 1 month ago
I’m the only one to swoon here, and I’m as sceptical as one can be.
I’m also a cost and my budget is on paper only. Non-IT management is complicit in crappy IT.
catloaf@lemm.ee 1 month ago
Yeah. I find a base image and post-install config with group policy or Ansible to be far more reliable.
magikmw@lemm.ee 1 month ago
Yea we’re doing something similiar. Only update base images for bigger OS updates or if something breaks or can break.
The general idea is to have config that works for both new PCs and the ones that are already in use. Saves on maintaining two configuration methods.
LrdThndr@lemmy.world 1 month ago
Completely fair, man.
timewarp@lemmy.world 1 month ago
Almost all computers can be set to PXE boot, but work laptops usually even have more advanced remote management capabilities. You ask the employee to reboot the laptop and presto!
magikmw@lemm.ee 1 month ago
I wonder how you’re supposed to get PXE boot to work securely over the internet. And how that helps when affected disk is still encrypted and needs unusual intervention to fix, including admin access to system files.
I’ve been doing this for a while, and I like creative solutions, so I wonder about those issues a lot. Not much comes to my mind besides let’s recall all the laptops and do it one by one.
timewarp@lemmy.world 1 month ago
I wonder how you’re supposed to get PXE boot to work securely over the internet.
PXE boot is more of last resort IMO, but can be uses as a chainloader to a more secure option. The biggest challenge I could see security-wise is having PXE boot being ran on unsecured networks. Even then though, normally a computer will have been provisioned on a secure network and will have encryption and secure boot-based encryption, and some additional signature-based image verification.
wizardbeard@lemmy.dbzer0.com 1 month ago
Hypothectically you could ship a company provided router to handle the vpn connection to your remote users, so you aren’t relying on the OS to be able to boot up to get connected to the company network and PXE environment. Lots of extra cost and mess though.
LrdThndr@lemmy.world 1 month ago
From a home user? Probably ain’t shit-all you can do with PXE booting. But if you have a field office or somewhere a user can go with a hardware vpn appliance? Well now you’re in business.
wizardbeard@lemmy.dbzer0.com 1 month ago
It also assumes that reimaging is always an option.
Yes, every company should have networked storage enforced specifically for issues like this, so no user data would be lost, but there’s often a gap between should and “has been able to find the time and get the required business side buy in to make it happen”.
Also, users constantly find new ways to do non-standard, non-supported things with business critical data.
Bluetreefrog@lemmy.world 1 month ago
Isn’t this just more of what caused the problem in the first place? Namely, centralisation. If you store data locally and you lose a machine, that’s bad but not the end of the world. If you store it centrally and you lose the data, that’s catastrophic. Nassim Taleb nailed this stuff. Keep the downside limited, and the upside unlimited or as he says, “Don’t pick up pennies in front of a steamroller.”