Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
TehRedWheelbarrow
Mar 16, 2011



Fan of Britches
as a person who does corporate IT/ERP/CRM things for a large amount of manufacturing facilities, GTFO and take as much work as is legally allowable with you. they have no idea of your sorcery they just assume everything just works and will continue to forever when you know that just isnt so. get out and yeah charge gently caress you rates after you are out if you decide to even deal with their poo poo.

Adbot
ADBOT LOVES YOU

peanut
Sep 9, 2007


Charge high and set a fixed term to your services, like 6 weeks, not "until a suitable replacement is found and trained."

Juicy side gig is nice but long promises are exhausting. If it was me, I'd sell the code and charge hourly for 1-2 weeks of training your replacement.

Hyrax Attack!
Jan 13, 2009

We demand to be taken seriously

Never mind

Hyrax Attack! fucked around with this message at 03:06 on Feb 16, 2024

TehRedWheelbarrow
Mar 16, 2011



Fan of Britches
no is a complete sentance.

i know its also a luxury but more people need to start weilding it.

zedprime
Jun 9, 2007

yospos
If you're not otherwise dependent on owning your own IP, arguing about it on your way out is going to be exhausting if not leave you with a bad reputation in exchange for owning something you'll never use again.

Meanwhile change management is not instant and if they already have a line item in the budget for consultants they will probably still retain you until your replacement understands the arcane hieroglyphs you dump on someone's desk at the end of the month.

I would just document whatever I have time for and never think about them again but I'm not exactly in a financial situation to need to hustle. And full disclaimer I consult on contracts where I don't own the IP so document whatever I can before the end date is my normal SOP.

mllaneza
Apr 28, 2007

Veteran, Bermuda Triangle Expeditionary Force, 1993-1952




TehRedWheelbarrow posted:

no is a complete sentance.

i know its also a luxury but more people need to start weilding it.

I've occasionally been able to use it as a complete paragraph! The last time I did it was followed by a paragraph starting with "$EMPLOYER considers this an internal issue for $VENDOR." The vendor went and unfucked themselves after that.

Coasterphreak
May 29, 2007
I like cookies.
I love telling people no. Customers, bosses, coworkers, vendors, it’s literally my favorite word (besides gently caress off, but that’s two words and people get butthurt when you use them)

bee
Dec 17, 2008


Do you often sing or whistle just for fun?

Coasterphreak posted:

I love telling people no. Customers, bosses, coworkers, vendors, it’s literally my favorite word (besides gently caress off, but that’s two words and people get butthurt when you use them)

This but especially for people who want my help but have treated me with rudeness, condescension or aggression.

TehRedWheelbarrow
Mar 16, 2011



Fan of Britches
oh those folks deserve full on theatrical no

performative if possible with an audience.

Cthulu Carl
Apr 16, 2006

TehRedWheelbarrow posted:

oh those folks deserve full on theatrical no

performative if possible with an audience.

That type of person, I've found it's more satisfying to tell them no in the simplest terms, but repeatedly as they keep asking questions related to why you're telling them no until they go to your manager, smugly give him screenshots of the conversation expecting vindication, only for you manager to say "No fuckin' poo poo, I would have told you the same fuckin' thing."

History Comes Inside!
Nov 20, 2004




We had an email issue a few weeks ago so I had to have a bunch of teams conversations with people about their issues.

Some dipshit just tried “I never got a reply about this issue and now it’s 3 weeks later and everything is all hosed up, why didn’t you help me?” while cc’ing my boss and their boss.

Gonna send back a whole wall of teams screenshots and ruin their morning.

peanut
Sep 9, 2007


Client: Good afternoon, do you translate official documents? like bank certificate etc.?

Peanut: Good morning and thank you for your message. Yes, I have experience with documents from banks, hospitals, and city hall. Can you send me a photo of your document so I can estimate the difficulty and time required?

Client: Good afternoon. as of now i don't have the documents yet. maybe next week i’ll send it to you once i get it. i want it to be translated from Japanese to English. may i ask if how much does it cost? Thank you very much

Peanut: In order to give you a quote, I need to see the content and length of the document(s).

------------------------
...let's see if she actually gets the document and sends a legible photo before I go on my business trip in 2 weeks!

Cyrano4747
Sep 25, 2006

Yes, I know I'm old, get off my fucking lawn so I can yell at these clouds.

Cyrano4747 posted:

This was the dumb poo poo my work did this week.

Right after the holidays I got an email from the correct IT@company address with all the correct formatting and links that apparently pointed to the correct URLs for IT's ticket stuff in our internal system. It was addressed directly to me, using the specific version of my first name that I go by day to day rather than the full version in my email (so, something like Matt instead of Matthew).

Subject was something about my new laptop being ready.

I am scheduled for a new laptop. My boss has been talking about this for a while, because I do some meeting poo poo where my current ancient laptop has been a real detriment. I was told at the end of the year to expect someone from IT to reach out to me to get the ball rolling right after New Years.

But surprise this was a phishing test! The link I clicked apparently had a cleverly hidden redirect inside it. I dunno, I didn't care to sleuth that much. All I can say is that it looked like our normal internal IT communications and passed most of the obvious phishing bullshit.

So now I had to take time out of my post-holiday deck clearing to take mandatory anti-phishing training that took a goddamned hour.

Congrats guys! You got me!

You have also just trained me to mark all correspondence from IT@company as phishing! Surely this won't be a problem in the future!

Holy poo poo the dumb assholes did it again.

I got an email from IT@company - let me reiterate from the above, the actual correct address - with a subject line about guidelines and rules for company phones. Skimming the body it was the usual basic poo poo - don't use it for personal business, phone numbers can be spoofed so if you get a call from a number you recognize but it seems odd hang up and call back, just loving ignore texts from weird numbers, and a link to hit up the official policies that if you hovered it showed an OK looking phone-policies.company.biz.

AH HA! I thought. I'm just a lowly contractor so I don't have a company phone! Checkmate IT nerds, I'm going to passive-aggressively report this as a phishing attempt!

Click the report button. . . . "Congrats! You have successfully identified a simulated phishing attempt!"

:negative:

Holy poo poo I have to assume all communications from IT are phishing attempts now. Good job guys. :bravo:

I really wish I'd approached it more carefully so I could really pick apart the email. I have to assume there was some fuckery going on with the email headers or whatnot if you really dug in and examined it, but who the gently caress knows with these guys. Of course once it was reported it auto-deleted and I can't recover it to see what, exactly, was going on and what nefarious tell they're expecting me to have picked up on.

Cyrano4747 fucked around with this message at 14:43 on Feb 16, 2024

Space Kablooey
May 6, 2009


Next IT email you could send it as an attachment for yourself, mark the original as phishing and then pick the attachment apart.

blatman
May 10, 2009

14 inc dont mez


awhile back we got a sitewide email from a new contractor nobody's heard of that was just a jpg with a QR code inviting us to do a survey and possibly win amazon gift cards, enough people reported it as phishing that we all had to do phishing training so it wouldn't happen again???

Barudak
May 7, 2007

blatman posted:

awhile back we got a sitewide email from a new contractor nobody's heard of that was just a jpg with a QR code inviting us to do a survey and possibly win amazon gift cards, enough people reported it as phishing that we all had to do phishing training so it wouldn't happen again???

Ok thats incredible.

wash bucket
Feb 21, 2006

blatman posted:

awhile back we got a sitewide email from a new contractor nobody's heard of that was just a jpg with a QR code inviting us to do a survey and possibly win amazon gift cards, enough people reported it as phishing that we all had to do phishing training so it wouldn't happen again???

Wait, they weren’t supposed to report that? They want to discourage reporting suspicious emails???

Nybble
Jun 28, 2008

praise chuck, raise heck
Can’t get phished if you just dump all email into the trash

Cthulu Carl
Apr 16, 2006

Just spent most of my morning working with about three different people and bouncing between two computers because uh... Turns out our antivirus likes to run off and refuse to come back unless it's fully uninstalled and reinstalled?

Cyrano4747
Sep 25, 2006

Yes, I know I'm old, get off my fucking lawn so I can yell at these clouds.

Barudak posted:

Ok thats incredible.

Barudak over here taking notes on how to decrease productivity.

Serious_Cyclone
Oct 25, 2017

I appreciate your patience, this is a tricky maneuver
At my last job they sent out our cyber awareness training module through an email from a vendor I had never seen before requesting that I click through on a link and provide my personal information to get started. I flagged it as a phishing attempt and sent it to security and they came back a few hours later and said "no, that's real, please follow the instructions and complete the module by [date]". I wanted to tell them that I would have to break essentially every cyber awareness rule that is in the training module in order to access it, but I figured it wouldn't do any good.

pumped up for school
Nov 24, 2010

Serious_Cyclone posted:

At my last job they sent out our cyber awareness training module through an email from a vendor I had never seen before requesting that I click through on a link and provide my personal information to get started. I flagged it as a phishing attempt and sent it to security and they came back a few hours later and said "no, that's real, please follow the instructions and complete the module by [date]". I wanted to tell them that I would have to break essentially every cyber awareness rule that is in the training module in order to access it, but I figured it wouldn't do any good.

Thats how ours was set up. I flagged everything. The IT report that went to my boss said I was non-compliant. I don't get the emails anymore, success!

Cyrano4747
Sep 25, 2006

Yes, I know I'm old, get off my fucking lawn so I can yell at these clouds.

pumped up for school posted:

Thats how ours was set up. I flagged everything. The IT report that went to my boss said I was non-compliant. I don't get the emails anymore, success!

This sounds like a perverse way of essentially testing out of the training.

TehRedWheelbarrow
Mar 16, 2011



Fan of Britches
your security IT teams sound loving terrible. we send out fake rear end emails occasionally but they are very tailored and loving never from internal addresses that arent obviously fake as all hell if they looked at it.

Serious_Cyclone
Oct 25, 2017

I appreciate your patience, this is a tricky maneuver

Cyrano4747 posted:

This sounds like a perverse way of essentially testing out of the training.

It's the Kobayashi MarURL

zedprime
Jun 9, 2007

yospos

TehRedWheelbarrow posted:

your security IT teams sound loving terrible. we send out fake rear end emails occasionally but they are very tailored and loving never from internal addresses that arent obviously fake as all hell if they looked at it.
It's incredibly unlikely to get phishing from a credentialed email but it's possible at any given moment to use some exchange hack that IT was 5 minutes late patching to get phishing or worms sent out. So the IT directors setting policy that phishing training should look exactly like a normal IT email but with bad payloads to identify are technically right and every IT professional knows technically right is the best type of right.

TehRedWheelbarrow
Mar 16, 2011



Fan of Britches
sounds like everyone getting these hates the IT department and doesnt trust them anymore so id say thats kind of a loving fail

bitterandtwisted
Sep 4, 2006




Cyrano4747 posted:

Holy poo poo the dumb assholes did it again.

I got an email from IT@company - let me reiterate from the above, the actual correct address - with a subject line about guidelines and rules for company phones. Skimming the body it was the usual basic poo poo - don't use it for personal business, phone numbers can be spoofed so if you get a call from a number you recognize but it seems odd hang up and call back, just loving ignore texts from weird numbers, and a link to hit up the official policies that if you hovered it showed an OK looking phone-policies.company.biz.

AH HA! I thought. I'm just a lowly contractor so I don't have a company phone! Checkmate IT nerds, I'm going to passive-aggressively report this as a phishing attempt!

Click the report button. . . . "Congrats! You have successfully identified a simulated phishing attempt!"

:negative:

Holy poo poo I have to assume all communications from IT are phishing attempts now. Good job guys. :bravo:

I really wish I'd approached it more carefully so I could really pick apart the email. I have to assume there was some fuckery going on with the email headers or whatnot if you really dug in and examined it, but who the gently caress knows with these guys. Of course once it was reported it auto-deleted and I can't recover it to see what, exactly, was going on and what nefarious tell they're expecting me to have picked up on.

That's nuts.
We do the same tests but always for domains that are obviously fake if you look at them. Thinking about all the time and effort I've put into securing our email domains against impersonation and then purposefully training our users that they can't trust our poo poo at all :psyduck:

DeeplyConcerned
Apr 29, 2008

I can fit 3 whole bud light cans now, ask me how!
I don't know poo poo about emails but is it possible to make the sleuthing process take all day? Like, sorry boss I was tracing VPN subnets all day to try and figure out whether RE: Nigerian prince scam was a phishing attempt.

TehRedWheelbarrow
Mar 16, 2011



Fan of Britches

bitterandtwisted posted:

That's nuts.
We do the same tests but always for domains that are obviously fake if you look at them. Thinking about all the time and effort I've put into securing our email domains against impersonation and then purposefully training our users to you can't trust our poo poo at all :psyduck:

said better than i. honestly i want you folks to come to the IT departments with poo poo you think looks weird, users are legit the first line of defense and help us immensely. mass punishment because joe click a link did his thing doesnt reinforce that.

Pyrtanis
Jun 30, 2007

The ghosts of our glories are gray-bearded guides
Fun Shoe

Serious_Cyclone posted:

It's the Kobayashi MarURL

this is a fantastic username idea

withoutclass
Nov 6, 2007

Resist the siren call of rhinocerosness

College Slice
I know multiple people that have been phished by emails coming from legitimate accounts that have been compromised or using email spoofing to appear like the email came from their CEO/boss whatever. It's not really outlandish IMO.

Cyrano4747
Sep 25, 2006

Yes, I know I'm old, get off my fucking lawn so I can yell at these clouds.

withoutclass posted:

I know multiple people that have been phished by emails coming from legitimate accounts that have been compromised or using email spoofing to appear like the email came from their CEO/boss whatever. It's not really outlandish IMO.

Sure, and if your phishing test is a spoofed email from CEO@company.biz asking you to click this link and enter all your PII and sensitive business information then OK, good game.

But having it come from IT@company - an address you use to communicate IT poo poo that you want everyone to know - is going to cause larger problems in the future. If that account gets compromised I suspect they have larger problems.

zedprime
Jun 9, 2007

yospos
Big company buttoned up IT mailings are like bank emails. They do not contain any links and tell you to visit XYZ intranet app for action or more info because an exchange server is a miserable pile of exploits and links can and should be ignored.

Cyrano4747
Sep 25, 2006

Yes, I know I'm old, get off my fucking lawn so I can yell at these clouds.

zedprime posted:

Big company buttoned up IT mailings are like bank emails. They do not contain any links and tell you to visit XYZ intranet app for action or more info because an exchange server is a miserable pile of exploits and links can and should be ignored.

I mean, maybe yours don't Mr. "I have competent corporate IT" humblebragger.

Cheesus
Oct 17, 2002

Let us retract the foreskin of ignorance and apply the wirebrush of enlightenment.
Yam Slacker
Seconding zedprime that a competent IT department will send out emails like "Log into the intranet and look for new notifications for Thing You Need to Do" and not include links.

Salami Surgeon
Jan 21, 2001

Don't close. Don't close.


Nap Ghost
My IT department will send out a legitimate email containing links only if that email is made to look like the very suspicious phishing tests that they also send out.

Freaquency
May 10, 2007

"Yes I can hear you, I don't have ear cancer!"

The problem is that a lot IT people have approximately zero soft skills so they check off “did security training” on the todo list and don’t care about what impact that may have with their relationship with the their users. Also most of us have outright antagonistic relationships with the rest of the staff to begin with (not me though, the people I work with are cool and good and definitely love me). We use one of the big names for phish training, and a guy I knew was showing off how one campaign this company offers lets you send out an email as HR telling the user that they’re getting a raise or extra PTO or something, click here to activate it or whatever. Dude was cackling over how mean it was and how anyone who clicked it was an idiot, which is a) hosed, and b) counterproductive, because now the people that got targeted by that aren’t going to learn “hey don’t click this” but instead “hey my IT admin is a loser piece of poo poo”. You test on the easy inoffensive stuff and coach on the harder and touchier stuff. If you’re mad that the people you’re there to support are bringing you things to do support on then you’re in the wrong line of work.

TehRedWheelbarrow posted:

said better than i. honestly i want you folks to come to the IT departments with poo poo you think looks weird, users are legit the first line of defense and help us immensely. mass punishment because joe click a link did his thing doesnt reinforce that.

Yea, it takes me ten seconds of looking at an email to determine if it’s fake or not, but can take days or weeks to clean up the mess if someone makes a mistake. I want people to bring things to me because being proactive is so much easier than being reactive, and I’m sorry that so many of you have IT departments that are so spiteful.

withak
Jan 15, 2003


Fun Shoe
My company was mad that people weren’t acting on some necessary stuff that was being emailed out, then it turned out that it was because a lot of people had noreply@salesforce.com blocked, which apparently is used to send some required stuff in addition to a lot of useless stuff that annoys people enough for them to figure out how to block an email address.

Adbot
ADBOT LOVES YOU

TehRedWheelbarrow
Mar 16, 2011



Fan of Britches
IT folks with soft skills are a rarity and i think they are great. I just interviewed a charming dude who i would totally grab if the local division doesnt.

Freaquency posted:

showing off how one campaign this company offers lets you send out an email as HR telling the user that they’re getting a raise or extra PTO or something, click here to activate it or whatever. Dude was cackling over how mean it was and how anyone who clicked it was an idiot, which is a) hosed, and b) counterproductive, because now the people that got targeted by that aren’t going to learn “hey don’t click this” but instead “hey my IT admin is a loser piece of poo poo”.

fire that rear end in a top hat. he is actively creating a security problem just prove LOL USER DUMB.

yeah some are, job is to educate and always have time for poo poo, id rather 20 false positives than one real one big loving deal oh god gotta talk to people instead of whatever you are doing big deal its a customer service job, and your customers are your colleagues.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply