Fighting the automation paradox || Deployment θα κάνουμε φωνάζοντας "αέρα"
Dear (billable by the hour) consultant-
You are brought in to help us find a solution. You are not to bring the one solution that you know and try to fit us in there. You are to find a solution that fits the client, not a client that fits the solution. So next time please present at least two different solutions (see here why), otherwise we are going to bill you for our time instead.
[ Inspired by discussions with colleagues from both the private and public sector ]
Δεν έχω συχνά την τύχη να βρίσκομαι μαζί με αρκετό κόσμο που δουλεύει με τον Exchange. Όταν όμως συμβαίνει αυτό, πάντα φεύγω έχοντας μάθει κάτι παραπάνω, όπως π.χ. την ύπαρξη των παρακάτω “ποστμαστερικών” blog που αφορούν κυρίως το συγκεκριμένο εργαλείο:
From time to time I observe the following email setups, from web hosting providers mostly:
$ host -t mx example.com example.com mail is handled by 5 mail.example.com. $ host mail.example.com mail.example.com is an alias for www.example.com. www.example.com has address 192.0.2.2
In other words this is a single server that provides web and mail services, The devil is in the details though: mail.example.com is an alias for http://www.example.com. This is a mistake as when something is declared as a CNAME, it cannot have other resource records bound with it. I copy from DNS for Rocket Scientists:
CNAME RRs cannot have any other RRs with the same name, for example, a TXT – well that was true until DNSSEC came along and in this case RRSIG, NSEC and certain KEY RRs can now occupy the same name.
So the above setup is wrong. The correct setup would be the following:
$ host -t mx example.com example.com mail is handled by 5 mail.example.com. $ host mail.example.com mail.example.com has address 192.0.2.2 $ host www.example.com www.example.com is an alias for mail.example.com. mail.example.com has address 192.0.2.2
That is if you want to use a CNAME at all. Personally I am using A RRs instead of CNAMEs whenever possible. But why cannot a CNAME carry any other information? I copy from RFC1034 (section 3.6.2):
A CNAME RR identifies its owner name as an alias, and specifies the corresponding canonical name in the RDATA section of the RR. If a CNAME RR is present at a node, no other data should be present; this ensures that the data for a canonical name and its aliases cannot be different. This rule also insures that a cached CNAME can be used without checking with an authoritative server for other RR types.
So please people, correct your defaults. Your clients will benefit from that.
A poster over at ServerFault complained about the attitude some sysadmins show towards their users, even when the task seems simple and can take as little as 30 minutes maximum. Many users share similar concerns / complaints:
“Every time I ask a simple request like [simple request], these guys act like i’m asking them to build the great wall of china overnight. I’ve had to do this myself many times, it takes under 30 minutes, and maybe 30 seconds of user interaction.”
Or so the poster thinks. There are enough answers that show why comparing stuff you do on a single system are not to be compared with stuff you do when inserting a new system into an already working web of systems with provisioning and established procedures in place. But even when it is only a matter of 30 minutes, it is also a matter of when these thirty minutes will be devoted. Users do not know about RMS or EDF and do not understand that in an interrupt driven line of work sysadmins use intuitive variants of them. I want to expand however on a comment I posted there which links Metcalfe’s Law to the problem. Metcalfe himself has written about the law:
“[Nobody] has attempted to estimate what I hereby call A, network value’s constant of proportionality in my law, V=A*N^2. Nor has anyone tried to fit any resulting curve to actual network sizes and values.”
For simplicity most refer to the law by using V ~ N^2. Note though that in the same blog post Metcalfe points that the constant A (which we conveniently omit most of the times) may change while N increases and may even be a more complicated function of N. He urges people to look into that.
What Metcalfe defines as value, is what we, system administrators, lift for a living. So when a service is down and your sysadmins work like crazy to bring it back rest assured that they already know what is at stake. Metcalfe made sure of that. And that is why it does not really help asking them every ten minutes “When is it going to be up again? We are losing money!” Not only do we know, we do not even need a napkin for our guestimate.
And that is why what for the user is “just another server” or “just one more service” and therefore going from N to N+1, actually means that the load to be lifted increases by 2N+1. No it is not just another server or service for it is not independent. It is inserted in an already complex system and it must be done so in a way that does not affect the stability of the (new) whole. Rolling back, if things fail, is a myth. This is a lot more complicated than your testbed setup which no matter how complex, is simple enough. Consultants and other “out of town experts” routinely make this mistake.
A schematic may make it easier to understand. We all know the corporate pyramid, where “the top” is the target (or the result of the Peter Principle in action) of workers within an organization. But within organizations, a second (inverse) pyramid forms, a pyramid that explains your sysadmin’s day:
It’s no wonder that, even putting personality and character deficiencies aside, your sysadmin looks grumpy at times. Like the Last Electrical Engineer, his work is of infinite weight and importance, but invisible to the known (organizational) universe.
Remember, pressure brings tension.
It has been over a month since I purchased 20G of disk space from Google for $5 per year. Given that a relatively cheap 32G USB drive is being sold for €19 this is a bargain (including the risk of not being able to access my stuff over the network).
The reason I bought space from Google, was because I wanted to upload “My Documents” (PDF mostly) to a single place where I could access it from any computer I work from and always be in sync. By the way, for non-documents I am using MyNetworkFolders.
But here is where the Paradox of Choice emerges: In my “Books” directory I see over 200 ebooks (Math and CS-Math related mostly). They are either O’Reilly titles (including a few from Apress less than 20) or interesting books that have been made available online. Picking them up and filing them in a directory is quick and easy (Hey a book on Optimization, another on Topology, etc let’s keep a copy around). Can you imagine the actual space that 200+ hundred books would occupy? Would the bookshelf cost $5 per year? But then again how many of these books will I ever manage to read in my lifetime? At least it seems that sometimes when someone has a question, the answer may have already been downloaded.
The speed and easiness of the delivery are making us somewhat less picky (or alter the way we research before grabbing a book). I was having a similar discussion with a friend who is a professional photographer and he observes that people click far too many (digital) photographs which they file away and forget, as opposed to taking the time and shooting less photographs (because film was expensive, developing took time, etc) which they enjoyed viewing more. As Ashby said “only variety can destroy variety“.
Clyde Drexler run. Ivan Helguera run. While prominent achievers want to become Greeks for a day, we daily behave like cattle.
Damn!
This is an incomplete list of books about Prolog that can be found online:
I am counting on readers’ comments to grow it.
Update by ΤΖΩΤΖΙΟΥ:
* Κολυμβητήριο ΟΑΚΑ, 2010/10/20 *
– Μα αν αφήσετε τα πράγματά σας στα αποδυτήρια, πως θα μπορέσω εγώ να ντυθώ;
– Α, αυτό δεν είναι δικό μου θέμα.
– Μα αυτό που κάνετε δεν επιτρέπεται!
– Και ποιος το λέει αυτό;
– Η ταμπέλα
– Α να σας πω! Δε με ξέρατε και από χτες για να μου μιλάτε έτσι!
– ?!?!
Και επειδή η γαϊδουριά πάει σύννεφο, τα πράγματα τα άφησε εκεί.
Lately I find myself attending meetings where the need for a single coordinating body over the various efforts of computer / network / cyber security is stressed. Roll back 15 years:
Once upon a time (circa 1996) the GRNET-CERT was formed. It was nothing official, just three guys (me, Georgios Koutepas and Costas Troulos) and a mail alias. Since we had no funding and the legal landscape was non-existent our main focus was on trying to stop whatever incidents occurred. It seemed to work pretty well at the time. We even managed to find some funding and some of us attened FIRST‘s 1998 and 1999 meetings. With the emergence of the GRNET2 project GRNET-CERT was handed over to another institute for operations. Our interests had already shifted from (pure) incident response and we never really followed-up the national progress on that front.
In the meantime the Greek state responded to the void that was forming regarding the legal side of matters. And it did so in the wisest of ways that we are used to being treated to. It formed a multitude of authorities to cover the area, sometimes conflicting one another. Nature abhors vacuum, but as Rob Pike said “sometimes when you fill the vacuum, it still sucks”. There can appear types of incidents that might require reporting to three (or even four) different authorities with no clear roadmap on what one is expected to do if one receives conflicting guidance on subjects that at times require rapid response.
It is a saddening thought to see that the manpower and the resources exist (something that was not that obvious back in 1996), that people with skill, knowledge and willingness to work exist, yet the overall progress is kind of minimal.
ISACA informed last week that my application for CISA got accepted. I had passed the exam quite some time ago, but since no professional certification is particularly helpful in the Greek Public Sector I was reluctunt in applying. I finally made up my mind and now I need to dance the steps. So as the subject says, the question is simple:
– What is your strategy in earning CPEs ?
I’ve read the relevant ISACA provided information, but I am particularly interested in what CISA holders in Greece do to keep up. So if you can answer, or forward a link to this post to someone who can provide (even minimal) information / guidance, I would appreciate it.
