:Blog o' Doom

Last week, as some of you may know, I was working 9am – 4am almost every day. It was rough, but it’s one of those heavy crunch times that comes with being a sysadmin, and I accept those.

Today, I spent most of the day arguing with the CTO of the university about a security issue that was supposedly settled more than 8 months ago. I spent the entire day in meetings. But I left work at a normal time. And I would rather be back working absurd hours then having to fight all day long.

And people who know me know I don’t plan on staying at USC past summer ask me, “Why do you care so much? You’re leaving in a bit.” It’s true that I will barely be around to see the fruits of my labor, but is it such a bad thing to have pride in your work? Is it such a bad thing to actually be passionate about what you do and want to do it the right way? All day I hear “Whatever, I just don’t care that much” or “Whatever, I don’t care anymore” or “Whatever, it’s not worth the effort.” But God Fucking Dammit, I DO care! I care about protecting my users and my systems! We as IT professionals have a job to migrate our users to secure networks and environments! Am I the only person who actually gives a shit about their job? Am I the only one who wants to make a difference? For fuck’s sake! No one has cared about this in the history of the university, and now that someone does, it gets fought.

Arguing known standard practices in the real world to people in academia has proven to be the equivalent of running as fast as you can at a brick wall over and over hoping you’ll eventually fall through on the other side.

For a week now, I’ve been in non-stop arguments about this stuff. I’m aggravated and upset that no one in academia cares about security — they’re more worried about doing things fast. And if our universities don’t care, who will?

But to make matters worse, today I found out that instead of increasing security, the powers that be are looking to decrease it. Management as actually asked us to remove the encryption and VPN requirements for the wireless network. Anyone can get on and go. If you aren’t registered, you’ll be forced to a registration page, you’ll register and voila, you will be on the network. No VPN or encryption necessary. So you think “well at least only USC people can get on” but no… they’ll have guest registration as well. I hope everyone in the entire neighborhood jumps on this and abuses the shit out of it, saturating it with downloads, servers, virus, and all the problems that happen when you make retarded decisions like this. I hope major publications hear about this and write up articles on how the university doesn’t care enough to train users on how to be secure, and prefers to make it easy – how USC is too fucking lazy or inept, or whatever, to do it right. I hope this completely comes back to bite them.

Further, I was told that several universities are building high-speed networks as backdoors to the campus universities because firewalls and network security implemented by modern IT departments are too difficult.

Basically, in a nutshell, I was told security does mot matter to universities. Great – this is how we’re shaping the minds of young computer scientists. This is where tomorrow’s programmers, sysadmins, technicians, and information architects are coming from.

Great.