I couldn't possibly tell you the computer's ID over the phone, I've been on A Course™ How's your Friday shaping up? Come join us for another dive into the piranha-infested waters of what we at The Register like to call On Call. Today's tale of phone-based antics comes from "Mike", who spent the early part of this century working in the IT Moves and Changes teams for a large Edinburgh-based financial institution …
Obviously the training he got from IT/security about not falling for phishing scams and giving up personal information sunk in. Imagine how much more secure corporate networks would be if everyone acted in a similar fashion!
I'd rather have someone who didn't give up asset numbers than someone who would willingly follow instructions "can you go check her monitor and see if there are any sticky notes attached, and if so what letters/numbers are on them?"
Absolutely, in the dim and distant past I've done helpdesk at a company that did logistics, the department that dealt with government defence logistics was behind locked doors, card swipe entry, you had to be signed in and out.
So, obviously calling them up and asking for user name and passwords because 'we need it for some work over the weekend' wouldn't work right?
Right?
Oh...
Heh, I was at the other end of the chain - within a military logistics unit itself.
I was responsible for the unit's logistics supply system, and we were supplying aircraft parts into multiple theatres of war.
Occassionally a soldier would forget their password or otherwise lock themselves out, and so would need me to unlock them. Unsurprisingly, there was no remote access in order to do this, so outside cire hours it'd be a callout which resulted in a small additional payment to me.
The budgets dept at brigade HQ weren't happy with this though, and issued an edict that a forgotten password wasn't an energency, and therefore must not be a call out. When asked what we should do about the aircraft spares needed by Ops, they said the soldiers on duty should just share their password with each other until I was normally back in to reset the account.
They did back down eventually though, to be fair, when we pointed out that budget's favourite hobby - looking for misuse of supplies - would need to stop if we couldn't routinely show that the operator signed in was the one completing the transaction
My wife's uncle told me a few tales from USAF Mildenhall where he used to work in purchasing.
Apparently almost everything had to be bought and supplied through the USAF's central depot. This means everything including pencils were shipped over via transport plane from the US to the UK. Things readily available and at a much cheaper cost here in the UK. He was asked to get a barrel of oil for use by the USAF's display team (the stuff that creates the coloured smoke behind the plane). As it was classed as an explosively volatile mixture it had to be transported by itself, with no other cargo. Via a cargo plane from the USA. In a rare moment of sanity hundreds of thousands of dollars were saved by pointing out that the oil in question was exactly the same as used by the RAF's Red Arrows team and could be bought through them from a depot that already had it in stock here in Blighty.
The other tale may be a bit of an urban myth. Then again it might not be, you decide. They had a newbie in the department so someone gave them a part code and told them to order it. Types the code into the purchasing system "Denied, you're not authorised for this transaction." Grab his supervisor who puts his login details in, "Denied". Grab the ranking officer in the department. "Denied". Eventually they get the highest ranking officer they could find. "Denied". At this point someone finally thinks to check what the part number was. It was an AWAC, which apparently needs a 4* General's clearance to order.
They had a newbie in the department so someone gave them a part code and told them to order it. Types the code into the purchasing system "Denied, you're not authorised for this transaction."
Ahh! The infamous "off by one" order code.
You think you're ordering a gross of pencils, and what you get arrives on a flatbed.
// mine's the one with the copy of Peterson and Weldon in the pocket
Reminds me of a friends mishap.
Went to order 8 oak planks for a new corporate conference table he had been commissioned to build.
Accidentally ordered 8 TONNES of oak planks.
Didnt realise until the low loader turned up with his order.
"Which are mine??"
"All of it mate".
A few hundred £s versus ~£40k.
Blood drains from extremities.........
A friend of a friend used to peruse the military surplus flyers for interesting stuff. Unfortunately, the descriptions weren't the best.
One item was 100,000 bags. So he felt he could always use some bags and submitted a bid of 0.1 cents a bag. He was informed that he won the bid and how did he want them shipped. He answered, "best was." A week later the railroad informed him that his 14 boxcars had arrived and he would have to start paying rent for the boxcars in 4 days. ??? So he went down to the railroad siding and opened up a boxcar to discover that they were filled with top-quality sleeping bags (which he had purchased for 0.1 cent per bag). Immediately he contacted all of the sports stores and offered the sleeping bags for $1 a bag. He managed to unload a few thousand of them but had to burn the rest to empty the boxcars.
The Navy yard offered 8 48 volt generators. He bid $25 a generator. He won the bid. When he came to pick up the won bids in a pickup truck they said, "By the way, your generators are around back." Going around back he discovered they were the main generators for a PT boat each weighing about 500 pounds. His truck could barely handle only 2 generators. He loaded them up and went to a scrap dealer to sell them but they saw him coming and didn't offer him much. Still made a profit though.
Class, been there before.
I recall we accidentally did something similar with zipties. An engineering BoM update included 15x a new part number for coloured zipties, but purchasing could only buy them in bags of 250, cue 'miscommunication' between departments. The product sell rate was 50 per month and purchasing were told to secure stock on all consumables.
The zipties came in on four pallets and nobody noticed initially (it was a chaotic time), it was 18 months before anyone queried it. The supplier howled with laughter when we asked for a refund. When the warehouse team got bored they made Xmas decorations out of them in a big long chain. I vaguely recall the order value was high enough to need a finance director's approval.
This post has been deleted by its author
Friend of mine in the Army told me of a similar mistake he had witnessed.
The base, a small one, was running out of toilet rolls so someone decided to put in an order. In the "Quantity" column, they put "144" as they knew toilet rolls came by the gross. What they didn't realise was that the order multiple was a gross and they received multiple truck loads containing a total of 20,736 rolls.
The procedure to return goods ordered in error was so bad as to be useless and they had a base inspection due in a matter of days. The unfortunate perpetrator, realising the horror of his mistake, needed hide the evidence before the brass arrived. Every closet and possible storage/hiding place was stuffed with toilet rolls and everyone on the base told to take as many home as they wanted. I don't think anyone who was stationed there bought a toilet roll for the next 3 years.
Ha, I guy I used to work with meant to order a hundred or so disks mechs for some arrays and managed to order a hundred or so arrays. The factory was not amused when they tried to cancel the order part way through delivery when the arrays started to arrive by the truck load.
shipped over via transport plane from the US to the UK
When I worked at an embedded OS provider (later bought by Intel) we had a moment of absurdity like that - we were moving to a swanky new office, custom fitted out for us. The eejit CEO (in the US) decided that the look and feel of the office was so important that *all* the office equipment and fittings should be the same worldwide and hence, our new office, was to have all the stuff needed to make cubicles should be shipped over from the US.
One of the desirable outcomes of the move was that all the power and connectivity requirements was to be built into the cubicle basebands. Unfortunately, the stuff shipped over from the US was to US power and electrical spec and would have been illegal to install in the UK.. And they had forgotten the tick the ethernet requirement as well. So we had a shiny new office in the corporate colours with ethernet and power cables lying around and visible. And the furniture cost about 4x what it would have cost to buy the stuff locally - even if we specified the correct corporate colours.
Said CEO got ejected fairly shortly after by the founders of the company who came back to lead it up until it was aquired by Intel. They reckoned that he'd cost the company several hundred million dollars by his decisions.
When I lived in Norwich back the the heady days of the mid-late 70s the place was overrun with US Airforce servicemen and Corvettes. Turns out the Americans could ship their cars over at (US) taxpayer expense and when their tours were up they would often sell the cars to eager East Anglian Yoofs.
I also found out the level of the stuff they would ship in, down to milk for the airbases. It was the real answer to an often asked question when I came to the States in '84.
"Why don't Europeans like us? Our presence is good for business as well as national security" some ex-serviceman would say, upon detecting my Midlands whine and ascertaining I was not, in fact, and Australian.
"Well, we're pretty fed up with US spokespeople singing up a third world war starting in the Fulda Gap when US Territory is separated from the Soviet mainland by only 50 miles. You want a war, fight it in Alaska, not Germany. And if you want local businesses to be happy you are there, buy your base supplies from them, not from farms in the USA" I would reply with a shrug.
My uncle & cousin both worked in Air Traffic Control at Mildenhall (Uncle was usually complaining about the various USAF Staff sergeants & the like & began to be viewed as a Albert Trotter type of "During the war..." sort of thing).
The two stories I recall are him going through a hanger & a unsecured "aileron" dropped down & nearly took his head off & another incident where an officer sussed that father & son should not be on the same shift (Collusion\coverup in the event of a SNAFU - Justified in hindsight, but annoying to them at the time) basically scrapped their joint savings from the commute from Brandon & screwed up family event schedulings.
They were also reminded by people like my dad driving a Landy that they should close the car doors when they get out to go buy something in a local shop. Leaving them open when parked in a narrow British road tends to get the problem solved for them by percussive maintenance.
"Turns out the Americans could ship their cars over at (US) taxpayer expense and when their tours were up they would often sell the cars to eager East Anglian Yoofs."
When I was a kid and my Dad was stationed at RAF Alconbury circa 1959, a number of the airman had vintage Rolls Royces parked in front of the barracks. I was told those were shipped stateside when their tour was done.
I also remember my Dad's 56 Chrysler 300 drawing a group of people to look it over whenever he parked it in Cambridge. He had to give out a few rides when the person was a real gearhead.
You want a war, fight it in Alaska, not Germany.
That's cute.
It was West Germany, at the time, since the Soviets had East Germany under their control. East of that was Poland, also under their control, and from there it was all Soviet Union all the way to Moscow. Overland troops could move from the heart of the Soviet Union right up to the border of West Germany without having to leave the Soviet-controlled Eastern Bloc, which the Soviets were eager to expand.
I'm sure that if the Soviets had decided to make a move on West Germany, a polite request would have been all that was needed to convince them to turn around and roll their tanks 4500 miles across rugged, mostly unpopulated Siberia, then across the Bering Strait, then into the rugged, mostly unpopulated Alaska instead, thus provoking war with the only country on earth capable of standing up to them. I'm sure also that NATO and the US presence had nothing to do with the fact that the Soviets never did make a move on West Germany.
NZ was involved. As was Oz, UK, France, Germany, Russia/USSR/Whatever it was at the time, Poland, Italy, Japan I believe, probably other European nations, I think some of the African nations, and maybe even some of the South American nations (Yes, NZ forces were fighting in American waters in 1939)
The US was there too.. Oh, no wait a minute. No, the US wasn't interested. Came in late, after the really hard work was already done, and try to take credit.
But that's irrelevant anyway. Most of that generation has died off, very few are left. The people we have today - the children they fought and died for - tend to be a bunch of disgusting lazy whiners - you need look no further than their obese sedentary bodies and their penchant for suing each other over the tiniest imagined slight for evidence of what I say :)
The Soviet defector who wrote under the name Suvorov predicted it in the late 1970's -- that the Soviet Union would feign collapse, so as to remove the appearance of the threat of Communism.
And right on schedule, the Communists went into high gear here in the U.S.
Nonononono.
You missed the context, old boy.
The Russians had these things called Intercontinental Ballistic Missiles that they threatened to spray all over Europe when The Big One went down. We all thought that it would just be easier for the belligerents to point their rockets in a polar trajectory and get stuck in without involving the rest of us.
The question being answered was "Why don't the people we install our service bases amongst like us?" and I was responding to that, not to a comprehensive plan to re-configure the Soviet land Forces in East Germany.
Do keep up.
They had a newbie in the department so someone gave them a part code and told them to order it.
When I was in the Marines (US), this was very common and seems to be a rite of passage. Our line shop got a pickup truck as the order somehow got passed through. Then again, we would tell a newbie to go to supply an pick up such goodies as "5 gallons of prop wash", "200 feet of flight line", etc. Ah... good times.
At London Underground we had "Long Weights". Trouble was that it was impossible to distinguish between those and the time kept hanging around for a legitimate part number with the way the stores operated.
Ever have anyone show up with it? We (I was in Satcom) sent a newb out for 100 feet of orderwire (which was the sideband radio channel we used to speak to field terminal operators over the satellite) and the guy comes back with a spool of field wire (used for hardwired telephones in the field.) Lots of laughs that night. No idea where he found it either.
Off-topic, but in the same vein: when (in the 1960's) I was a school prefect at an English boarding school, it amused me to despatch some irritating little oik to the Post Office to enquire as to the price of a verbal agreement stamp (back in the days when most agreements attracted 2d stamp duty).
My father was a commender of a submarine base in Australia during World War II. He had trouble getting parts for his torpedoes - lots of delays etc. He reasoned that the torpedoes were essential for the war effort so he finally, without authorization, put through a triple A priority request for the parts. The parts came within a week.
He later learned that he was competing with the atom bomb project.
When I was working for a large electrical manufacturing company in the Midlands, I was once a member of a team that was developing a Motor Control Centre for all-electric ships. We were a loose mix of electrical and mechanical engineers, and I was detailed (amongst other functions) to keep an eye on the budget. I could write and sign for requisitions up to £1000, my immediate boss up to £5000, and the Project Leader up to £10,000. One day it became necessary to order a very large, very special, electric motor to act as a surrogate load for the equipment during testing (think 8 feet diameter by 10 feet long, weighing several tons). We approached various other companies, including our fellow engineers in a different division of our own company, and the cheapest quote we received was for a quarter of a million pounds, but no-one was willing to take responsibility for spending that much money, so, as I was the most junior and therefore the least irreplaceable, I wrote and signed the Purchase Order myself. Project Leader was summoned to Head Office and asked to explain why I, a mere Development Engineer, had been allowed to sign the PO. Project Leader points out that, unless we have this motor, all development on the equipment will stop, and the Navy's shiny new Destroyer will be just a floating hotel. We got the motor tout suite.
"The long weight one is actually common enough to be both an urban legend AND true."
Having started my career many years ago with a stint of fixing faults on manual telephone switchboards, I can assure you that weights (to keep tension on the cords) definitely do come in long and short versions.
If you used a long weight in a board designed for short weights eg., the operator's position for a BPO 300-type PABX, setting the cord to the correct length to prevent the weight hitting the floor meant that it wouldn't have enough length to fully cover all the sockets an operator needed to reach on a multi-seat switchboard. The long weights were used for older main exchange switchboards.
Both types of weight were kept in stock by stores at the exchange I worked in.
My old boss told a story about being instructed to fetch a left-handed shovel.
Obviously stores guy knew the line and said "we ain't got none", so he asked for a regular shovel and temporarily borrow a grinder and cutoff wheel. Proceeded to cut off the folded-over bit of the blade for where the right-foot pushes, changing it to a left-foot shovel.
He took that back to the foreman and was doubtless branded a smart arse for life.
Slightly off topic, but many years ago when my brother was in the USAF, he had an additional duty of performing some maintenance on flight simulators. They were very low tech by today's standards as the flight track was drawn by a computer driven plotter. A gear had stripped on one of the plotters, but the manual had a national stock number where a replacement could be ordered. He ordered the gear, but none came until about 6 months later when a "delivery person" located my brother and announced he had his gear and wanted to know where to deliver it. My brother told him that it was okay to put it on the desk. The delivery person told him he couldn't do that and led him to the "Wide Load" truck with a gear that was about 10 feet in diameter. My brother told him that it wouldn't fit and to take it back. Apparently the national stock numbers had gone through a revision and the NSN for the 1/2" gear for the plotter was reassigned to a slightly larger gear.
In all seriousness there should be a law against materially changing the stock description that has been previously mapped against an existing stockcode. In certain industries it can cause a life and death situation to arise, and no doubt an opportunity for fraud in others.
Couldn't agree more, had this argument over and over with the powers that be at a place I used to work - they hadn't properly thought through their part numbers scheme, so had run out, and were proposing to "re-use" part numbers and couldn't understand my objections...
I don't work there anymore and am much healthier and happier as a result
almost everything had to be bought and supplied through the USAF's central depot
I know I'm a bit late to the thread, but that sort of thing seems to have been carrying on for years.
My dad grew up in a major South Wales port during WWII and will gladly tell the story that all supplies for local US military not only came through the port, but were checked at the port and included stuff that was not available in local shops. Particularly sweets and chocolate from his point of view.
'Checking' involved inspecting cartons for any sign of damage, and rejecting - sending to waste - the whole carton, even if it was just a corner of the outer box that was torn, or rat-nibbled.
My dad and his mates soon learned where these rejects were stored - without the security afforded to items destined for the troops - and he apparently had a roaring trade in sweets and chewing gum from his school desk, while his school bag strained under the weight of the books which should have been in the desk.
M.
Having mistyped a part number for a fan and almost ordered a £250,000 CPU cube I'll believe this. If I had actually pressed the button it would have cost £50,000 even if it was never installed as it would have had to go Back through manufacturing for retest and refurbishment.
Or even better, give them a ticket reference and make sure they know which label they're looking for. Then have them call back into the helpdesk using the number on the company directory, and hand over the asset ID and the ticket number.
Takes more time, but it means they're calling a trusted number.
Indeed. I'm always impressed by people who turn down my invitations to provide details, especially if they weren't the ones expecting a call which would ask for those.
That's solved with a simple and polite "Call me on my internal extension number so you can be sure I am legit. The sooner you call; the quicker we can get the problem fixed".
I'd rather have people over concerned about security than lax. I know who I think is the biggest "banker" here.
Takes more time, but it means they're calling a trusted number.
And that, right there, is why you need to make sure that the corporate VoIP admin console has a good access control. There is no end to social engineering you can get away with if you have access to that.
That said, the scammers that set up their VoIP system to represent a national number appear not to have worked out that an inland call will not show the international prefix (i.e. a UK originated call to a UK number will not start with "0044") so such a called ID makes it easy to reject the call :).
They can, but you need to know a bit of inside information. It's this sort of stuff that Kevin Mitnick was actually in trouble for. If you know the system, and the IP address of the VOIP gateway a lot of systems will let you connect as if you're within the network providing you have a compatible phone. This is why you should never have your remote user phone interface published anywhere, nothing should forward to it and it should be different to your main external IP address.
It doesnt need many. If you can get 1% of your calls to work that's probably around 1 victim a week and that's probably a bitcoin a month or something. I could live on that, the Indian guy running an office of these people is probably going to be having a bit of a party on that.
You assume the recipient can readily identify that the call is definitely internal, that also it is definitely from the Helpdesk, not a random department within the company ( and especially not a convenient internal phone just the other side of the reception desk for visitors to use when they arrive) and that he has time to work these facts out while trying to respond to the call itself. And that's assuming he can be sure that the phone system hasn't been hacked into. (Whether or not that is a significant risk is irrelevant, he wouldn't be expected to know, let alone decide, whether it was or not).
Back in the nineties, a lot of companies suddenly had to remove the telephones that were placed conveniently right outside their locked doors, for visitors to call inside employees on. Seems that the scammers had figured out that these always looked like "inside" telephones. Also, the scammers could use them to call 900 numbers, which back then were automatically paid to the number being called ... scammers may be evil, but they're not stupid
Thank you, this..
"suddenly had to remove the telephones that were placed conveniently right outside their locked doors, for visitors to call inside employees on "
validates my earlier comment.
I'd had in my head that I'd seen this from time to time, in reception areas of large companies, but couldn't have quoted where. Or even when.
"I'd had in my head that I'd seen this from time to time, in reception areas of large companies, but couldn't have quoted where. Or even when."
I often visit clients who have unmanned reception. You walk in off the street, find the phone on the wall and call the extension of the department/office you need from the list on the wall by the phone. I've never actually considered, let alone tried, dialling 9 + number to see if I can get an outside line.
I would assume I'm on CCTV while there anyway.
but couldn't have quoted where. Or even when.
Had one of those at the radio station I worked at in the 1990s - overnight there would only be two people in the buding (one for each station). It was restricted and could only call the two main studio numbers, reception and the engineering office. Very simple configuration at the exchange.
Towards the end of my time there we also installed CCTV covering that door and the staircase behind it so that people answering the phone could both check the caller visually, and check they actually went where they said they were going once they were inside.
The keypad for the door was a bit more of a problem. We /told/ everyone that they had a unique code and that accesses were logged. In reality, although accesses /were/ logged, only four codes were available, which made for an interesting round of internal memos every time a member of staff left, and some longer-served members of staff began to catch on :-/
M.
"Back in the nineties, a lot of companies suddenly had to remove the telephones that were placed conveniently right outside their locked doors, for visitors to call inside employees on."
Sensible companies used a phone with no buttons, which dialled reception/security automatically when the handset was picked up.
Sensible companies also block access to premium numbers.
Worked for a company once that had an internal phone system for a particular department. Pick up one phone, and the other 4 automatically rang. Useful if you know you're usually going to be calling particular areas. They were also the oldest-looking phones in the place.
"Everybody knows the Helpdesk"
Do they? I've worked at my current employer for nearly a decade, and I genuinely have no idea off the top of my head what the helpdesk phone number is - in the earlier years here, support tickets were generally raised by simply wandering over to the IT area and having a face to face chat with whoever was in at the time, and in more recent years we've moved over to a more formalised web portal system. So if they decided to suddenly phone me now, I'd have to reach for the internal phone directory to check the number shown on the phone was theirs and not one of the myriad of other extensions on our system that I've also not felt the need to have committed to memory.
And even if they do know the helpdesk number, or if their phone system is helpfully programmed to display "Helpdesk" or similar rather than the actual number, that still doesn't mean the person answering the call should blindly assume the person on the other end actually is from the IT department. Do we know for certain that the only people with access to a helpdesk phone are members of the IT department? Do we know for certain that the internal phone system is impossible to hack/spoof/otherwise manipulate to allow an attacker to generate calls which appear to originate from the helpdesk?
I should have known I'd end up in IT when I first became an engineer. I needed some help with a script on the manufacturing system, so went off to have a chat with the IT person in charge of the system. Only to find out that I was actually the most knowledgeable person in the company regarding the data structure of the system (by this time I'd been writing reports on the system for about a year).
Turns out the company didn't have a single DBA type person, the IT department's role was purely to make sure the hardware stayed functional. Probably explains why I got tasked with the company's intranet just before taking redundancy.
Umm, the entire company was "one of them" back then, because that was the preferred way to raise tickets with IT unless you were working away from the main site. So aim your ire at our former IT guys please, not at those of us just following the procedures such as they were at the time.
"aim your ire at our former IT guys please"
If your assertion is correct then fair enough. However I shall never aim my ire at any IT guy. We have to stick together!
Normally the preferred way of raising support tickets is to not raise support tickets. Ok I jest. However, users be aware, unless we invite you, the IT department is off limits and not to be wandered in to whenever you feel like it to raise an issue (normally while we are really busy). Either we come to you, or you call or raise a ticket. Also, don't get telling us stuff you want or need or all your IT problems while we are walking around site, or better still whilst eating our lunch.
Felt like getting that off my chest.
(chuckle) Ah, but there's IT staff, and then there's IT staff. I used to work at a company group with offices in two major cities. I was a lowly helldesker for the programming team that had developed and maintained the in-house system that handled the business and customer data for large chunks of the group. The actual IT staff at the same locale as me generally knew what they were about and trying to get to the root of problems that might've been the in-house software or might've been due to some network problem seldom involved any fraughtness.
Not so the bunch at the other site, who were almost universally regarded as an almost useless bunch of monkeys. How they managed to keep their jobs was a mystery to many of us. The classic was that they kept mucking up setting up new users with remote access to the system developed by the team I was Helldesker for. This meant that you could guarantee that shortly after a new employee had started at their site, I'd get a call about how their system didn't work. Well, how OUR system didn't work as it was the responsibility of the team I worked for. Never mind that it was the access to it being incorrectly set up by their local IT that was causing the problem.
Even worse, I'd have to explain to users that I needed to pass their request over to IT, as only they could do the necessary to rectify things. About half the time, I'd be told that it was IT that'd told them to contact me, and could I just get on with it and fix the problem?! Sigh. So about half the time, I'd end up having to ask the local IT team to fix the problem with their ninja network-fu, because I certainly didnt have the tools (or knowledge) to fix what was wrong, and bedamned if I was going to go through the mental agony of trying to get the monkeys to clean up the mess theyd caused and then shoved in my direction, it'd take way too much of my time, and being the only helldesker for my team, that'd mean a worse service to other potential callers, most of whom were at the same site as me.
After having patiently explained what was needed to the distant IT team by phone many times, I asked my boss if it'd be OK for me to write up the process and email it to them. She gave me the go ahead, once she'd checked what I'd written. For a week or two things improved - and then slid back to their previous dismal state. So I resent the instructions. Apparently one of them paid attention that time, but not the others. Third time of sending I sent in a stiff formal complaint about 'em. THAT got their attention. But if they ever received anything more than a gentle slap on the wrist for being so useless, I never heard about it. They NEVER caused me unecessary problems again though.
So, yeah - in that one situation, I was prepared to stab a bunch of IT staff in the back - they damned well deserved it. What made it even more bitter was that the bunch at the other site got paid more than the local lot (and way more than I did!), despite the latter being far the more competent.
"However, users be aware, unless we invite you, the IT department is off limits and not to be wandered in to whenever you feel like it to raise an issue"
Oh dear. One of the Ivory Tower brigade. The up-my-own-arse sort who thinks they are more important than the people they serve.
IT is a service. You are there to help. Not make it hard and raise barriers. It is attitudes like yours that have given IT departments a bad reputation.
You know those tossers in Accounts who block things and never explain why and you can never get hold of them? You are like that.
You know those bastards in Finance who cock up your pay and you can never get hold of anyone to fix it or explain what happened? You are like that.
So, open the door of the IT department and welcome people in. If you actually communicate with your users, you'll find they have far fewer problems and thereby stop being a pain in the arse.
What would I know? 35 years experience including setting up friendly, open, service desks and turning around Ivory Tower ones into helpful ones.
Just needed to get that off my chest.
"Oh dear. One of the Ivory Tower brigade. The up-my-own-arse sort who thinks they are more important than the people they serve."
No Simon. I am most certainly not. IT is a service and users keep me in a job. Like any service, you have absolutely no right to to walk all over the person delivering it. That includes disturbing a team doing a job in their office, trying to help users who've taken the time to put tickets in or are calling in whilst the actual issue is visible on screen.
1. Diving in to an IT office to tell someone your problems out of the blue and take up their time and attention when they are more than likely busy.
2. Telling an IT Support person walking to and from jobs or generally around site your IT issues you must raise with them because it's so important you couldn't call or put a ticket in, expecting them to remember all the details when others like you have done the same to them on the same journey.
3. Telling a support person your IT issues whilst they're sitting there eating their dinner having down time.
Doing any of those make you a self important 'better than those that serve you' kind of person. If you disagree with that then that says a lot about you.
Someone takes the time and effort to find your team, approach you, engage in a face to face human relationship and discuss how to best help the company solve a problem, and you think they're in the wrong?
You may require ticket systems and work queues and other bureaucracy but if you can't handle someone walking up seeking help that is not their problem.
"IT is a service"
Quite right. It's a service within a business and it's the business that's the unit. Working in IT I always found it was most useful to the business if I got to know something about how my users worked. It didn't even do any harm if some of the users got to know something about IT. And the most effective way for that was face-to-face communication so not only did I not take offence at them coming and talking to me, I went to talk to them. In fact, at times, the seating arrangements were a little ad hoc and I found myself seated next to them.
Apart from anything else the "keep users at arm's length" approach is an invitation for users to keep IT at arm's length. Perhaps an arm long enough to reach to India.
One of our staff _used_ to be a helpdesker.
Now he's a developer - and every time people walk in to regale him with their latest problems they pull him away from essential tasks
Those same people - when told NOT to disturb him and to either use the webforms or talk to the current helpdesk guys get all huffy - just like you do.
We started documenting how much disturbance they cause. The answer is about 9 months delay on one project so far.
And yes, this is a "Ivory tower" organisation. The problem isn't the helpdesk, it's the tenured staff who think they can ride roughshod over everything coupled with management who 'don't want a confrontation' - to the point that the only thing that can stop them is locked doors and even stricter access conditions than would otherwise be necessary.
We can't actually say that all the issues are down to professor X, Y amd Z and we CERTAINLY can't direct the restrictions only at them or staff of that level, so everyone gets to wear the results of the shitfest they create.
University academics are some of the most entitled (as in demanding) prima donnas you'll ever encounter - and whilst they have deep qualifications in their speciality that does not make them automatic experts in everything else. The average academic has a mildly above average IQ, on par with most El Reg readers. The _really_ smart ones are actually easier to work with, with less tendency to micromanage or play "dying swan" at the slightest provokation.
and whilst they have deep qualifications in their speciality that does not make them automatic experts in everything else. The average academic has a mildly above average IQ, on par with most El Reg readers.
I love those types. When I've had to deal with them, I developed a simple and effective response...
"If you're so bloody smart and better qualified, YOU fix it yourself. I'll help someone less capable than you are.".
Most times I'd get an apology, sometimes a bit belated (after their boss bailed me up about it and I pointed out that I was being berated by their time-waster who kept telling me how unqualified I was). Hmm.. Maybe they left more of a mark than I thought. Make mine a pint of bitter -->
"Everybody knows the Helpdesk"
It's that number that I call when there's trouble. I rarely get calls from them. In fact, many help desk calls will be referred to a tech who can actually solve the problem. And if they call me back, it's their number that shows up on the display*. Back when I used to support the shop floor on behalf of engineering, I'd get paged to call in at any time of the day or night. If they had the means to view the origin of that call, it would be from my residence during the graveyard shift.
*You young folks are spoiled by your fancy IP phones. I used to get cold called while working at Boeing. All we had were the classic five button office phones, with no means of detecting what the origin of the call was.
Do companies still even use internal phone systems of any type? I've been with my current employer for 6 years and there's been no internal phone system during my tenure. Cell phones and the odd land line (I know of only one actual wired phone). Just shy of 2000 employees. There has been talk about getting a few voip phones for the meeting rooms, but they've been talking for several years.
We always had one land line (old fashioned button or rotary dial type wired in in every department, in steel conduit) It always works for 999 (emergency number) calls. Power from the telephone company. Major power outage and an employee trapped in machinery is no time to rely on a possibly working internal powered telephone. As all walls were steel (earth covered) (and roof) explosion proof cells to avoid any one explosion in one cell setting off others, no mobile phones were used. Even people with hearing aids, battery contact activated wee not allowed inside
The UK had the type 706: https://en.wikipedia.org/wiki/File:GPO_706_Green_Telephone.JPG
That insert in the middle was used for a recall or bell disable switch or had 2 buttons for 2 line phones.
For internal (non PABX use) they ended up looking like THIS: https://upload.wikimedia.org/wikipedia/commons/7/75/GPO_706_HES.JPG
"When I were 'lad" these were the phones everyone had (if they didn't have the black bakelite versions) in areas where the phones weren't crank handled and answered by a manual operator. They only stopped being standard issue in the mid 1980s - which curiously enough was also when I was involved in removing the last of the aforementioned crank handled phones and party lines from service. (The standard issue became the BT Viscount aka "pert", which have proven to be 20 times as reliable as anything else since, despite costing less than £3 each when new - achieved by buying 500,000 of them in only 2 colours - reputed to be an ordering typo/off by one error)
This post has been deleted by its author
Definitely. Trying to spin this as anything other than a complete failure on the part of "Mike" fails because:
a) if the IT department expects employees to divulge anything that feels like it might be sensitive information (calling it an Asset *ID* rather than, say, an Asset *Tag* probably didn't help here) when the IT department has effectively cold-called them out of the blue, then they're they ones that need security retraining. It's one thing for Mike to be calling to try and speak to the same user they were previously dealing with to gather more information about the support request that user had raised, but the second he realised the call hadn't been answered by that user he should have changed tack completely rather than demanding that an uninvolved third party give out details on behalf of their co-worker.
b) It might just be a random number meaningless to anyone outside the IT department, but how is the average user expected to know this in advance? Especially if, as noted above, it's being referred to as an ID number rather than something less likely to trigger a security training warning in the mind of said average user. And it still doesn't mean that the average user should be expected to simply divulge this information to someone claiming to be from the IT department - if someone called up the IT department armed with a list of genuine asset IDs they'd phished from unwitting users, could that in turn be used to successfully phish something of more value out of the IT department?
c) treating this user as a pain in the arse to be dealt with accordingly, rather than as someone who, no matter how misguidedly, was at least demonstrating a clear intention to abide by their company security training and therefore ought to have been earning themselves some brownie points with the IT team who'd be the first ones to call that same user ever name under, over and around the back of the sun if they'd ignored said training and caused a security breach that required them to drop everything and deal with the fallout, was unprofessional. As was changing their password for no good reason. As was changing it to something derogatory.
There's a really simple scam - call someone, get the asset ID.
A couple of weeks later, call. "Hi - this is the IT department. We need to run some upgrades remotely but before we go ahead, can I confirm the Asset ID on your computer? My records show XXX-111-XXX - is that correct?"
Instant plausibility - you're telling them what's on a label on the computer in front of them - you must be legit!
Now talk them through connecting to whatever domain you need to point them at to get malware onto their PC ...
"Jaded box heads on help desks are, luckily, becoming a thing of the past."
What's replacing them is far, FAR worse.
The standard response is frequently "We don't support that" - despite documentation showing that they DO support it and memos from senior management to stop giving that response.
On top of that, when someone takes your name and userID at the start of the call, they shouldn't then be asking you to re-supply it _3_ times during the call - nor should they be ignoring what the user says and just typing something generic in the fault fields - leading the investigators to either be chasing the wrong fault ("no fault found") or have to phone up and ask for the description AGAIN.
(Similarly, refusing to link tickets, or reopen improperly closed tickets...)
Then there are the helldesk systems which don't allow the helldesker to pull up fault histories to find series of tickets for the same fault which have been repeatedly closed by the SAME staff without being fixed (these are the people you need to deal with or remove from the organisation)
I have stand up arguments with my managers about tickets which are open for long periods. He subscribes to the metric that they MUST be closed within 7 days or he gets stroppy. I subscribe to the metric that they get closed when the fault's fixed and confirmed fixed - NOT BEFORE.
It's dickheadedness like that which causes faults to go unfixed for _years_ until someone with half a clue decides to look at the ticket - assuming that it hasn't gone way up the food chain on one side and come down _hard_ on the support crew from a great height on the other.
If the IT department had a decent asset list this wouldn't happen - I guess Mike feels that admin isn't part of his job.
All he had to say to the PA is - could you call me back on the IT number.
Seriously it's people like Mike that give HellDesks a bad name
Much as I hate to throw mud at another Mike, yes he was a bit of a dick. Complaining vociferously about users when they're not in earshot is fine - it's even to be encouraged to avoid situations where you lose your spanner on the phone with 'em. And changing the password to 'wanker' might not be worth the sack, but it's definitely worth a serious talking to ('don't be a fucking dick'); it's also completely pointless unless you keep a record of what users passwords are (which is pretty dumb).
"it's also completely pointless unless you keep a record of what users passwords are (which is pretty dumb)."
Indeed, changing it to wanker is like saying 'I changed your password to something that encrypts to ASDhasf8a4rt89iASFasfd8iu'. You can reset it any time.
"If the IT department had a decent asset list this wouldn't happen"
Fsck. Off.
The amount of times people swap desks or PCs and don't tell the IT department is huge. I've gone to log on to someone's PC today and been told "Oh, you're on the wrong PC. We swapped desks yesterday"
It's not about the asset list, it's about attitude. I've never had a problem with a PA because i've learnt how to speak to them over the years. Mike obviously hasn't, he probably shouldn't be in first line support.
people swap desks or PCs and don't tell the IT department is huge
Which is why we have spot audits every year. Most of what we find is "oh yeah - they left 6 months ago and had a better laptop than me so I took it".
And (often) if you check whether the leavers account is still enabled it often is - because their manager hasn't bothered to tell us that they've left.
My IT department get a report every week of hirings and firings(well, mosty retiring, and short timers), so we know when someone is about to leave.
Then we run a script that sets up a scheduled job on that user's PC...
A week after the termination date, the user shell entry of that PC gets changed to a slideshow program that someone in the department hacked together. No file dialog or anything. All it does is show pictures with helpful info such as 'This PC belongs to xxxx organisation, please return it' and contact info.
(The registry also gets further locked down, and of course, users doesn't have admin access. And the HDD is Bitlockered. And with the indelible asset tag, it's not very attractive to bring it to a fix-it shop, either)
It REALLY cuts own on low-level manglemnt 'holding onto' computers after users leave....
Assets lists! Ha!
I've just had an interview with a large UK public sector organisation, and in the discussion we covered the fact that they had no idea where many of their IT assets were. Hold on, I said. I worked for you doing the Win7 roll-out six years ago, and part of that process was rigourously building up an asset list of equipment, because you had no idea where most of your IT assets were.
I take the point about asset lists not always being up to date, and I don't think that's the necessary solution to the problem. Yet it's still not the fault of the user concerned. They were, perhaps annoyingly, sticking stubbornly to their security training. In other words, they were doing exactly what we'd want them to do in the case of an attempt at social engineering. Repeatedly shouting at the user to give you information doesn't help prove the point. Asking the user to call back with a trustworthy number does do that. There are other ways to authenticate as internal and/or trustworthy, but none were mentioned. Worse, the user who acted in compliance with their training and was actually able to provide the required information without leaking potentially secure information was penalized in a frankly pretty irresponsible manner.
"If the IT department had a decent asset list this wouldn't happen - I guess Mike feels that admin isn't part of his job."
We were all sent an e-mail on a Monday saying that the day after there would be an inventory, and anything electrical in the office would be added to the department's IT asset list. As some people---including me---were away the whole week, all of our personal stuff like phone chargers, etc., were added to the departments assets. I peeled all their asset tags off them when I got back and carried on.
I'm not going to bother telling them their list is wrong if they are going to be stupid about making i tin the first place.
If L0phtcrack taught me one thing it's that Windows passwords were split into two sets of 7 characters and hashed separately. So a 7-character password was potentially more secure than an 8 or 9-character one, on the basis that if you decoded the letters at the end it may give you a clue to the letters at the start.
... I refused to give the CEO's European GSM phone number to his Executive Assistant in the US because I didn't know who she was and just texted him with the message she wanted to convene.
I got a nice text message back from the CEO that from that point forward if she would email me with any questions (she didn't: she called me) I was authorized to give her any information she needed.
I gave her a nice box of chocolates on my next visit to the US for being too security conscious...
Heh. When some contractor requested access to our server room in order to install an alarm, I denied him access since nobody informed me of access needed.
Got a chewing out from $Boss, but $Boss agreed I was doing the right thing as he was supposed to inform me of this and he did not do so.
It's been known for OFSTED inspectors to try to get access to schools without showing ID. I heard one story (may be apocryphal ) of one getting quite angry and demanding access. The admin stood her ground and refused her admission until she showed the card. That school passed. But I did hear of one where the inspector was able to get access by walking in another entrance that wasn't secured. Instant fail ( there were, as it happens, other issues about management that deserved the fail imo anyway).
Working in an outsourced MoD secure office, someone tried to follow me in through the card-swipe back door. I refused to let him in, so he went mental. He was bigger than me and I could not physically stop him forcing his way past, so I 'escorted' him to his destination i.e. followed him explaining you cannot come in without ID. When he got to an office he walked past some staff into a second office. I said to the staff present what had happened and asked if he was legit.
They thought it was hilarious. He was the Head of Facilities Management.
Wow, did I get a totally unfair big time bollocking for that - which I refused to accept.
I was dismissed from that contract shortly after. :-/
^This. Absolutely gets on my nerves. Give me a reference code, I'll go to the website to get an official number to call and do the verification that way. Not a chance I'm proving who I am when they called me.
Same goes for the cold calls about mobile phone upgrades. I have had good fun calling them out on their "we see you're due for an upgrade" schemes. First question to them is can they confirm my name?
I've generally found they're unsurprised and completely okay, though I will suggest I call them back instead and ask if I need a reference code (don't think a reference code has ever actually been involved). Asking them to confirm details is an opportunity for social engineering if a fraudster has managed to get enough detail elsewhere. It's harder for them to be the person picking up if you ring your bank's contact number (though not impossible, one scam a while back involved ringing landlines and simply not hanging up to hold the line, harder to pull off on a mobile where disconnecting either end will cut the call).
" one scam a while back involved ringing landlines and simply not hanging up to hold the line"
Which shows the sheer number of dipshits who don't listen for dialtone before starting to dial (Worth knowing: When the exchange is overloaded it'll withhold tone. Some provide a pip tone but that's not universal)
And of course if you think your line's been grabbed this way, dial a couple of other numbers first to ensure they go where you think they'd go.
The ultimate defense is simply calling out on another line.
My standard reply was that I'd already made clear to my bank that I wasn't doing that so the one thing I knew for certain was that they weren't my bank and I wasn't even prepared to confirm they'd guessed write. It was inevitably followed up a few days later by a plaintive letter from HSBC to the effect that I wouldn't give them a chance to try to sell me services I didn't want.
Once I closed the company my personal account was closed as well. I did offer to meet them to discuss it but only in my preferred branch, the one they'd just closed.
I refuse to confirm my details with them when they call me unexpectedly
I once had a cold-caller from the bank get very aggressive with me on the phone when I wouldn't confirm my identity. She didn't seem to understand that I'd never heard from her before, didn't know her and (since her number was withheld) no way of validating who she was so why should I give her my private information?
I suspect that she was on a quota and I was messing her completion rate. And my level of caringness and sympathy was somewhat adjacent to zero.
I tell them "You confirm my details first"
I do the same, banks or other organisations I deal with (actually my bank doesn't call - a very strict no-first-contact policy except through the official app/website).
Some people get quite shirty when they're trying to confirm it's me but they won't say who they are, who they're calling from or what they're calling about (legitimate privacy protection). I'll sometimes get them to give me part of an account number or something else (eg if it was my bank, I'd ask them to give me the cents from 3 of my last 10 transactions, in any order).
You've called me out of the blue. Your phone # is blocked. The information you ask for is enough for me to be a victim of ID theft. And you're expecting me to give you that without me being able to confirm you have a right or reason to be asking?
I think my bank may have me on a list about this. After my repeatedly refusing to give out information to unexpected callers, we now exchange information. I know this is not foolproof but its a start. What generally now happens is that they ask me to call back them but don't give me the number and I look it up from my contacts.
"I think my bank may have me on a list about this."Either that or your bank may have had an outbreak of sanity.
At a bank? Surely you jest!
Here in NZ (and I believe in Oz) there is this "Poli Pay" system that's supposedly set up to let you pay for various things (including some government like vehicle registration (think of it as a type of road tax) . Most sites that use it claim it goes straight to your bank's website, but it doesn't. Most banks don't seem to care that any time their users use this thing they're in breach of the contract with their bank (the "do not give your details to anyone ever not even the police" bit). Mine (Kiwibank) has issued a statement to me and anyone else who has asked to confirm that it is considered a breach of contract, and one other actually seems to block it from their system, but most other banks just effectively stare at you blankly, a bit of drool running down their cheek, while you ask them if it's a problem or not that their users are encouraged to put their bank login details into an offshore firm's website (name, address, DOB, bank access number, bank passwords, security questions - everything). Worse is the gubbermint defoolments who also encourage it's use and won't listen to warnings that a) it's putting the users in breach of contract and b) it's a massive security risk!
</rant>
I need a cuppa and a lie down now..
Most banks don't seem to care that any time their users use this thing they're in breach of the contract with their bank (the "do not give your details to anyone ever not even the police" bit).
This is something the "nothing to hide" crowd fail to grasp. There are perfectly legitimate things which you're obliged to hide.
And the privacy/information regulators in both countries have green flagged this when queried?
Thus far, they take the word of the websites who use this over the word of the people complaining. The websites say "it's your bank's own site".
You can see a screenshot of a fake poli-pay transaction at the enter bank details page here. For comparison, here is a shot of the ANZ login page
Not many differences. Style, colour, URL... Nothing much.. I forgot to record the URL of the poli pay submit button, but trust me when I say the URL it sends to is not "???.anz.co.nz" nor "???.anz.com.au".
A couple of banks have told customers it's not acceptable, where customers have asked. The banking ombudsman's office isn't interested, most of the banks aren't interested, and the organisations involved aren't interested. They all claim innocence, that it's above board, goes direct to the bank, and what would someone with web-developer or computer security experience know? The company and the government say otherwise so that must be true, and no matter what evidence web devs or security pros show they're wrong. It's all above board, nothing to see here, move along please.
El Reg - where's the icon with tears of frustration/despair over the self-inflicted fate of humanity?
"Back staff react surprised "
I've had them become quite abusive. Moreso when they start rabbiting on about Caller-ID and I calmly point out that having worked as an exchange tech I know how trivial it is to fake those - and NO, I'm not going to call back any number you give me.
Of course banks deny that their staff do that - which is too bad when there are recordings.
My bank always used to say that they would not ring me for any reason- it popped up everytime I logged into the the online portal, and was printed in bold at the bottom of every statement. Until, one day, they did. I drove the caller up the wall by repeatedly pointing out that the bank does not ring anyone for any reason; and when she told me that this was an exception, I kept asking who was lying, her or the warnings on the website and printed statements.
1) Just respond to the ticket on the support system by sending a request for the computer number through that system, telling them where to find it. Quick, easy and straightforward. Nobody's going to get a bad rep for strictly following procedures in a bank.
2) Anyone who changes someone else's password to you know what what out of petty spite whilst working for a large financial institution is a thoughtless idiot. After all the time you've spent working there, do you really want to demolish your reputation so quickly by doing something so stupid? Pranks and banks are a total no-no.
3) If in doubt, keep 'em out is standard good practice, and taken as read in large financial institutions as a rule.
Way back in the mists of time, I was working for an ISP which was essentially just a tax fiddle for a certain (now defunct) large PC seller. Every few days, a database transfer from the PC seller's systems went into the ISP database, and a Perl script of mine ran to try and pull out the details of any user daft enough to hand over their phone number to the box-shifter, and discerning enough not to sign up with the ISP.
These poor people would then get a phone call from the box-shifter asking why they hadn't signed up with the lovely ISP, and wouldn't they like a free month's service or something? This all worked very well, until disaster struck: my script spat out the name and phone number of someone who was vaguely related to the owners of both companies.
The result: I get a bollocking because apparently my script is supposed to be psychic and not do such terrible things as this, despite my not knowing any names or addresses that I ought to have been avoiding. Pointing this out was hopeless; a bollocking had been ordered, therefore I had to receive a bollocking and no, I was not to get an avoid-list to prevent future trouble. Discarding a certain common Asian forename would have done the job, but being where this company was this would have dropped the number of victims down to a trickle.
I left the company soon after this, and was most amused to later hear of their going bust; they bloody well deserved to go bust for being such an unremittingly grim load of arseholes!
My wife worked briefly at a Cracker Barrel. (For those not in the US, this is a restaurant with attached shop, both with a rustic southern US theme.) She was quite thoroughly instructed that she was not to ever refer to people or anything people-like (like the dolls being sold) as "white" or "black", and to do so would result in disciplinary action as it could be considered racist. An African-American customer came in and inquired about a dark-skinned doll; when my wife referred to the doll as "African-American" the woman became rather upset about the politically-correct terminology. "It's black, honey!"
Trying to keep ahead of the latest politically correct terminology where race is concerned is an absolute nightmare. In my experience though the only ones actually bothered by whichever term you use tend to be the same ones who claim you can't say Christmas anymore. The fact is the terms black and white are meaningless, we're all just shades of brown, just some are different shades due to genetic makeup, and some due to exposure to sunlight. Except vampires, exposure to sunlight tends to make their skin go a grey colour as it turns to ash...
Where Native Americans are concerned I prefer to refer to a friend of mine using his preferred term, Hopi :)
Teacher training in the early 90's (before I escaped into IT*), we were told those things in classrooms were either chalkboards or markerboards (after all, they might not be black or white). Before that, I lived in the Peoples Republic of Islington, where council cafes would not let you order a white or black coffee.
In the same era, I used to frequent a rather good Hungarian Restaurant in Soho called the "Gay Hussar" No-one blinked at the name, although now it is difficult to mention without a lot of explanation.
This idea that you cannot use particular words, in any context, for fear of causing offence has gone completely crazy.
*For a suitable definition of "escaped", probably involving a frying pan and a fire
"Before that, I lived in the Peoples Republic of Islington,"
A very long time ago, when David Blunkett was in his pomp, I went to a couple of talks by a pathologist from Sheffield. His standard opening (maybe not the best term in relation to a pathologist) was "Greetings from the People's Republic of South Yorkshire".
when my wife referred to the doll as "African-American" the woman became rather upset about the politically-correct terminology. "It's black, honey!"
To be fair the correct PC terminology could have just been changed to "black" and she'd missed it. It's harder to find umbrage to take if you can't keep wrong-footing the public.
I was called by someone seeking to complete a security check on me and wanting to ask for some details about my family.
I understood the need and politely asked how I could be sure the caller was who he said he was, working for who he said he was.
The caller said he would email me with his phone number. The email arrived on the proper channel with the correct letterheads etc.
I too a minute to reconcile that info against the Exchange records for him.
Then I called him back and we got down to the business of letting me keep my job.
No unpleasantless was involved on either side. I had some explainable holes in my security profile and he was tasked with getting the explanations from me. No need for warfare.
The PA was perhaps out of his depth but erring on the side of caution. The proper way to deal with this would have been (in my opinion) to request an update of the tag info via the ticket system and move on.
I'd also add that misusing the power one's position confers is an all-too common tactic in IT, but is unprofessional and unethical in my opinion. Changing the password was a step too far. At that point I, like a few others here, have a different view of who was being the thing that rhymes with banker.
"If I give you a piece of information about your account, you then give me the next piece of information..."
In my case it was "ok the first part of your postcode is ..." "Ok what is the rest of your postcode?" which is the point at which I told him I didn't want to play that game.
What Mike could have done using that technique though would be to proffer the Monitor Asset Number and then ask for the one on the box below.
I'd rather not talk to anyone, especially as my users are not the sharpest spoon in the toaster - I communicate primarily by e-mail & asset info can be retrieved in a number of ways.
At one place I used to keep my own records of PC's & serial numbers for easy service calls under warranty.
I frequently astound colleagues on new contracts or employment by carrying my own barcode scanner as part of my toolkit.
I turned up on one site with two field teams trying to record asset tags & serial number information on to printed out excel worksheets with fields too small to legibly write in the information that they should have recorded at the time of deployment. I just strolled to each desk in my assigned area & scanned in the info leaving the grumbling & mumbling of the others in my wake.
Project manager was glad that in my case she didn't have to spend the rest of her weekend interpreting 1/15th of the information.
..that when someone managed to forget their password 3 days in a row, changed the user's password to "Iamadumbass123456" or similar. Another trick was giving a PITA user a password like $%^&dhKn4*.r5xTz-_ I've been tempted, but never been that unkind.
When the company I worked for was going through bankruptcy, some of the passwords were quite entertaining in a dark way. And I've had users that didn't want to give out their password because they were embarrassed by them. One big, macho guy had "69Kissypoo69" as I recall..
And got some regular calls from users all over the United Snakes. Really good folks who needed help (and often passed my name and number on to their co-workers in other cities). I didn't demand tickets (and in fact, preferred to NOT have to work them) and tried to get their issues fixed ASAP. Sometimes they were in other offices which made verification of the fix not possible that date and would be checked later.
BOFH - not hardly. I liked my job and my users and i think for the most part we got on well. Company forced me into retirement - i guess they C suite wasn't making enough.
""IanTP
Pint
Thanks Richard, I must have missed this gem on Friday as it's now 2am Sunday morning with a bottle of Haig Clubman on special. Have one on me""
You should be SO LUCKY - here am I in Hong Kong infested with 'Enemies of the People' i.e. the Weaponised 'Guardians of the Law' - and every week, without fail, I HAVE to wait till sometime after 14:00 (06:00 GMT) before "The Reg" for Friday finally arrives in my e'mail box.... on MONDAY !
Logistics? You don't even need to go that far.
Not IT, but an acquaintance got $900 from her mum, who told her "go buy some eggs". She was meant to buy a single pack of a dozen eggs, and the rest of the money was meant to pay the bills, the extra money was *accidentaly* handed to her. 5 bucks would have done it. But....
She bought $900 worth of eggs. Of course.
That's a FULL DELIVERY VAN of eggs, no matter which part of the World and how devalued your currency is. They ate all forms of eggs, from scrambled to cooked to Portuguese cakes that take large amounts of eggs, for 2 weeks.
Icon, because they "ate this".
RAAF Butterworth, Malaysia late 1960s.
Air servicing Flight engineer ordered 2 split pins Pt No 26FP/2.
New 'puter system in supply control flight ordered same but should have run a check and the order should have been 28FP/2.
Few days pass and aircraft (special flight) arrives from Singapore with our 2 26FP/2 Shackleton main planes.
......... and just to confirm, I placed the order!!!! ...... and I still have nightmares!!!!!!!
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
