News for hackers. Stuff that matters.

A comment on I usually run 'w' first when troubleshooting unknown machines. Parent comment

Re:I usually run 'w' first when troubleshooting unknown mach... by jameshart on Tuesday March 27, 2018 @07:59AM (#16687442)
Why take the risk of continuing to run a tainted host, though, if you can just tear it down and spin up a new, clean, untouched one?

I think there’s another level we need beyond treating servers as pets or cattle, which is treating servers as wild animals; after you’ve captured one and interacted with it, you’ve doomed it because now it has the scent of humans on it.

[ Parent | on HN ]
Re:I usually run 'w' first when troubleshooting unknown mach... by subway on Tuesday March 27, 2018 @09:53AM (#16688336)
Sure, but that does nothing to prevent the person who invoke the debugger from inadvertently triggering prod alerts, possibly encouraging more folks to ssh in to see what's going on.
[ Parent | on HN ]
Re:I usually run 'w' first when troubleshooting unknown mach... by gowld on Tuesday March 27, 2018 @10:46AM (#16688919)
Good hiring and training practices prevent people from invoking the debugger on live prod machines
[ Parent | on HN ]
Re:I usually run 'w' first when troubleshooting unknown mach... by subway on Tuesday March 27, 2018 @10:52AM (#16688978)
There are times when it has to happen. It certainly shouldn't be an every day occurrence, but even in the best environments, there are times when SHTF only under a production workload, and you need an understanding of why yesterday.
[ Parent | on HN ]