News for hackers. Stuff that matters.
Re:White hat social engineering: How to become an admin of a... by motohagiography on Wednesday May 13, 2020 @09:04PM (#23173928)
I see these people coming. They are motivated by power for its own sake, and their playbook is limited.

Take heed of this post, it's how the incompetent rise.

Re:White hat social engineering: How to become an admin of a... by ueu33hyrdd on Wednesday May 13, 2020 @10:17PM (#23174480)
It's also how the competent rise though, in #1 they not only service a need but they identify that need on their own and in #4 they're completing tickets that are chosen partially based on how popular their resolution will be. What's the alternative, choose admins at random and ignore the people who have shown the most promise for understanding and contributing to tasks related to being an admin?
Re:White hat social engineering: How to become an admin of a... by theamk on Wednesday May 13, 2020 @11:21PM (#23174912)
If people are only competent, they would not do #5 and #6.

If people are actually going to make an effort to kick people out to cement their position, then it is better to restrict their access, before they do too much damage. Getting one person who services the need is not worth it if they kick out everyone else.

Re:White hat social engineering: How to become an admin of a... by Thorentis on Thursday May 14, 2020 @12:08AM (#23175168)
> If people are actually going to make an effort to kick people out to cement their position

If the only reason is to cement their position then sure, but there are good reasons to limit the number of admins. The more admins, the more attack vectors for serious social engineering, the harder change control is, the longer meetings go for, the harder it is to make necessary change, etc. etc.

I think if somebody cares enough to become an admin and shows they care about the users then I don't mind them getting a power trip out of it. It's the "admins" that got there because they know the boss, or because they convinced somebody they should have access because their job-title entitles them to it that you need to look out for.

Re:White hat social engineering: How to become an admin of a... by EdwardDiego on Thursday May 14, 2020 @01:38AM (#23175741)
Being a JIRA admin is a pretty lousy form of power. Right up there with being a Slack admin.
Re:White hat social engineering: How to become an admin of a... by user5994461 on Thursday May 14, 2020 @07:00AM (#23177999)
It's the opposite of power, it's like being downpromoted to janitor. Now you're the one having to clean jira tickets. Grunt work to add a field or setup a plugin for every manager who feels important and a hard-to-maintain software.

If you want sysadmin power, get DNS access or AWS admin or active directory admin or root on all servers.

Actually, the jira admin probably grants more "power" and visibility onto every manager who's got to come to you for tickets. So it makes sense for politics.

Re:White hat social engineering: How to become an admin of a... by blaser-waffle on Thursday May 14, 2020 @10:15AM (#23179782)
In an Org there are the actual roles and official power structures, and then there are the unofficial or de facto power structures.

The AWS or Network owner may have the keys to the kingdom in terms of provisioning access, turning off routers, running arbitrary code on things, etc. but that also comes with great responsibility. If you fuck around and break something on accident, or shut down a router on purpose, there will be consequences. You may spend 150% of your day putting out fires and getting yelled at by senior leaders for application-killing lag or outages.

Meanwhile JIRA guy gets to shift blame and interface with leadership. He may not have any power, but depending on the org, he could have a bunch.

When I worked for an ISP -- a big one, chances are everyone here has heard of em -- one of the most powerful people in the PMO was essentially a secretary ("project coordinator") who had the ear of the head of the PMO, the VP of Engineering, and the CTO. She smoked a lot of cigs, so if you could make it to that smokers circle you could twist some powerful levers...

Re:White hat social engineering: How to become an admin of a... by rwnspace on Thursday May 14, 2020 @05:40AM (#23177466)
I am continually reminded of this essay by Mark Chapman, "Geeks, MOPs, and sociopaths in subculture evolution" [0]

[0] https://meaningness.com/geeks-mops-sociopaths