Of course the whole situation was less than ideal to begin with, but now it's even worse.

In my experience, most... don't.

Enterprise IT at non-tech companies is an absolute #&@_ show. The only rationale I've been able to come with is: if some portion of your company isn't developing / keeping up with tech trends, your IT shop isn't going to be pressured to either.

True story: A friend was pentesting a large company network in Germany, wrote his report and got paid. Years later, when being hired as head of IT security, he pulled out his old report and simply tried the default/easily crackable passwords he had discovered in the core infrastructure: They all still worked.

If his section about "use jump hosts" was ever useful for the company, it was because someone had that page open by accident, needed a place to put down his mug of coffee - et voila: His report even made a difference!

This year is going to be huge for Google cloud and m365.

I had one of those jobs for a while. It was awful. The worst part was the ridiculous demands (example: all bugs should be fixable in 30 minutes or less) on top of the embarrassingly low pay.

Half of this is actually the right way to do it. On one hand undervaluing IT in almost any company these days is a major problem waiting to blow up. IT isn't just an end, it's the means to do everything else. Using computers but ignoring any good IT practice under the excuse that it's not an IT company is like working from an office with asbestos, lead paint, and black mold because you're not a construction company.

But on the other hand non-technical companies, meaning ones without a strong IT culture and focus, should undervalue programming expertise. One of the worst things a non-tech company should do is deploy all kinds of custom IT solutions developed internally by their "programmers with expertise". Invariably (and I mean this in the most literal sense possible) they will end up with a patchwork of systems that nobody understands or maintains properly but which underpins all the core services the company needs or delivers.

So...no, undervaluing programming expertise is never a good thing, whether your particular needs are for a lot of programming or only a little. Either you need exactly zero programming—in which case undervaluing it is impossible—or you need some—in which case you need to value it the right amount.

In general precision is important but in this case it doesn't make that much of a difference besides a linguistic discussion. Let's try to look beyond it and more at the point I was trying to make: In the companies referenced above, as I understand them, valuing "programming expertise" at all is setting yourself up for disaster. You'll be tempted to use it but pretty much by definition in those companies you have no ability to support the outcome long term. Even tech focused companies have a hard time keeping up with the custom solutions they develop and are struggling with technical debt.

If you worked in these companies you know how this goes and have seen the story countless times. IT manager of small IT dept has a "great idea", hires some people to implement it, and they get it sort of done with the limited resources. Pretty soon both the techies and the manager move on to greener pastures, leaving the solutions in the hands of someone with little to no interest in it but who has another "great idea". The best solutions are manageable ones and custom stuff is hard to manage in the best of cases. Programming expertise is like a live grenade, only useful in capable hands (which "non-tech" companies are almost without exception not).

Perhaps your second is IT being overvalued? You've described a situation where technologies are being deployed inappropriately by an organization ill-equipped to handle the ongoing effort required. This is the sort of silver bullet thinking I would expect from leadership that does not understand IT beyond that it is powerful.

I took the archetypal "non-technical companies" you gave as an example earlier. If I understood your meaning correctly in the vast majority of those cases undervaluing "programming expertise" is probably the best thing to do. And by "undervaluing" I mean they such companies should not consider this as a skill they should rely on to build their IT around.

It's not that the skill is not useful in itself, just that it doesn't serve that type of company well, and valuing it suggests the companies are considering heading in waters that they're unlikely to successfully navigate.

Most of those companies will do things inappropriately because they are ill-equipped to handle this. For all intents and purposes "programming expertise" in such a company is like driving drunk. Sure you can get home safe anyway but that's not a reason to be proud of. Or you can crash but the real issue isn't that you couldn't cut it while driving drunk. You shouldn't be doing it to begin with.

The first: I am a competent employee, who can do what needs to be done (in whatever technology).

The second: I am a forward-thinking planner, who surveys and keeps abreast of options and can identify, test, and deploy appropriate ones.

In my experience, it's the second that's lacking. Aka the "we can only deploy if Microsoft holds our hands through it" shops. Usually 1/2 because of lacking talent and 1/2 because of lacking / incorrect policies.

I've seen, but haven't seen too many, instances of "insert crazy state-of-the-art technology." Usually it's just institutional paralysis that prevents anything from getting done.

They might also be unable to know if a job applicant is good at IT or not? And listen mostly to how he/she describes him/herself, and how confident he/she sounds?

Meaning, the company in effect hires IT people a bit randomly, and then mostly finds people who aren't that good at their job.

And if the company started paying more, then, more competent people, but also lots of more so-so competent people, would apply for the job? And I wonder if the company then still ends up with a random mediocre IT people who are unable to really secure the network? Just that the salaries are higher?

I wonder if the underlying problem is that 99% of the population is unable to know if someone is good at software or not

It's a sh*tshow everywhere.

Which means they rely on those companies to do the right thing, while not really prioritizing the work (i.e. not giving it much budget), or being able to critically evaluate the quality of the work being done.

So none of this is surprising.

There may be some room to question the general technical expertise and competence of a shop that runs a bunch of Windows 7 systems, though. IT running beyond the limit of their competency may not be capable of doing what you so wisely and rightly point to.

Or they may simply not have a choice.

My company has a particular automated machine that I have to work with once or twice a month. It is controlled by a computer that runs Windows XP. It can only run Windows XP because the company that made the software went out of business years ago.

Because of that, the control computer is not permitted on the public internet. When I interface with it, it's using a dedicated laptop through a VPN to a remote session which then accesses the control machine on a dialup connection. It's slow as heck, but since I only have to do it once or twice a month, I deal.

Just before the pandemic, we looked into replacing the circa 1995 automated machine with a new one. Because of the nature of the machine, and the local government regulations about replacing it, the cost would have been little over one million dollars. Not going to happen.

Everyone hates it. But that's why my company's IT department, which tries hard to keep up with the times, has a single Windows XP computer in its stable.

Changing out the part for an unapproved one, obviously, voids the certification.

Not all machines are computers.

He isn't entirely oblivious about security, has his hard drive encrypted and encrypts some of his calls, but the non-updated system is a disaster waiting to happen.

A humble brag!

There are some very elderly machines out there.

For example, Sam needs to use a corporate network, doesn't really understand "apps" or what a "TOTP" is, so they optimize (weaken security) to allow them in.

I'm sure today's 60-year-olds are still perfectly good at the kind of things they've been doing since they were 20.

Haven’t had much use of that lately.

I think a better descriptor would be "app-native" -- i.e. "I don't understand or care how anything computing works under the hood, and it'd better be tied off with a pretty bow and UI."

So yes, I have no idea how things I don't use work. This isn't that I'm unwilling to think, things are more open ended.

The more likely reason you're noticing is that thanks to covid, and the accelerated death of real news services, combined with the echo chamber effect where we're all reminding each other of how bad things are, means you're getting more exposure to sensationalism, because that echos the best. And hacks certainly qualify as sensational, especially on slow news days, where news services desperately need clicks, and "X got hacked" gets those (even if it's a report on a hack that isn't actually one, like when someone walked into a data container with tens of servers, one of which happened to be rented by a password manager).

The real wtf is what happened in 2017, though.

[1]: https://nvd.nist.gov/vuln/search/statistics?form_type=Basic&...

What do you consider a big news item that isn't "sensationalism"? (Your link timed-out)

This global situation is specific because a lot of people are working remotely so they easier to target and compromise then before.

In the last decade or so a lot of businesses moved their presence and other ops online and lots of them practice poor cyber security that's why you see a lot of hacks happening.

Speaking of big companies they are always targets of state sponsored attacks and industrial espionage.

I feel like with a lot of security or cyber-crime stuff there's a "physician who smokes" dynamic to it where the people who you expect to have great security actually often don't take a lot of precautions. How many hackers end up being exposed because of fairly trivial or random accidents is actually surprising.

Veterans of many years are the ones who get too comfortable, and too complacent. I guess the confidence of many years leads them to work a little too closely to the blade.

This might be a universal human trait, across any industry.

Getting the SSH pubkeys of other developers is easy. Grab them from github or from a shared server or ask them once. Then use age/rage to asymmetrically encrypt the secret you want to share. No password has to travel in cleartext anywhere.

And one in which many countries i.e. Russia, Israel, China, Saudi Arabia, North Korea did not want Biden to win and who have a record of state-sponsored hacking.

Solarwinds and the Microsoft compromises for example are clearly at a scale beyond your regular criminal hacker.