Years ago, I worked at this place, they tried to install these new core routers. The first core router worked fine, but connect the second and the whole campus network would go into meltdown.

The network team could not work it out. The vendor could not work it out. But one of the IT managers had an explanation: me. Firstly, it was due to an OpenVPN I installed on a server (with permission-as a stopgap measure so we could remotely access the “next-gen data centre” because the networking team was taking too long to get the real VPN installed and it was blocking other teams on the project.) The explanation didn’t make any technical sense: the VPN is just an application, nothing to do with the core routers; but he wasn’t technical enough to understand that. They told me to shut it down, so I did (even though doing so inconvenienced the project), and lo and behold, it made zero difference to the problem. Then, he apparently even suggested at a management meeting (I wasn’t there but I heard about it) that I was sneaking in to the data centre at night or on the weekends to sabotage things, and that was why the new routers didn’t work. Apparently they even asked campus security for my physical access logs, which revealed I hadn’t been doing any such thing.

Eventually, the vendor worked out the problem. When you install the router, there was a step you had to change the VRRP IDs to give every router a unique ID on the network. Clearly explained in the documentation, obviously essential, apparently our networking team didn’t read that part. You plug one new router in, everything is fine; plug the second one in, well it still has the OOTB default VRRP ID, so now two core routers on the campus network have the same VRRP ID, and all the other routers got confused, and the whole thing fell apart. Both our networking team and the vendor’s support team were so focused on chasing some obscure bug they didn’t see the basic config issue.

Wow, I'll keep this in mind next time I complain about my manager.

r/talesfromtechsupport is full of these sorts of stories. I make a visit on days when my job is frustrating and inevitably feel better.

Did that IT manager ever apologize for accusing you of being the problem?

I don’t remember him ever directly apologising, although he was nice to me afterwards (and this was many years ago, memories get hazy). I think he was rather embarrassed by the whole incident, it turned out to be such a basic configuration issue and it took them so long to solve it. I only knew about the whole “sneaking in at night” allegation because my boss told me what he’d said at meetings to which I wasn’t invited, and I don’t think my boss was supposed to tell me what was said in those meetings, so I’m not even sure if he knew that I knew he’d accused me

Lots of these folks (like the governor) don’t even know the basics of IT. Zero knowledge. You can tell them anything and it will stick.

All hacks are ”sophisticated” because otherwise the other party would be ”dumb”

Hey, the only people we have to convince that it's not hacking are the insurance companies. When they start charging their clients for their absurd levels of risk and liability, we'll start to see actual change.

I very much want the blame to be on the person who broke into my house regardless of whether my door was locked or my window was open.

Which works great when there's some kind of access restriction in place.

If you wind up putting your tax returns in the 'little free library' you set up on your front yard, you can't blame others for reading them, then handing them back to you and not telling anyone else.

That's the proper analogy for what happened in the original article.

This doesn’t track at all. This is me telling you that your forms are on my desk and throwing you the keys to my office. And then after getting your papers you go rummaging around other stuff.

Like sure I’m accepting a risk that you could do that but you’re still a dick if you actually do.

Content you're serving on a public URL is content you have published. It's not your house and you didn't extend anyone any trust or limited access. You put it in The New York Times. Maybe you hoped no one would find it because it's on page B30 and most people only read A1. But people are allowed to read page B30 if they want to.

The point is that there's no keys involved, nothing in your private office. No rummaging either.

Publishing to a public web server is analogous to that little free library, out in the yard. No keys, anyone can look in it at any time. If you accidentally put something sensitive in there, where anyone can see it without any access control, you can't blame them for doing so.