News for hackers. Stuff that matters.
Re:ServiceNow Insecure Access Control to Full Admin Takeover by NikolaNovak on Friday July 07, 2023 @06:21PM (#36639048)
What makes it so bad?

We are likely to get it next year . I feel it cannot be worse than the aberration we are currently using but I could be wrong :-/

Re:ServiceNow Insecure Access Control to Full Admin Takeover by vxNsr on Friday July 07, 2023 @06:28PM (#36639099)
It’s secret super power for executives is GQL it’s easier to use vs SQL and the interface looks slick compared to what’s out there.

A very well architected instance looks and is pretty good, the issue is that often large enterprises will hire the cheapest possible consulting firm to implement it, and you can really screw it up if you’re not careful.

Re:ServiceNow Insecure Access Control to Full Admin Takeover by NikolaNovak on Friday July 07, 2023 @06:32PM (#36639126)
My background is ERP so that sounds similar then - the bones may be decent, but how you implement it can make or break it, both as IT exercise and as business transformation / process implementation; is that About right?

I will likely have some input on how it's implemented and particularly the processes. I guess I should start reading up on best practices etc...

Re:ServiceNow Insecure Access Control to Full Admin Takeover by Karrot_Kream on Friday July 07, 2023 @07:22PM (#36639579)
This seems to be the big problem with ERPs. Problem domains are complex so you need implementation flexibility, but with that comes the ability to create shitty systems that everyone hates.
Re:ServiceNow Insecure Access Control to Full Admin Takeover by vxNsr on Saturday July 08, 2023 @10:59PM (#36651069)
Yes, servicenow is much closer to an opinionated ERP vs a simple ITSM platform. In fact they’re working pretty hard on making it easier to implement your own erp type process in snow, instead of using it for only your item needs.
Re:ServiceNow Insecure Access Control to Full Admin Takeover by notyourwork on Friday July 07, 2023 @07:48PM (#36639775)
100% this - I used to do enterprise integrations in the early days of ServiceNow. It's not a bad platform, consulting companies can suck (most do) and in-house implementations usually suck for different reasons.

ServiceNow is a combination of data modeling, interface and process design along with carefully balancing how to do things. Most of my time was in the CMS and SOAP integrations.

Re:ServiceNow Insecure Access Control to Full Admin Takeover by genmud on Friday July 07, 2023 @07:12PM (#36639477)
You could be wrong... I worked at a place where we had like 20-30 different ERPs and they got SAP as a way to centralize the entire thing on one platform. However, during the migration they managed to recreate interfaces that resembled the old workflows people were used to, effectively having 20-30 customized SAP UIs with a common backend.

It became such a clusterfuck the vendor (SAP) who we paid MASSIVE amounts of money to, wouldn't support their own software.

Thanks for coming to my TED talk, try to run as vanilla as possible.

Re:ServiceNow Insecure Access Control to Full Admin Takeover by NikolaNovak on Friday July 07, 2023 @08:06PM (#36639891)
Thanks, appreciate the perspective. But I've been implementing peoplesoft for, dear god, quarter of a century now, so I'm familiar with that unfortunate pattern. I guess I'm more wondering is service now inherently so bad it's unsalvageable, or is it a matter of good vs bad implementation, and resulting business transformation (or lack thereof :).
Re:ServiceNow Insecure Access Control to Full Admin Takeover by Aeolun on Friday July 07, 2023 @08:53PM (#36640212)
It’s like, navigating through servicenow immediately tells you that the people that build it were used to doing RPC, and didn’t quite understand how HTTP or HTML worked. It goes downhill from there.

I think at some point they decided to hire a few frontend engineers to do some form of SPA, but now it’s so badly integrated that…

Jank! Jank everywhere!

Re:ServiceNow Insecure Access Control to Full Admin Takeover by calvinmorrison on Friday July 07, 2023 @10:10PM (#36640685)
I have this quote bookmarked, about ERPS:

"Most companies spend way too much time and money trying to make software work for their processes. Some of these processes haven't changed in years or even decades. Rather than customizing software to work for your processes, it's often easier to reevaluate processes around modern software."

You can have your ERP customized, but you cannot have your cake and eat it (without cost). Ramping up new trading partners, onboarding new staff, whatever it is.

One reason accounting people have it easier than us tech people is they've got a very good clear process. It's rare that anyone mucks with Accounts Payable / Accounts Receivable / Payroll.

So yeah, go on pretending your SMB that manufactures/ships/resells/distributes product/service _________ is unique and needs your own processes, it _will_ bite you in the butt.

Re:ServiceNow Insecure Access Control to Full Admin Takeover by Sylamore on Friday July 07, 2023 @11:55PM (#36641225)
>try to run as vanilla as possible.

I can't emphatically agree with this enough.

I've worked on a Siebel 7.5 installation that was so heavily customized by a certain DBS TV company that it's still running to this day because upgrading to a current release means starting over from scratch. There are efforts underway to migrate it to SalesForce but that's been in progress for 3 years and still not far enough along to cut over.

Re:ServiceNow Insecure Access Control to Full Admin Takeover by inferiorhuman on Friday July 07, 2023 @07:18PM (#36639536)
We used it locally at megacorp in place of the standard JIRA instance. As an end user I disliked it because it was painfully slow and the interface was awful. It broke browser navigation, if there were permalinks they were nearly impossible to find so most things couldn't easily be bookmarked, filtering was tedious and unintuitive. Some coworkers tried to write CLI tools and the API turned out to be as awkward as the web UI.

Ideally we would've just thrown more money at CloudBees, but there was no political will to fight for another paid JIRA instance. I'm sure there are worse tools than snow but I'd just as soon never use it again.

Re:ServiceNow Insecure Access Control to Full Admin Takeover by kneebonian on Friday July 07, 2023 @11:23PM (#36641089)
The best answer I can give you is that if you guys get it fully implemented next year you'll be able to have the first screen load, and if you're lucky run a query to completion the year after that.

Not because you need to implement anything, or configuration reasons. That's just how long it takes to do basic things.

Re:ServiceNow Insecure Access Control to Full Admin Takeover by cjmcqueen on Saturday July 08, 2023 @12:19AM (#36641311)
Many places to start, but I would say SN lacks a strong engineering culture, so everything is driven by sales and profit. That means updates come every 6 months with "features" that will never get proper support. It's shiny thing stacked on top of shiny thing and it's just a mess