Topics

Over the years, I've worked with a number of products. Some of them start out easy to use and stay easy to use. Some of them started out easy and then got harder because they added a bunch of features and didn't take time to clean up the GUI when integrating them or - worse - there's a totally different GUI for the add-on and it's way different from the one I got used to. And then there are the ones that didn't add features, but they did ruin the GUI and chose to double down on the crap instead of rolling back to what I was comfortable with.

A change in GUI is like inviting the competition in if the product doesn't have a "revert" button. I can see wanting to have a new look for marketing and sales purposes, but the daily users of the product likely have lots of memories attached to what they're doing and how they're doing it and changing everything makes them feel useless. Replaceable. Unimportant. Judged by the makers of the product and found wanting. And that makes it easier to burn a bridge and move on.

https://thebulletin.org/2025/09/the-risks-in-the-protocol-connecting-ai-to-the-digital-world/#post-heading

model context protocol (MCP) is comin' to town, best get ready.

It runs on HTTP according to docs here: https://modelcontextprotocol.io/docs/getting-started/intro

So, I hope it can also run on HTTPS, but then there's the fun times about making sure all the encryption is done right and is made quantum-resistant when those ciphers are ready.

Communicates via JSON over HTTP.

I need to read the rest of the articles now... 

Well, I signed on at ISC2 and I'm going to work on clearing the intro cert for cybersecurity and then going on to the cloud and AI certifications, whatever they got there. This is self-directed training on my own dime and time.

Internally, I'm going to work more on product training in Cloud / AI areas and getting up to speed in those venues. Traditional network stuff I got down very well, and finding out that AI security is basically an IPS/WAF for the AI inputs and outputs helps to put that security in context.

https://apps.dtic.mil/sti/pdfs/AD0758206.pdf

Save it locally and refer to it every now and then. I first read this about 10-11 years ago. It is incredible how the author describes the world of IT that we have today. While technologies for connecting, storing, and processing information have improved over time, security has not. It has *always* been "somebody else's problem." Software guys aren't the only ones - there's some pretty bad security on every piece of hardware we use. Not "almost every". EVERY piece of hardware.

While I don't want to disconnect the PCs, power them off, melt them down, and then bury them under a mountain and then push the mountain to the base of the Marianas Trench, I *do* think that having everything interconnected is, on the whole, a bad idea. When I think about the technology I'd miss if I was living back in 1979, smart anything and Bluetooth are not on my list. All I need my fridge to do is to refrigerate things and have a frost-free freezer. My dishwasher should wash dishes. My lightbulbs should make light. I'm good with all that plain Jane stuff. By interconnecting all that stuff needlessly, we've increased our vulnerability to being trapped by our own technology when it fails us at scale.

The CrowdStrike-Windows mess is just the largest mess *thus far*. Bigger ones await us because no matter what happens here, security will always be someone else's problem.

A gut-punch of a story. CrowdStrike pushes an update to its agent globally, wrecks tons of systems because it's broken.

Yes, I want security updates fast and furious to keep ahead of the baddies.

BUT

I also want my mission-critical servers in banks, airlines, and health care to not crash because of a security update.

 

https://www.independent.co.uk/life-style/quiet-vacation-work-remote-jobs-b2580849.html

Like "quiet quitting", but you still like your job. You just don't disclose where you are when remote... 

"Could you please delete this S3 instance I created by mistake?"

***

THREE HOURS LATER

***

Finally found the guy that has root access with his email and he was able to log in and delete the S3 bucket.

ZERO help from Amazon's automated AI-augmented help system. It offered up code that had been deprecated and would do things bit by bit, instead of calling out a full solution. At the end of the day, none of those things worked and we had to get someone to log on as root, which was another ordeal in and of itself.

Amazon Web Services I now consider to have poor support and self-defeating security mechanisms. When the creator of an object, let alone a full admin, can't delete a simple S3 bucket that was created by mistake, there is a serious flaw in their processes and policies.

Had a discussion about the suitability of spine/leaf for enterprise networks and I was surprised to see there being actual vendors with products for wall-to-wall spine/leaf. Others tend to emphasize traditional switching for environments outside the data center, so I'm wondering... does spine/leaf make sense outside the data center?

And there are security concerns for all the products that need to do full packet capture and deep packet inspection... how would they accomplish that in a full mesh environment?

Question that I'm stumped on - we're trying to add a Fortigate controller for Fortiswitch into Forescout.

We got to the part where we add a Rest API account in Fortigate, but the option is not there in the drop-down menu.

Is getting the API user something that has to be turned on in the CLI or is that a licensing option, sold separately?

The biggest difference between Zero Trust (ZT) thinking and earlier design concepts is that ZT means there is *no* trusted zone. There is *no* area of the network where we can safely assume that only the Good Guys are doing things in. Assume a breach can happen from any direction, starting in any location. Where you are not looking is where the attacker is preparing a base of operations.

Taking a step back from plunging into raving paranoia (which can be a good career choice, should you want to be deeper in security), ZT networking means the end of the flat network where everything can reach everything else. It's about determining what communications need to go where and permitting those and no more. The reason? Attackers, being unfamiliar with the network, will do probes and recon missions that go all over the place so they can plan their next moves. Blocking recon at the start makes things that much more difficult for attackers.

Which means they go the human route more and more - intimidation is on the rise as a component in cyberattacks, which means our own employees are more and more likely to use their access to permit attackers' entry and operations. Therefore, we have to keep an eye on those employee credentials, making Identity Management a critical pillar of ZT. No more assign users to groups and give groups rights on the network: assign users to groups and group members can check out temporary credentials to perform tracked and monitored functions.

Is this a bit police state-y? Yes. Yes, it is. If you read histories of how the East German secret police, the Stasi, ran operations, you will see ZT shot through their thinking. I abhor everything the Stasi stood for - oppression, silencing voices, totalitarianism - but at the same time, I can learn from studying them. By no means do I ever want to go as far as keeping scent samples on people so I can track them down with dogs or develop planar discharge mines to kill only people (or animals, as it turned out) who tried to cross border fences. But do I see a need to track and record all admin actions? Yes, I do. Most won't be reviewed, but if a forensic investigation arises, we want those for the investigation, 100%.

Looks like we got to re-do the plugins to hunt down their 2.1.4 equivalents and fix up the look and feel to get back to where it was. Also need the logo in the upper left.

Don't click on the "More" by the smilies unless you want to have a pop-up block your post with no obvious way to close it. Hitting refresh will clear the pop-up as well as anything you typed before that. 

For me, it's Baldur's Gate 3, really hard. MAN this is a great game. I've put in 127 hours since release and loved all them hours, so hell yes that's value for my entertainment dollar.

I like dealing out remote damage, so I have a party with a rogue, 2 rangers, and a sorcerer. Hand crossbows are the way to go in this game. Coupled with the sharpshooter feat, they can deal out massive damage and the battle's over in a round.

Remember 10 years ago when all this was pretty much about to start or just getting going? Well, it's time to look back and ask - how much have these techs changed what we used to do on the network and how much was able to stay the same?

For me, the cloud has absolutely done the most disruption in that the cloud environment itself is an SDN and is very amenable to automation. Costs aside, the ease of management in the cloud is a strong case for shifting up there. On-prem vendors have been scrambling to get cloud solutions together, and a fair number of them have some strong tools for the clouds, but they're also going head-to-head with cloud providers that push their own tools - Microsoft - and with vendors that started in the cloud, like Netskope and Zscaler.

I haven't seen much on-prem SDN. I have seen better automation on-prem, but it's typically limited to spinning up VMs and containers and running management tools like Cisco Prime.

What's everyone else seeing out there?

[A Special Message from Nick]

A Special Message from Nick

Nick is broken and getting fixed! After long avoiding it, I’m finally getting surgery for a torn rotator cuff in my shoulder. (If you’ve ever had this, you know it hurts like the Dickens!) This means my writing arm will be in a sling for about 6 weeks. Writing will be extremely difficult — more likely impossible, according to my surgeon — for part or all of that time. There are no little elves producing the Ask The Headhunter website and weekly newsletter. I write and produce all the content, and participate in the online discussions — always have, because

Join us for discussion! A Special Message from Nick

Nick is broken and getting fixed!

After long avoiding it, I’m finally getting surgery for a torn rotator cuff in my shoulder. (If you’ve ever had this, you know it hurts like the Dickens!)

This means my writing arm will be in a sling for about 6 weeks. Writing will be extremely difficult — more likely impossible, according to my surgeon — for part or all of that time.

There are no little elves producing the Ask The Headhunter website and weekly newsletter. I write and produce all the content, and participate in the online discussions — always have, because I like to mix it up with my readers.

While Ask The Headhunter goes on hiatus a few times a year for holidays and vacation, it’s never been for more than a couple of weeks. The April 25, 2023 column will likely be the last you — dear reader — will see until my arm can pitch fastballs again.

I’ll be back…

So you likely will not see a new Q&A column until the end of May or beginning of June. Your subscription to the newsletter will of course remain active, and as soon as my shoulder is fixed, it will appear again like magic in your e-mail!

In the meantime…

Please explore these popular Ask The Headhunter Resources:

The Basics

Ask The Headhunter In A Nutshell

Should I keep interviewing after I accepted a job offer?

What's Better: Quit or get fired?

Protect Your Job: Don't give notice when accepting a new job

Say NO to tests prior to an interview

Reductionist Recruiting: A short history of why you can't get hired

The Bogus-ness of Indeed.com

Ask The Headhunter Bookstore (and long-forgotten photo of Nick with a soul patch – urgh!)

The Q&A Archive

See ya soon!

I will have a little elf pulling up my e-mails for me periodically, so feel free to drop me a short note if you like — but please be aware that I probably won’t be able to reply. I still love ya!

Thank you for being part of the Ask The Headhunter community, and for your patience!

– Nick Corcodilos

Ask The Headhunter

: :

Join us for discussion! A Special Message from Nick

Source: A Special Message from Nick

[Compensation: Negotiate beyond money]

Compensation: Negotiate beyond money

Question I recently decided to leave a Fortune 100 company after nearly seven years. I accepted a generous severance package and have just been offered a good job at a small but growing company. I don’t think this company can match my salary demands so I would like your advice on compensation — how to negotiate professionally with them. Thanks. Nick’s Reply Job candidates can flub negotiations if they fail to recognize that there are two components to compensation. There’s money, and there’s everything else. If you ignore that dichotomy and focus primarily on the money, you miss the point

Join us for discussion! Compensation: Negotiate beyond money

Question

I recently decided to leave a Fortune 100 company after nearly seven years. I accepted a generous severance package and have just been offered a good job at a small but growing company. I don’t think this company can match my salary demands so I would like your advice on compensation — how to negotiate professionally with them. Thanks.

Nick’s Reply

Job candidates can flub negotiations if they fail to recognize that there are two components to compensation. There’s money, and there’s everything else. If you ignore that dichotomy and focus primarily on the money, you miss the point of compensation and you might forego a job you really want. Of course, if salary is the key for you, then much of this advice won’t be helpful. But if you’re open to alternatives to salary alone, read on.

What is compensation?

Compensation is not necessarily just money. An employer compensates, or “counterbalances or makes amends for” actions you have taken (that is, work you have done) for the employer's benefit. Viewed this way, compensation might have little or nothing to do with paying you money.

You might think I’m batty, but if you’re forced to negotiate with an employer who can’t meet your salary requirements, suddenly the idea of negotiating beyond money gets interesting. Let’s consider what compensation really means.

What is compensation for?

You devote time, effort, brain power, and perhaps muscle to do a job. These resources are all limited. You deplete them from your life as you deliver them to your employer.

For example, you take time away from your family so you can do the job. Who takes care of your kids? Who grows the potatoes for your dinner? Where do you find time to build a shack to shelter your family from the cold?

If you’re going to tend the job your employer needs done, who will take care of your needs? Simple: your employer. A company must compensate, or counterbalance, for what it takes away from your life — or you will not be available to do the job you're hired for.

What kinds of compensation are there?

An employer could provide you with housing. (Coal mines used to build entire towns to house their workers. We won’t get into how this system was often abused.) Or, it could give you food. (Restaurants often feed their workers.) In recent times, companies have provided on-site day care for children, or have allowed employees to bring pets to work. If your mortgage, meals, and child care were covered, salary might not be the only salient component of your compensation. You might instead focus on negotiating for a house rather than a shack; for education in addition to child care; and for steak rather than potatoes for your kids.

Did you negotiate for any of those things the last time you entertained a job offer? Maybe you should have, especially when the employer couldn’t cough up the cash you wanted. (See How I negotiate compensation.)

Of course, the list of potential forms of compensation is virtually endless and depends on the company and on you. The challenge is to explore the best, most reasonable alternatives together.

Compensation: Negotiate beyond money

Now, some of these examples are admittedly extreme. But when a company is strapped for cash, should you hang your head and walk away? For better compensation, negotiate beyond money. The smart job hunter knows to shift the negotiation to non-cash, non-salary forms of compensation. You can suggest acceptable alternatives and help the company identify ways to “make amends for” its inability to compensate you in cash. To do this, you must be able to express your needs in terms that can get them satisfied.

Cash futures. If a company can’t match your salary requirements, but you still want the job, don’t fight it. Instead, put other compensation options on the table.

These might include “cash futures”: company stock, an early review with a guaranteed raise, an incentive plan based on agreed-upon performance criteria, guaranteed severance upon termination, elimination of a non-compete clause, or a retention bonus payable once you’ve been on the job for one year.

Salary alternatives. Then there are indirect benefits, on which a company gets a discount (think tax write-off, too), but which deliver value to the employee: computer equipment and other technology to use at home, extended paid vacation, a transportation reimbursement, an expense allowance, child care benefits, a paid cell phone, education benefits, and tax advice services or even payment of taxes (not uncommon for executives).

Priceless time. There’s also quality-of-life compensation: flex time, sabbatical leave, unpaid time off and, nowadays, the freedom to work from home. Most people crave more control over their schedules. You won’t get paid for those summer Fridays off, but if a company can’t afford a full week’s work anyway, you still have a job to go back to on Monday.

Money is great because it's fungible. It’s an almost universal medium of exchange. It gives us the freedom to buy what we need. But when cash is tight, there’s also freedom in knowing how to negotiate beyond money to get compensated for our work in other ways. You must be able to discuss alternatives, because creative compensation terms might yield a job where there was none.

I'd never suggest taking a job that doesn't pay well enough, unless maybe if you're desperate. To be a really effective negotiator, you must be prepared to walk away from any deal that's not good enough. But before you walk away from a good job with a good employer that "can't afford you," try to boost the compensation — negotiate beyond money.

Have you ever foregone higher salary for something else important to you? Have you successfully negotiated beyond money? What are the top three forms of compensation for you? What’s the most unusual form of compensation you’ve received for your work?

: :

Join us for discussion! Compensation: Negotiate beyond money

Source: Compensation: Negotiate beyond money

[Just Say It: I want the job]

Just Say It: I want the job

Question I had a coffee with a potential manager in his company café and we discussed my past and current experience but it wasn't referred to as an interview. It lasted 1.5 hours. The final 30 minutes were with his manager, who dropped by. I never applied for a job and never shared my resume. We connected on LinkedIn and arranged the coffee through LinkedIn messages. I know he has a job opening (and one more coming up) and he confirmed that in our coffee chat, but he didn't explicitly say the chat was an interview for the job opening,

Join us for discussion! Just Say It: I want the job

Question

I had a coffee with a potential manager in his company café and we discussed my past and current experience but it wasn't referred to as an interview. It lasted 1.5 hours. The final 30 minutes were with his manager, who dropped by.

I never applied for a job and never shared my resume. We connected on LinkedIn and arranged the coffee through LinkedIn messages. I know he has a job opening (and one more coming up) and he confirmed that in our coffee chat, but he didn't explicitly say the chat was an interview for the job opening, so I am wondering how I can follow up without sounding like I am bluntly following up on a formal interview. I'd like to get feedback and want to know what next steps are. Should I send him my resume and ask whether he would consider me as a candidate?

Nick’s Reply

Don’t ask whether you’re a candidate. Tell him that he’s a candidate to be your boss.

This is the best kind of interview. It sounds promising, but we just don't know whether it's for one of the two jobs you mentioned or for something in the future.

Give the manager a signal

While you're worried this "non-interview" may lead nowhere, the manager may be waiting for you to tell him what's next. Many managers look for something few candidates ever display: motivation and desire for the job.

Having the right skills and experience is important, but I find that the best managers won't make a hire unless they see clear indications a person really wants to work for them. Motivation is at least as important as skills, which can be taught. The amount of time the manager spent with you is a strong positive signal — so signal back to him.

I want the job

Use your own best judgment, of course, but I think a simple e-mail is best, confirming your enthusiasm and motivation. For example:

How to Say It



"Thanks for the good conversation last week and for all you shared about your department (and for the coffee!). I'm impressed, and I want you to know that based on what I learned, I'd be very interested in joining your team if an appropriate position is open. You're the kind of manager I want to work for. Thank you for spending so much time with me."

Very few candidates ever come out and tell a manager "I want to be on your team!" yet that's what any good manager wants to hear – a commitment! What I'm suggesting is a very clear expression of interest without being pushy. I would not send a resume. If he wants it, he'll ask for it.

Show even more enthusiasm

If you want to go a bit further in showing your enthusiasm, find a really good article that addresses an issue that was discussed during your meeting. Attach it to your e-mail along with a couple of comments about why the manager may find it helpful. Show that you're already thinking like an employee.

When you make yourself this clear, you need not do anything else. The next move is the manager’s. Don’t keep pestering for a response. While you wait, the best next step for you is to move on to your next opportunity and pursue it the same way.

Nice work getting a meeting that's better than an interview! You had a conversation driven by your interests and the manager's — not by an "HR script." Whatever you decide, please let me know how this turns out. I hope something I've said is helpful.

(For more on the topic, check this article.)

Why do you think the manager invited the reader for coffee? Was this a job interview or something else? How should this reader follow up? Is “I want the job” the right message?

: :

 

Join us for discussion! Just Say It: I want the job

Source: Just Say It: I want the job

 

This *might* impact my productivity a wee tiny bit today...

I got friended by someone who claimed to be a fan of the music I play on my radio shows. I figured, sure, I'll roll the dice and accept the friend request - the personal account didn't have a lot of sketchy pictures and creepy-looking "friends", typical hallmarks of pr0n accounts.

It's now 3 weeks later and I'm getting probed for personal details and asked for pics of myself. Uhhh... my pics are visible in my account and my personal details aren't.  Nice long game, though. I'm thinking it is a person and not a chatbot - so if it is a chatbot, it's doing a hell of a job on the Turing tests.

So, yeah, don't hand out your deets online and give a cold shoulder to those who ask for them. Don't apologize - decent people understand and scammers will get outraged to try and pressure you into being "nice" so they can get the info and rip you off or worse.

Just read about a vulnerability in PaperCut, a paperwork reduction tool with a name that makes me cringe in pain, that's permitted a massive spike in ransomware among the customers of that product.

The fix is easy: apply the patch. What's difficult is knowing that the patch is needed, what with all the other alerts and emails everyone gets every day. What's also difficult is that the patch has to get scheduled, so as not to impact things... but then the ransomware guys get in before that window and then REALLY impact things.

I am sick of "five nines" metrics and philosophies. You get five nines until you DON'T, and then it stops hard. Really, really hard. After four days of outage due to ransomware, you're on one nine, the first one. Good news is that the outage has to be 36.5 days to lose that first nine, so you'll likely keep it.

I can get missing a notification when one is overwhelmed, especially in the public-sector, low-budget environments that are PaperCut's prime customer base. But when the notification to patch gets through, do not delay is my thinking. Apply at once and clean things up afterwards. If things go out, just call it "emergency maintenance" and it'll be up in a day or less. Yes, you took a performance hit, but no data was lost or stolen in the process. It's a good hit to performance, the way I see it.

[A Special Message from Nick]

A Special Message from Nick

Nick is broken and getting fixed! After long avoiding it, I’m finally getting surgery for a torn rotator cuff in my shoulder. (If you’ve ever had this, you know it hurts like the Dickens!) This means my writing arm will be in a sling for about 6 weeks. Writing will be extremely difficult — more likely impossible, according to my surgeon — for part or all of that time. There are no little elves producing the Ask The Headhunter website and weekly newsletter. I write and produce all the content, and participate in the online discussions — always have, because

Join us for discussion! A Special Message from Nick

Nick is broken and getting fixed!

After long avoiding it, I’m finally getting surgery for a torn rotator cuff in my shoulder. (If you’ve ever had this, you know it hurts like the Dickens!)

This means my writing arm will be in a sling for about 6 weeks. Writing will be extremely difficult — more likely impossible, according to my surgeon — for part or all of that time.

There are no little elves producing the Ask The Headhunter website and weekly newsletter. I write and produce all the content, and participate in the online discussions — always have, because I like to mix it up with my readers.

While Ask The Headhunter goes on hiatus a few times a year for holidays and vacation, it’s never been for more than a couple of weeks. The April 25, 2023 column will likely be the last you — dear reader — will see until my arm can pitch fastballs again.

I’ll be back…

So you likely will not see a new Q&A column until the end of May or beginning of June. Your subscription to the newsletter will of course remain active, and as soon as my shoulder is fixed, it will appear again like magic in your e-mail!

In the meantime…

Please explore these popular Ask The Headhunter Resources:

The Basics

Ask The Headhunter In A Nutshell

Should I keep interviewing after I accepted a job offer?

What's Better: Quit or get fired?

Protect Your Job: Don't give notice when accepting a new job

Say NO to tests prior to an interview

Reductionist Recruiting: A short history of why you can't get hired

The Bogus-ness of Indeed.com

Ask The Headhunter Bookstore (and long-forgotten photo of Nick with a soul patch – urgh!)

The Q&A Archive

See ya soon!

I will have a little elf pulling up my e-mails for me periodically, so feel free to drop me a short note if you like — but please be aware that I probably won’t be able to reply. I still love ya!

Thank you for being part of the Ask The Headhunter community, and for your patience!

– Nick Corcodilos

Ask The Headhunter

: :

Join us for discussion! A Special Message from Nick

Source: A Special Message from Nick