惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

D
DataBreaches.Net
SecWiki News
SecWiki News
博客园_首页
人人都是产品经理
人人都是产品经理
博客园 - 聂微东
P
Palo Alto Networks Blog
V
Vulnerabilities – Threatpost
Project Zero
Project Zero
WordPress大学
WordPress大学
NISL@THU
NISL@THU
酷 壳 – CoolShell
酷 壳 – CoolShell
P
Privacy & Cybersecurity Law Blog
Jina AI
Jina AI
AWS News Blog
AWS News Blog
Scott Helme
Scott Helme
Martin Fowler
Martin Fowler
C
Cybersecurity and Infrastructure Security Agency CISA
Forbes - Security
Forbes - Security
H
Heimdal Security Blog
小众软件
小众软件
I
Intezer
A
Arctic Wolf
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
O
OpenAI News
S
Security Affairs
阮一峰的网络日志
阮一峰的网络日志
Latest news
Latest news
G
GRAHAM CLULEY
Blog — PlanetScale
Blog — PlanetScale
J
Java Code Geeks
N
News and Events Feed by Topic
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
V2EX - 技术
V2EX - 技术
Stack Overflow Blog
Stack Overflow Blog
www.infosecurity-magazine.com
www.infosecurity-magazine.com
L
LINUX DO - 最新话题
博客园 - Franky
P
Proofpoint News Feed
aimingoo的专栏
aimingoo的专栏
博客园 - 司徒正美
P
Proofpoint News Feed
S
Secure Thoughts
Google DeepMind News
Google DeepMind News
Microsoft Security Blog
Microsoft Security Blog
T
The Exploit Database - CXSecurity.com
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
C
CXSECURITY Database RSS Feed - CXSecurity.com
F
Full Disclosure
Security Latest
Security Latest

IT Notes - virtualization

IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes IT Notes
IT Notes
Stefano Marinelli · 2024-10-19 · via IT Notes - virtualization

Yesterday, I received a phone call.

It was from a client I worked with years ago, but I had lost contact with them in early 2020. Back then, I was told about an ongoing migration “to the cloud.” I gave my opinions (they have poor connectivity and a high need for reliability without significant investment, since they are a healthcare facility, and dozens of people, besides patients, would be stuck if services became unreachable). In 2015, I had set up twin local servers for them, syncing the VMs every 5 minutes to be ready to switch without the full burden of true HA. The setup was based on Proxmox, with daily backups to another location.

Yesterday morning, the internal person responsible for this called me in a panic. In one phone call, I discovered that:

  • They are still using that server - without any updates since 2019 (Proxmox 5.x).
  • They removed the twin server because, according to this person, it was “useless.”
  • They are using a Windows 2008r2 VPS in production as a main server and a VPS with Windows XP (!!!) to manage some external operations. This VPS “exploded” due to an error by one of their staff (!!!), and they don’t know if there are any backups or how to restore them.

None of these machines are accessible externally, but all are on a LAN with hundreds of devices. All on the same LAN.

I (politely) exploded, having been convinced for years that this server had been decommissioned. I had already stressed in 2020 the need to update the underlying infrastructure, explaining that the physical server dates back to 2015, that you can’t run such old software on Windows 2008r2 and Windows XP, and that Proxmox 5 has been EOL for ages. But they responded, “we are allocating funds for the new cloud setup,” even though their connectivity is unstable and the costs would be absurd.

I decided to help them anyway because I was thinking about the dozens of sick people stuck and waiting for services to be restored. I connected via VPN they provided, and luckily, I discovered that the backups were still happening daily (just as I had set them up years ago and last checked in 2019) and that they were intact. I restored the (small) Windows XP VM from the backup of the previous day, and they resumed working.

After resolving the emergency, I called back and explained that such a situation is inconceivable. They replied that they are still “planning the migration to the new cloud system” but need to adjust connectivity, configurations, software, VPN, etc. After 5 years. At that point, I lost my patience and, courteously but firmly, emphasized that while they are “dreaming” of a “cloud” they will never achieve (and have already paid tens of thousands for “design”), their entire operation runs on a stable setup that just needs to be updated. They have 8 locations, and now I discover they’re all like this. At any moment, an unsolvable problem could arise. But no use: all their IT funds are diverted to the “study and realization of the new cloud solution” - which, by their own admission, won’t be ready anytime soon. Maybe in a couple of years, maybe. I tried to alert the owners as well, but they insisted, “the project has started, a lot has been spent, and it cannot be stopped. And there are no funds for any further spending on the current infrastructure, not even 500 euros.”

I explained that, given their internal and external situation (non-excellent and unstable connectivity, without any prospect of improvement, especially for 2 sites), they need a local copy of the data, processed locally, and then, for security, always copied externally. But to no avail. Their “cloud consultant” has been “working hard” for years to migrate everything, but there are “many issues,” and it will take “time and money.” And unfortunately, they are following that path.

I wonder when we will realize that blindly following trends and hype can be (besides unnecessarily expensive) truly, truly dangerous.