Every company is different, with different risks but here is the change management i have implemented successfully.
Minor, medium, major change category depending on potential impact with documented guidelines when each apply.
First release of a service always recommend to be major. (They are few vs daily changes and can be redtaped more to get many stakeholders requirements. Functional and non functional) Author of the change and his team decide the category.
- Minor need one more reviewer outside author. Team decide everything.
- Medium need min one more, and usually QA team or other affected team.
- Major change need CAB meeting with all major stakeholders to sign off.
CAB is responsible for the process and high level monitor the program, see if any cheating goes on, performance metrics such as number of changes per category etc. Help support people what could be considered minor vs major changes.
Overall rel flexible and balanced. Pushes people towards making smaller changes with less risk and at the same time increase velocity while still protect reasonable against bad actors, mistakes etc.
It is not perfect, medium changes tends to be more difficult to coordinate, some changes are missclassified etc but that is okey. It is not only about the process, communication matters and ci/cd have to be robust etc.
In a corporate setting my experience is that it is rarely worth it to add any obscurity on top of security. Your biggest challenge is getting peoples time and resources, and you need to use that time to implement security controls. A secondary objective you have is to build security culture over time and teach people too see patterns where more security is needed, so it is important to select what to teach to get maximum impact.
Many companies usually want to compare themselves to Apple and at the same time say they are disruptors and innovators but Apple is probably the best company at being okey with being left behind. Many think about them as experts in products but for me they always been best att copy what others are doing and refine it, maybe not neccassary better technical but always seen the market fit better then others. Like poker, the later you need to take your decision the more information you have.
I don't remember the last time i had a meeting that was productive. Last time i worked in the office, the hallway discussions where the productive ones and now working remote most of the time is just being able to work with good people that understand text and work by messages that works good. Even video meetings with good people tends to be waste of time.
I wonder if it would be possible to allow people to ssh into the edge servers with enough access to verify no access logs are stored but not enough to cause any problems. Admit i have not thought it through but would be cool having people verify the live environment while running.
You can't really verify anything in this way. SSH is just a protocol, you're trusting the SSH server to give you a shell inside the real production environment instead of giving you a shell inside some elaborate simulation of a production environment. It's about as trustworthy as a policy page saying "we don't keep logs".
You are correct. Would need something like distributed ledger to fully prove things.
It might not be possible to verify 100% but the more transparency the better i guess. Seeing the 3 way handshake and connection information, the timings, location of the server. Would need to be quite elaborate to fake. Just thought was a fun idea. Have the customer allowed in to production. A lot more difficult then publish privacy page, source code, fake audit reports.
I love kde and it is what i use but still having the bug from time to time that the panels dissapear and have to relaunch plasmashell, also i wish they merged the virtual desktops and activities into one concept and allowed different wallpapers on each.
The theme settings is also confusing because of gtk apps, global theme etc. Feels everything around theming could be made nicer.
Prob some more nitpicks but overall it is a really great desktop environment.
> I love kde and it is what i use but still having the bug from time to time that the panels dissapear and have to relaunch plasmashell
I have that too, on Wayland. I also had a bug I mentioned recently in another comment with transparent terminals flickering, but that seems to depend on what is behind them and I think is a bug specific to Konsole.
Overall, its very close compared to a few years ago when several things were problematic with Wayland, but I do slightly feel its not quite there yet.
> i wish they merged the virtual desktops and activities into one concept and allowed different wallpapers on each.
> Prob some more nitpicks but overall it is a really great desktop environment.
Trying not to sound too cold, he seemed like a very nice guy and i did not know him. It was not surprising for me. I remember seeing interview with him when he took things very personal and could not let things go some year back. Thought at that time that he was at high risk of suicide. He seemed to have a self loathing personality / depression and obsessive behaviors.
Staying on the Internet and be dependent on it in some way financially working as a streamer with all the short form communication and negativity online. Together with cyber bullies etc. A lot of things creating a perfect storm for what seemed to be a sensitive and very nice guy. Easy to say that his family and real life friends should have seen it too and make him change path but in reality it is difficult.
Especially since things that make it worse like sitting down and playing chess all day / night and not getting enough sleep, together with cyber bullies is also the things that you love, you earn money on and you have many of your friends there.
I asked Perplexity what people are speculating online might have been the cause of his death, and it mostly appears to revolve around mental health issues, substance abuse & self harm. Whether or not it's true, this is a tragic loss. Smart & talented people can often be very sensitive.
Having struggled with these same issues for most of my adult life I'll just say it's nothing to be ashamed of and if you or someone you care about is in pain or struggling, don't hesitate to reach out. There are resources out there for you and it doesn't make you weak for using them.
Minor, medium, major change category depending on potential impact with documented guidelines when each apply.
First release of a service always recommend to be major. (They are few vs daily changes and can be redtaped more to get many stakeholders requirements. Functional and non functional) Author of the change and his team decide the category.
- Minor need one more reviewer outside author. Team decide everything.
- Medium need min one more, and usually QA team or other affected team.
- Major change need CAB meeting with all major stakeholders to sign off.
CAB is responsible for the process and high level monitor the program, see if any cheating goes on, performance metrics such as number of changes per category etc. Help support people what could be considered minor vs major changes.
Overall rel flexible and balanced. Pushes people towards making smaller changes with less risk and at the same time increase velocity while still protect reasonable against bad actors, mistakes etc.
It is not perfect, medium changes tends to be more difficult to coordinate, some changes are missclassified etc but that is okey. It is not only about the process, communication matters and ci/cd have to be robust etc.
This balanced approach works for many.