The other day I was presented with a problem. A developer couldn’t access a database instance in the lab and the suspected culprit was Cisco ASA’s SQL*net ALG. What follows is a transcript of an actual conversation between the developer and me.
Me: Could you test connectivity so that I can run a packet capture on the firewall and check the logs?
Developer: It’s working now. Thanks!
Me: Uh…, I didn’t do anything.
Developer: Sometimes miracles occur.
Me: Not with TCP-IP. There’s no Miracle RFC.
Did I miss something? When was Vint Cerf canonized?
Yes, I know TCP/IP was created with Bob Kahn and the contributions of others, but Saint Vint Cerf sounded funnier as a meme.
In retrospect, it was a missed opportunity. I gave up the chance to connect with and educate a colleague in order to feel superior and in the process probably alienated this person. All because I needed to feel “smarter.” When I thought about it, I was especially troubled, because I’ve been treated very well by other Packetpusher community members and colleagues who realize that ignorance != stupidity. I’ve been very humbled by their efforts to educate others.
This was especially apparent to me yesterday, when I had my own moment as the village idiot. I was trying out some passive DNS reconnaissance tools and thought I’d look at the domain of my employer. What I found was extremely troubling. Recursive services open to the world, Microsoft Active Directory servers at the perimeter and unprotected, and two of the systems were also MX records! All my infosec alarm bells went off, I sent an email to the Unix team lead overseeing that service and we had a meeting with their compliance person to talk about remediation. Only problem was that I had gotten it completely wrong. I was tired after submitting CFPs the night before and left a single letter off the domain name. Turns out it was another company’s domain. However, did my colleagues mock or humiliate me over this error? Nope. They even invited me to go to lunch with them later that day and I felt even worse about how I had treated the developer the previous week. Hopefully, I’ll remember this incident and act with a little more grace when confronted with a peer’s lack of knowledge.
About Mrs. Y
