Let's Be Blunt: It’s Time to End the Add on Insanity

For the third time in a week, researchers have discovered a zero-day vulnerability in Adobe’s Flash Player browser plugin. Like the previous two discoveries, this one came to light only after hackers dumped online huge troves of documents stolen from Hacking Team — an Italian security firm that sells software exploits to governments around the world.

This quote is from Brian Krebs, who very rightfully goes on to advise that everyone “please consider removing or at least hobbling this program.” Now, that is fine for the most part. I mean, who really needs Adobe Flash these days? Don’t most services we use have other methods of handing us the content we need want? The Apple iPhone doesn’t have Adobe Flash, so why do we need it on our laptops?

The fact is, that most end users probably don’t need to have Adobe Flash installed any more, but a lot of us sysadmins do. Why? Well, in my world one major culprit is the VMware vSphere Web Client. The Web Client has gotten it’s fair share of ill-repute over the last few years, but the latest edition in vSphere 6 is pretty responsive and quite pleasant to use. That’s until you contemplate that it still needs Adobe Flash installed on the client. The same goes for any other admin interface that requires Adobe Flash, or even Java for that matter.

Any administrative interface that requires a browser add on to work, should be bagged, kidnapped and flung in the back of a van and driven off somewhere never to be seen again. Sure, I understand that it’s no easy task to rework all of these interfaces, and it takes real effort by skilled people. But please, please make it happen as soon as possible, and retrofit it it into your existing systems – don’t keep those stuck on older releases hanging, and only provide a solution for the latest and greatest version.

While we as admins and consultants are used to having to patch our systems, and keep current, please help us limiting our own attack surface by removing requirements for add ons and “special juice” just to be able to administer the solutions we depend upon to keep our businesses running. That can’t be too much to ask, can it?

The “vCommunity”

The recent months, and weeks, has made me question the value of the “vCommunity”. I’m even questioning if there really is such a thing at all any more. I believe there was such a thing at one point, but it seems to be fading fast into history, only to be replaced by hyperbole of egonormous proportions. Back in the old days, and this might just be me showing my greying of beards moment, the hyperbole wasn’t a strong a force as it seems to be today. As clickbait replaces journalism, hyperbole and FUD seems to be replacing what used to be based on technical merit.

Yes there is a typo in there, it was supposed to read “I don’t really understand why people spend enormous amounts of time on something, to just turn around and shit all over it.”

Sure, I get it. You want to make a buck, and a name for yourself. This is completely understandable, I do the same thing. We all do, let’s not kid ourselves and pretend we live in la la land where life is beautiful all the time, and we are all working together towards a better world, or even a better tomorrow. The truth is, we are not collectively working towards anything but our own self indulgence or self worth, or whatever might seem to be the best “move” at any given time.

Harsh? You bet. Reality? It sure is.

Take a moment, and read of what Anthony Burke wrote in his Remember your Technical Integrity post. I simply could not agree more.

If you chose to sacrifice your technical, or even moral, integrity for another paycheque, be my guest – That is your prerogative. Just don’t whine if I call you out on it, or simply stop listening to you. Just as you make your own choices, I sure as hell will be making mine. Please don’t take this the wrong way, I’m not saying that you can’t change your opinion about something. Or change employers. That’s perfectly fine, completely natural, and even healthy – Changing your personality, well probably not as healthy. Also, it probably shows that your previous “personality” wasn’t real either. Again, not so healthy. I’m pretty sure that’s where unicorns come from. Fake personalities, with hidden agendas.

I won’t kid myself into thinking that I can influence this trend in any way, shape or form, and things will go back to being what it once was, but I sure can make sure that I don’t fall into the same trap myself. If I ever fall into the same category, by all means tell me, or even better take me out back and give me a good old fashioned beating.

As someone I respect once said about the community:

There is none… It is a bunch of dicks and egos.