Not exactly sure where I’m going with this, but my work with creating penetesting tools for LLMs, the way that I use judgment is critical to the core functionality of the application. I agree with your concern and I will just say that the more time I spent concerned with chain of though where now I will make multiple versions of the same app using a different judge set a different “temperaments” and I found it to be incredibly enlightening as to the diversity of applications and approaches that it creates.

  Even using BMAD or superpowers, I can make five versions of an app without judges involved and I feel like I’m just making the same app five times because the API begins to coalesce around the business problem you want to solve. The vicissitudes of prediction tools always want to take the safest bet for the greater good, but with the judge involved we can make the agent force itself to actually be hostile about what exactly we’re trying to do, which has produced interesting and fun results.

How long will it take before they rob a bank?

If they do either of those things will the results have been intentional from the simian’s POV?

And lowercase active listening, IMHO is genuinely being interested in the experiences of the person talking that your line of questioning disarms the subject into sharing stories that add personal, “cultural” context to their choices which could be considered taboo.

It’s possible to make no mistakes and still lose, it’s when people get offended about something they are wrong about that creates a tolerance for Pyrrhic victories.

I met him in the server closet and asked “hey, I’m new here - do you mind if I look over your shoulder?” He turned around and smiled, “if you are here to help, then you should sit down and I’ll walk you through setting up Exchange mailboxes for these doctors.” Before he left, he walked me through a RAM upgrade and gave me his lucky red screwdriver “ you got this, just call me if you have any issues.”

Later in my career, I continue to learn lessons from this interaction; lately the lesson has been one of “don’t be awesome in a vacuum” - a little bit of encouragement to the new guy can go a long way to adding another person to your on-call rotation that you trust.

20 years later, I still have his screwdriver - and I bring it every time we have lunch every once in a while.

Life is too short to not let the people who make life enjoyable for us know so.

I was trying to keep a death grip on sobriety. The clenching and clawing while putting up appearances... life brings us sadness. sometimes at times of desperation, the only thing I have left is my reaction.

When I look back on my mistakes, it all feels insane; the pathology of feedback loop neurosis had me chasing tornados with a butterfly net. What would catching it do for me?

Recognize the stillness where you are _right now_ my friend, and we can sit here for awhile and watch those clouds join the others as they roll over the horizon.

As somebody else pointed out in this thread, The trick is to refine your training in real situations as quickly as possible. The SRE Padawan isn't there to watch, they are there to grill me as to why certain things aren't in my documentation.

they are there to help me eventually raise up the operational excellence of our team.

With the jr-sre by my side, Refuse to perform a task in a vacuum, or jump into meeting alone....their success is our victory (and probably my vacation.)

I think that this is a great starting point, but there is some fun nuances to teaching how to survive a shitstorm that are so rarely brought up. Communication protocols, database warming, orders of operations.

you can teach these things but until you get them wrong you risk not learning them.

TLDR: good but missing a Kobayashi Maru.

In our assessment we found that these APPKEYs are also included in the backup file - which makes the SnipeIT backup ZIP files a vector for exposing all users and passwords (as well as all encrypted fields data) because of a default setting by the framework's backup provider.

That said - if you are concerned about security, you will be on-prem or within your own cloud provider to begin with. The SnipeApp company offers an "enterprise" level support at a somewhat reasonable rate for big companies, and they were a great help assisting with our installation and integrating the SnipeIT API to import new devices and licenses automatically in a way that we can control from say a PO.

This password issue may not be a problem for you as I understand they now have connectors for SSO or another OAUTH provider. That and the fact that they asked us to share our backup via email during onboarding and they did not specify to keep the secrets out of the backup made our decision to go in-house. Still a good, scrappy product, and when we asked them if they had access to our company's passwords that was not disclosed, we didn't get a response. That's OK - and it was a good lesson for my team in evaluating an open source framework behind the product vis-a-vis "trust but verify."

Its always going to be a vector of our own partial design (and/or someone we are paying), a rogue backup source of truth that is ejected into the ether like atoms forming salts in an acid-base reaction.

----

something so beautiful

Deserves more than a poem

but this cage in My house

I won't never be home

I love you, being right

why do i make it so wrong

cut into my songbird

in search of the song