14 comments:

On Tuesday 30 September 2008 at 15:05, The Masked Avenger said:

I think the problem is as follows.

Every government department/public body has had letters from ministers on this subject and, as a result, there are now very strict policies and procedures on the dissemination of confidential data. The problem is not that there aren't enough people who understand secure networking, the problem is that the vast majority of “everyone else” either:

a) Doesn't care
b) Doesn't consider the impact of the loss of the data
c) Doesn't think it will ever happen to them

I am not sure it is a technical issue and am even less sure it could ever be resolved strictly through those channels as the amount of data and the amount of viewers/creators is rising hugely (due to the growth of MI as a performance tool within the public sector). People will always save non-password protected, unencrypted spreadsheets in stupid places unless organisations can address the above three issues.

As far as flash memory goes, well, kerching. Would having to buy a memory card of a specific type stop you buying a specific camera or a PSP ? If you want a £500 Sony Camera that has just got top reviews across the board in the press, the fact that you need to buy specific architecture memory for it is probably going to be quite far down your list of considerations.

Outside of the creative arts, Macs are only purchased by people who LOVE Macs. Macs are for Starbucks, Macs are for sitting in the Garden, Macs are for reading emails and playing music. Most people who use Macs do not rely on them for work (unless it is typing the latest childrens novel whilst waiting for their organic panini to be cooked in bloody Cafe Nero). Consequently, most Mac users in my experience tend to have a very rose-tinted view and see them as the panacea to all the worlds ills.

Indicating ? Not my subject...providing the Moulinex doesn't end up on its roof with me in it, I am a happy camper.

Bluetooth headsets ? I am sure I haven't seen one for about three years. I think most people have finally given up on them apart from meathead cab drivers who seem to think that these still make them look busy/important/more intelligent than their non-StarTrek costume adorned rivals (These are the same people who, 20 years ago, bought those stupid digital watches with calculators on them).

I can't believe it....

....all
.....on
......topic

On Tuesday 30 September 2008 at 18:17, Mark said:

I almost couldn't respond, I was so taken aback...

Good points, here goes:

By 'secure networking' I mean storing this sensitive data centrally, and allowing users to access it across secure networks (and ONLY across secure networks). We've been doing this with programming source code for years. No individual will ever need to save anything to any physical media, there will only ever be one copy (which will always be up to date), it will be accessible by anyone who needs it, from (nearly) anywhere, and nobody will be able to drop it in the middle of Oxford Street whilst fumbling for their phone.

I realise there's a fucking huge mountain of red tape in the way, and probably a lot of technical obstacles, but surely if Google can write an online, encrypted office suite then someone else can too? It's got to be cheaper than digging yourself out of the shit when people start suing you because their identities have been stolen...

On flash memory: I could understand your point if each type of memory was proprietary, but they're not - anyone can make an SD card. Or Mini, or Micro SD cards. Or an XD card. Or an MMC Card. Or... well, you get the idea. So it's not like any one camera manufacturer is making more cash by making their camera support one card format over the other. Except Sony. But they're just c**ts.

On Bluetooth headsets: maybe it's just Newton Abbot then. Bluetooth headsets, and people who walk really, reeaaaallly slowly.

On Tuesday 30 September 2008 at 18:20, Superman said:

You're all gays.

On Tuesday 30 September 2008 at 18:21, Mark said:

Sorry, that was me - it's just that we were in serious danger of having an actual discussion, and I didn't want it getting out of hand or anything.

On Tuesday 30 September 2008 at 18:41, Vigilante Boy said:

Stu is a ginger cock.

On Tuesday 30 September 2008 at 19:21, The Masked Avenger said:

There you go...my apprentice should have bought us a bit longer...

Good point on the cards, I didn't realise that most were non-proprietrary. Oh well, that's a load of old donkey dangles isn't it ?....hang on......aha....it would seem that most are still made under licence or, in the case of the SD card, represented by an assocation (Yes Stu...I know, geeky geeky....HARRLLOOOW !). Consequently, whilst anyone can make them, there are still vested interests floating around in going for one or the other (which will inevitably result in backhanders to the peripheral manufacturers).

Secure networking....interestingly enough an awful lot of data is bounced like that already (HARRRLLLOWW!). The problem is when monkey A wants to work on monkey Bs data on the train on the way home and his laptop is in his car and it is 4:45. He will inevitably get his mate to email it to him (because inevitably his mate will have saved it on his desktop and not the server), copy it to the flash drive...copy it to his hard drive on the train (because I don't trust these little key things for very long), work on it, save a new version of it onto his hard drive (keeping the original because, hey, you might need it if you've screwed up somewhere) and then back on to the key. Log in to his PC at home, email it back to his friend.

Check my arithmetic.....

Copy 1: On friends hard drive
Copy 2: In my inbox
Copy 3: In his sent items
Copy 4: On flash key
Copy 5: On laptop hard drive
Copy 6: On laptop hard drive (but new version)
Copy 7: On flash key (but new version)
Copy 8: Emailed to mate therefore his in his inbox
Copy 9: ....and my “sent items”

Until we:

a) Change the mindset of knobheads saving things where only they can access them (i.e. their hard drive)
b) Give people access to that network from any where at any time

.....I think we are fucked.

On Wednesday 1 October 2008 at 09:34, Mark said:

Ok, so...

a) Only allow people to work on things in-browser. Just like Google Docs (but without the export/save as options).

b) There can be an offline mode, which invisibly saves a working copy (the user never knows about it, or where it is), which then re-syncs when net access is restored. Just like Google Docs.

With the added bonus that every change made by anybody is saved and audited in a different, separate version, so you can always roll it back to any stage without needing to save out 'safe' versions - again this is exactly how version control works. And Google Docs.

I just will not accept that this can't be done.

P.S: I thought this was quite apt (even though their marketing dept. has obviously expanded the actual number of card formats slightly)...

On Wednesday 1 October 2008 at 10:40, The Masked Avenger said:

Ok...let me split this into two issues and then take each one in turn.

A) Technology

Yep, I am sure it can be done, however most public sector networks are...........YOUR CONNECTION WITH THE SERVER HAS BEEN LOST......sorry....as I was saying...most public sector networks are slow, unreliable and badly managed and if this was to be brought into action, the traffic would be outrageous. Paradoxically, even though our IM&T policy states that nothing should be saved locally, if we saved everything on the network, popular opinion states that it would crumble within about 48 hours. I know the Director of IT is trying to secure additional funding for the network infrastructure but it takes a back seat when you look at waiting lists, day of surgery admissions, 4 hour A&E times etc. This is the problem, the technology may well be there but the cash isn't. If you look at this from a financial perspective, upgrading every NHS network in the country (and then training everyone in the new methodology) would be prohibitively expensive (and the cost of data loss is mainly political for the government, not financial).

B) Monkeys

We are monkeys. We will continue to be monkeys regardless of the number of policies and procedures that come in because we do not see outselves working in an environment where data is mission critical - our product is unrelated to IT and, as a result, we don't really care/think about it. A consultant who needs to look at some electronic patient notes at home (breach of policy) that his medical secretary has just typed up and saved on the hard drive (breach of policy) will just stick it on his USB key (breach of policy) and stick it on his laptop at home (breach of policy). He/she just won't care about the NHS leaping up and down about this, threatening him with a disciplinary process - he will merely speak to the medical director and the whole thing will go away faster than you can say “Do you fancy a gin and tonic Rupert ?". If you don't manage a monkey they will, eventually, feel that the rules do not apply to them and become more and more powerful. Consequently, eventually, the “lesser” rules really don't apply to them. This is the point on the monkeys, in order for this whole shebang to work, it needs to be managed and, due to the fact that these sods are “saving lives”, we haven't got the minerals (guv'nor etc) to nail them up against the wall. This is common not just in the NHS but, I am guessing, a lot of public sector organisations where the greater good outweighs everything else....“Ah yes 007, please sit down, now we realise that you have just single handedly prevented a coup in Burkino Faso but you must not save surveillance photos on your hard drive”.

On Wednesday 1 October 2008 at 11:08, Mark said:

Yep, I do take your point about the financial side of things. But doesn't sorting out slow, unreliable and badly managed networks come under my original banner of 'hiring someone who knows what they're doing with secure networking?'

And I think you're misunderstanding me when I say “Only allow people to work on things in-browser”, I don't mean “make a rule that you're only allowed to work on things in-browser”, I mean “nothing exists outside the browser”.

People ignoring policy is one thing, and yes, they (and I...) will always end up doing it if there's a quicker or easier way, but if there just isn't a 'save as' button, it becomes somewhat harder to go against the rules and a lot easier to just take the path of least resistance...

Still as you say, it ain't gonna happen anytime soon - perhaps I'm just sick of hearing about this sort of thing in the news.

Oh and ironically, I just found this

On Wednesday 1 October 2008 at 12:26, The Masked Avenger said:

Hehe....no-one has got the balls to get rid of the save-as button. This would be a huge seed change, remember, you are looking at organisations that still have some PC's running Windows 2000 here. As far as hiring someone goes, we just don't invest - we pay a lot less than the private sector simply because it is seen as a secondary service and, unfortunately, non-mission critical. Who in the NHS (thinking about that as a good example) is going to have the guts to say, “Actually, I think a network administrator with equivalent experience and qualifications should be paid more than a cardiothoracic ward sister ?". The Royal College of Nursing would shit a chicken (and so would the press who would immediately leap on the public friendly band wagon of too many over-paid administrators whilst our penniless clinicians are forced to sift through the bins at Lidls in order to find out of date Band-Aids).

I do like the idea of the browser only desktop though and I know there are many organisations that have employed it with success but until organisations such as the NHS, MI6, Home Office etc invest, it isn't going to happen. The reason I feel they don't invest is as follows, any new implementation will inevitably cost a huge amount in the first year (training, equipment, infrastructure etc) and this is where we go wrong. Because of the way we (and a lot of other government departments) are paid, we work in a 12 month cycle. We are commissioned for 12 months worth of work, our targets are set within those 12 months and consequently, so are all the efficiencies and cost savings set by central government (because we should be getting better and better all the time, we cannot afford to stand still). It is all in year from April to April. The idea that we can release savings in year two and three take a back seat to the spectre of a negative savings (hehe love that term) in year one. What needs to happen is that either our funding should be changed or, central government should fund the project over a 5 year period. The problem there is the track record. The central project that I have been involved with most heavily (the Electronic Staff Record - NHS wide integrated HR and payroll system), has now been rumbling on for over 6 years, was originally scoped at £350m, has cost, to date over £500m, is two years over programme and the money has now run out so inidividual trusts are having to fund its development themselves. Consequently, the entire project has cost the taxpayer a fortune, is now being parked rapidly by trusts Finance Directors as it has become their problem and has realised absolutely bugger all in terms of benefits as a result. Central government has a long track history of screwing up large IT contracts (in fact, I can't think of one over the past 10 years that anyone could call a success). A browser only workplace would be a major project for an organisation like the NHS and no individual trust would ever fund it (because it would cost too much in year one) and no government would have the appetite to fund it either (in case it goes the same way as every other IT project they have funded in the past).

In terms of it appearing in the news....well, surely this is to do with the growth of the mobile office. If we want people to work at weekends and on the train then this is the price we pay. 15 years ago, everyone just worked late but, with the european working time directive, that is no longer an option so we have got round that by giving everyone laptops (or, if you are really lucky, a laptop and a naptop). Data loss and a few embarrassing headlines is, alas, a relatively small price to pay for getting a large percentage of managers to pump in an extra 10 hours a week whilst they are watching the grand prix.

On Wednesday 1 October 2008 at 13:45, Mark said:

Although that was all very interesting, the main thing I took from it was the phrase “shit a chicken”, which I'd never heard before, and will be using much more from now on.

On Wednesday 1 October 2008 at 14:05, A chicken said:

I need a shower.

On Wednesday 1 October 2008 at 15:15, carlos said:

Thought you had lots of work to do?

Harry has had a hair cut!

On Thursday 2 October 2008 at 10:19, Mark said:

Coincidentally...