{"id":642,"date":"2014-04-09T19:45:34","date_gmt":"2014-04-10T03:45:34","guid":{"rendered":"https:\/\/sheldon-hess.org\/coral\/?p=642"},"modified":"2014-04-10T10:37:15","modified_gmt":"2014-04-10T18:37:15","slug":"bad-tech-news","status":"publish","type":"post","link":"https:\/\/www.sheldon-hess.org\/coral\/2014\/04\/bad-tech-news\/","title":{"rendered":"Need to tell a bunch of coworkers unpleasant tech-related news?"},"content":{"rendered":"
\"Test<\/a>
Test sites with http:\/\/filippo.io\/Heartbleed\/<\/a><\/figcaption><\/figure><\/div>\n

So, here’s a thing I don’t see many people posting about: how and when it’s best to share unpleasant technical information. It seems really relevant today, when most of the web (well, OK, all the stuff I bothered checking<\/em>) seems to be patched up after Heartbleed (more on that below, if this term is new to you), and therefore everybody ought to be changing all of their passwords soon<\/strong>. <\/p>\n

We had a discussion, in my department (Systems), about how best to share this information—and whether sharing it was the right call. There’s an argument that we should have waited for campus IT to do it, but 1) it felt a little unethical to keep this to ourselves, and 2) we were worried that a well-meaning but less-techy coworker would send out something panic-stricken in the meantime. There’s something to be said for—and forgive me if this sounds cynical, because that isn’t how I intend it—controlling the message. Put more positively, it helps build trust when the Systems (or IT) department tells people about issues of possible concern in a timely manner and a straightforward-but-not-too-jargony way. <\/p>\n

While we don’t email the library about every exploit or vulnerability out there, when Bruce Schneier says “catastrophic”<\/a>, um, it merits comment. <\/p>\n

So, we picked a couple of good articles (one for “what the issue is” and another for “how to respond”), and I composed (with edits from others in the department) the following, which I am sharing in hopes that other tech\/Systems\/IT librarians will adapt to their own tastes and purposes and share with their colleagues who don’t live on Twitter. I think it was good to send today; other people are saying “on Friday.” Use your judgment.<\/p>\n

All:<\/p>\n

You may have heard in the news about a security vulnerability,\u00c2\u00a0\u00e2\u20ac\u0153Heartbleed.” It\u00e2\u20ac\u2122s a flaw in OpenSSL, which many websites use for security.\u00c2\u00a0The BBC wrote about it yesterday<\/a>, if you\u00e2\u20ac\u2122d like to better understand what it is.<\/p>\n

Short version: an unknown number of sites were affected by this vulnerability for two years; it\u00e2\u20ac\u2122s impossible to tell how many of them were hacked; and the \u00e2\u20ac\u0153good guys\u00e2\u20ac\u009d have only known about and been fixing this issue for a few days.<\/p>\n

Logins on Facebook, Yahoo, Tumblr, Google, and a number of other popular sites are confirmed to have been vulnerable, but it\u00e2\u20ac\u2122s\u00c2\u00a0confirmed<\/a>\u00c2\u00a0that those four\u00e2\u20ac\u201dand most things on the web\u00e2\u20ac\u201dare patched, at this point. Your usernames and passwords on any sites that\u00c2\u00a0were<\/i>\u00c2\u00a0vulnerable might\u00c2\u00a0still<\/i>\u00c2\u00a0be compromised, even if the site is now patched.<\/p>\n

This is a good time to change all of your passwords on banking, finance, email, and social media sites<\/b>.\u00c2\u00a0Avoid using the same password for multiple sites<\/span><\/b>; that is the main way to limit the damage these kinds of hacks will cause. Here\u00e2\u20ac\u2122s a good article about password security, written in response to the Heartbleed vulnerability:\u00c2\u00a0The 5 Things To Do About the New Heartbleed Bug<\/a>.*<\/p>\n

Thank you!<\/p><\/blockquote>\n

*This one was actually displayed as a bit.ly link, rather than a linked headline, because we wanted to know how many people would click on it. :)<\/p>\n

Actually, this was the version that went out to the state library association mailing list. The version internal to my library had a slightly different second paragraph:<\/p>\n

Short version: an unknown number of sites were affected by this vulnerability for two years; it\u00e2\u20ac\u2122s impossible to tell how many of them were hacked; and the \u00e2\u20ac\u0153good guys\u00e2\u20ac\u009d have only known about and been fixing this issue for a few days. We believe the risk for [the universities’ and the library’s] services is minimal, and our web server is patched. I\u00e2\u20ac\u2122m sending this out because logins on Facebook, Yahoo, Tumblr, Google, and a number of other sites …[same from there]<\/p><\/blockquote>\n

Because, if you can honestly say your site is patched, that will help with confidence and trust and, uh, actual security. (How many library websites are major hacker targets? I could believe we’ve been targeted, perhaps, but our university usernames are so long and obnoxious that I imagine the username\/password combos any malicious entities would get are wildly different from the ones any of us use on other sites. Perhaps your institution uses similar security-through-absurdity tactics. Still<\/em>, patching is good.) And if you can’t say that, you really<\/em> should fix it, or lean on whoever’s job it is to fix it.<\/p>\n

Tone<\/h3>\n

Perhaps you got angry at me for my imprecision, oh geeky reader. (I was almost embarrassed, posting it.) But you have to look at what people’s tech tolerance is.<\/p>\n

My coworkers are smart enough to understand the details about this exploit, about exactly how bad this situation is, etc., if they cared to do so. Which they don’t. <\/p>\n

I could tell them all the gruesome details and then reassure them with the information about what version of OpenSSL we’re on, when we did our last patch, and when we did the patch before that one. But I know for a fact<\/em> that several of them email their passwords to one another, despite knowing … well, they know we hate that<\/em>, but maybe they don’t really remember why.<\/p>\n

My point is, most of them have a very low technology tolerance. Tech isn’t an interest of theirs, nor is security. Their computers, email, the internet, and the protocols and procedures to keep all of it going: these things are just tools, tools they prefer not to have to notice. <\/p>\n

So I simplify, in hopes that I’m using enough words to help them understand the importance and make good decisions, but not so many that they get bored or decide they’re too busy to deal with my email. <\/p>\n

I may have struck the balance wrong, on this; while I can defend the choices I made, re: what to share and what to simplify, I won’t go so far as to claim they were the right<\/em> choices, necessarily. The email’s probably a smidge too long. People might not have the presence of mind to think to themselves “Systems never sends out stuff about security unless it’s REALLY BAD, so this must be important!” or, worse, they might not remember my department head is out of town (making me the acting department head) and think “Eh, if it were important, Mike would have sent it”—so it’s possible the urgency of my tone should have been kicked up a notch. Or I could come in to panic and bedlam in the morning, in which case I’ll know it should have been kicked down a notch. ;) (This is unlikely.)<\/p>\n

I will admit to one major mistake: instead of “Change your passwords,” my subject line read “Heartbleed – OpenSSL vulnerability.” Look, it was after 4pm, and I’d had a long day and cold medicine. <\/p>\n

Anyway, I’m really interested in other Systems\/IT folks’ opinion on this<\/strong>:
\n1) Are you going to send out an email to your less-techy coworkers? General library mailing lists?
\n2) How detailed do you think it’s worthwhile and productive to be?
\n3) What tone do you try to strike, when writing an email like this?
\n4) Any tips you want to share?<\/p>\n

Thanks!<\/p>\n","protected":false},"excerpt":{"rendered":"

So, here’s a thing I don’t see many people posting about: how and when it’s best to share unpleasant technical information. It seems really relevant today, when most of the web (well, OK, all the stuff I bothered checking) seems to be patched up after Heartbleed (more on that below,…<\/p>\n

Continue readingNeed to tell a bunch of coworkers unpleasant tech-related news?<\/span><\/a><\/div>\n","protected":false},"author":3,"featured_media":643,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,28,38],"tags":[80],"class_list":["post-642","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-communication","category-librarianship","category-technology","tag-heartbleed","entry"],"_links":{"self":[{"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/posts\/642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/comments?post=642"}],"version-history":[{"count":0,"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/posts\/642\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/media\/643"}],"wp:attachment":[{"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/media?parent=642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/categories?post=642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sheldon-hess.org\/coral\/wp-json\/wp\/v2\/tags?post=642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}