caleb-craft.com

Caleb Craft

You found my website. If you disagree with me or think im wrong about something, let me know. I love to argue with people on the internet. /s This site primarily exists for my own use. Content may change without notice.

Stuff

What i’m learning about

what i want to learn in 2025:

Powershell DSC
NIST CSF

Blogs (Work in progress)

Thoughts

TLS Certificate Lifetimes Will Officially Reduce to 47 Days [2025-04-19]

https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days

Schedule:

Date	Maximum lifetime	IP/Domain validation
Current	398 days	398 days
March 15, 2026	200 days	200 days
March 15, 2027	100 days	100 days
March 15, 2029	47 days	10 days

It is time to start moving towards ACME and other automatic Certificate tooling.

GEICO moving away from cloud [2025-03-02]

GEICO repatriates work from the cloud, continues ambitious infrastructure overhaul

“we have a lot of data – and it turns out that storage in the cloud is one of the most expensive things you can do in the cloud, followed by AI in the cloud…”

Ten years into that [cloud] journey GEICO still hadn’t migrated everything to the cloud, their bills went up 2.5X and their reliability challenges went up quite a lot too – because if you spread your data and your methodology across so many different vendors you are going to spend a lot of time recollecting that data to actually serve customers.

But the migration actually reduced availability, putting the firm “at the cumulative mercy of our clouds” and with “no consistent data strategy, no consistent hybrid stack” it was hardly an improvement. That, in part, was the result of a lift-and-shift approach that took applications/stacks to the cloud instead of refactoring for what the cloud actually does well.

Compliance is among the drivers for the overhaul. She notes that data also has to be retained due to state regulatory requirements, “because at any time, we could be asked by a given state to produce information that proved we didn’t have bias, or we didn’t violate any of the terms [of an insurance policy].”

As Weekly sums up: “Just running legacy applications in the cloud is prohibitively expensive. Our use case just highlights that…”

Don’t move to cloud for the sake of it. Cloud can limit innovation. When you store your data on someone elses hardware, they control it. you have only the control that they give to you.

Lift and shift is probably a bad idea in general, but think about your situation before listening to over-generalizations.

Cloud journey:

Adoption

Growth

Cost Realization

Evaluation

Repatriation

It would be best to go a different path, but some lessons are only learned the hard way.

Be wary of consultants
that will push you towards accelerated adoption and growth in cloud services without a full evaluation. You will almost certainly be better served if you have people that know what they’re doing close to you.

Be wary of vendor lock-in
You should have an exit plan before entering the cloud.

Be wary of underskill
Cloud does not necessarily mean that you have no responsibility in-house. Understanding the shared responsibility model is hugely important. You might think going full SaaS lmits your responsibility, but it usually doesnt. At the bare minimum you are responsible for mission success, and if the SaaS is not working, you need to be able to fix that.

Workers need training with the tools they use. The cloud is complex, and incorrect mental models of that complexity have bigger consequences.

On-prem enables innovation
You get more opportunities for customization when you control the hardware and the software. Throwing money at a problem is not innovation. Building new solutions is. You don’t always need to innovate, but being able to when necessary is useful.

sources: - https://www.thestack.technology/warren-buffetts-geico-repatriates-work-from-the-cloud-continues-ambitious-infrastructure-overhaul/ - https://www.youtube.com/watch?v=XnjlhnrYSw

Spoiler alerts - 2025-03-01

I added a new css class for spoilers.

Spoiler: Spoilers look like this

sudo lecture - 2025-02-23

On some linux systems, when you first use sudo it will display the following message:

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

It has come to my attention that I am the “local System Administrator”. At my job, when new users are granted admin rights, they do get a lecture, but i think it might be a good idea to make a more formal version. Maybe a powerpoint to start.

Today I Learned: Brave browser plays youtube videos on lock screen - 2024-11-24

on iPhone, Brave can block ads and play youtube videos when your phone is locked.

On Moving to the cloud - 2024-11-13

More and more, I think its a mistake. We have to decide what our core competencies are, and keep that skill and knowledge in-house. Maybe we don’t want to be in the business of patching servers, or replacing hard drives. Maybe we don’t want to worry about properly securing Active Directory. Thats fine, those things aren’t directly related to our mission, but think about what you are replacing it with when moving to the cloud.

If Identity is central to your security strategy, it doesnt matter if you keep your IDP on-prem, or in the cloud, its still your responsibility to secure. The cloud IDP just gives you less control in exchange for hopefully a competent team of engineers to keep the tools running properly.

If you care at all about privacy, you will try to limit what third parties you are sharing data with. Subscription services and cloud apps are predatory and designed to maximize profit. The most profitable companies in the world are cloud providers and they got that way because its a good business strategy to keep data and engineering talent in-house. Thats a good strategy, and its exactly why you shouldnt outsource your data and operations either.

On Mass Layoffs - 2024-10-30

There has been a lot of big tech layoffs recently. I’m not going to try to list them here. But it is interesting that these large tech companies are able to get rid of so many of their employees and seem to stay afloat. Some possible explanations: - they overhired, and are correcting now - maybe they never needed that many people - they are choosing to decrease their quality of service. - i think this is it. quality doesnt seem to impact sales, especially in the near term - people like to buy cheap stuff - theres a lot of dead weight. 20% of employees do 80% of the work - maybe 10x engineers are real?

Almost everyone I talk to seems to be understaffed at their job. Resturants, office workers, field technicians. We seem stretched thin.

On Tools - 2024-10-03

Don’t let tools drive your workflow
Don’t try to automate a task until you can do it manually.
Using the right tools is more important than having the best tools.

Don’t listen to the salesperson. They will make the tool sound great, it’s their job. I have seen so many times, people will buy some expensive product hoping it will solve some problem, then it sits and collects dust. It’s like buying a treadmill because you want to lose some weight, but then you never use it and it becomes a $1000 storage shelf. Its easier to buy the treadmill than actually put in the work. Maybe you never really intended on doing the work, you just wanted to buy yourself a little bit of hope. In the corporate world, the same thing happens, and people buy some new software because it gives them hope. The hope that all of the problems from the previous software will be gone. But, if the problems are a result of years of negligence or lack of maintenance, you might just run into those same problems with whatever new software you buy.

Don’t try to get clever and offload the maintenance to the software vendor either. Your problems are YOUR problems, No matter how much you pay somebody else to solve them.

Cyber Hygiene

Many cyber-attacks can be attributed to poor cyber hygiene, including failure to patch known vulnerabilities, poor configuration management, and inefficient management of administrative privileges.

I read this from a CIS webinar spam email. It reflects my thoughts on the topic. It usually gets distilled down the fact that we are bad at prioritizing our efforts. We spend time on the wrong things. Typically, the best thing to do is the basics, but the basics are hard.

Today I Learned: “University” - 2024-09-07

Why do we call colleges “Universities”? That word sounds just like “Universe”, but I didn’t understand the connection. Well it turns out that “University” is short for the latin “universitas magistrorum et scholarium”, meaning something like “a group of teachers and scholars”. Interesting.

Contact

cwcraft@protonmail.com