If you think your week is bad, just wait until a company vying for a massive contract tries to explain to me why their technology doesn't work with UAC and I act stupid the first 10 minutes.
UAC is not religion. It exists to serve and mitigate very defined problems in the ecosystem. There are extremely specific workloads where it does not add value nor is leveraged. But Less than ever.

It is shot to the heart of poor architecture. I expect a comprehensive argument.
Security is compromise. The most secure computer is one shut off, in a lead box, buried in the woods. I do not know everything, and am willing to listen. I have the knowledge to target exceptions where needed.

But in that flexibility is power. Not rules without mind or dispute.
This week I encountered a situation where my initial, principled stand that boiled the question down to absolutes, was wrong in context.

I listened to my colleagues input the next day and changed my mind. There's no shame in that. I hope they see me better for it.
For the record, I expect some half-ass hand-waving where I tell them to get their product architect on the call. But my expectation isn't enough.

I hope I'd be given the same chance to convince a fellow professional, even if I'd front-load the argument with my sales engineers.
You can follow @SwiftOnSecurity.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled:

By continuing to use the site, you are consenting to the use of cookies as explained in our Cookie Policy to improve your experience.