BOFH: The PFY Chronicles part 2

A poisoned chalice

  • alert
  • submit to reddit

Application security programs and practises

Episode 2

Things are quiet at Mission Control. No, quiet would be an understatement. The room seems unnaturally large and cavernous, and there's an echo that just shouldn't be there...

I could swear I heard the words "sleep no more" coming from the PC speaker, but I'm sure I'm imagining it.

My contemplations are interrupted by two arrivals: A postcard with the words "Hi from KiwiFoo" crudely pasted from letters cut out of a magazine, and the Head Beancounter. The first is disconcerting, the second just annoying.

"Just... ah... need the building master key to get onto the roof," he blathers hesitantly.

"Interviewing for new auditors then?" I ask.


"You know - the jumping game," I prompt.

"I'msorry?" he half gasps.

"You know, when you get a skip full of empty cardboard boxes delivered outside the building then convince job applicants their job relies on them jumping from the second floor balcony"

"Oh, you mean like a trust test - they land in the boxes?"

"No, the bin's on the other side of the building."

"So why is it filled with empty boxes?"

"That's where you put all the stuff in their desks. I take it they're all internal candidates?"

"No, I don't need the key for that - there's just an appointment in my diary with your... uh… former supervisor in the... roof storage facility."

"Ah, right," I respond. "Complain about some IT delivery last year did you?"


"Park in one of the IT reserved car parks then?"

"There aren't any reserved Car Parks for IT."

"Course there are. They're labelled 'Chief Financial Officer' and 'Board Members only'."


"Doesn't matter - I don't think I've ever been in the rooftop storage facility before, so let's take a look-see."

"I'm perfectly capable of..."

"No, no, I insist."

...15 minutes later...

"That's not a storage locker - it's just some tin sheds bolted together."

"True - but how about we see what my predecessor was storing in Shed Number One?"

>eeeee< . . . >SLAM!<

"Well, what's in there?" he asks.

"You don't want to know!" I gasp.

"Oh come on, it can't be that bad!"

"See for yourself." >eeeee<

"A bunch of monitors?"

"How MANY monitors?"

"I... well lets see, seven wide by six deep by six high. How many's that?"

"A hundred and eighty."

"That's not so many is it?"

"That's only one of the sheds. Shed 2 will probably have another hundred and...” >eeee< >SLAM!<

"What is it?"



"VT52s - though on the bright side there's only about 70 of them because they're twice the size of a screen. But that's not what I'm worried about."

"What are you worried about?"

"CRTs are getting harder to get rid of than a scorching case of herpes - and there's only so many you can dump on the tube before they start hunting you down like a dog."

"Can't you just get a bin in?"

"You can, but even they're getting picky now, what with leaky capacitors, mercury leaching etc, and dumping this many will undoubtedly require me to fill in some paperwork about safe disposal options - with some guarantee about accuracy."


"And that's just the monitors - the VT52s are a whole other story."

"Why's that?"

"Well firstly because they're probably crammed with stuff that's no longer legal to just dump and secondly because this company's never HAD any VT52s."

"So perhaps they were here already?"

"No, Simon had the sheds installed."

"So how did they get up here?"

"Exactly! Someone must have brought them up here, at night, one at a time, and stashed them in the sheds."

"But why?"

"A poisoned chalice," I sigh, the penny dropping.

"A what?"

"Does the term 'Mutually Assured Destruction' mean anything to you?"

"You've lost me."

"Say you're concerned that one of your younger beancounters is going to try and nudge you out of your job. There's two ways of defending yourself - three, counting the jumping game. The first is that you increase your efficiency to such a level that no one in power would ever dream of replacing you with your subordinate, while the second - and far less exhausting - option is just to make the financials system such a pig's breakfast that your subordinate would never want to take over. Poison the chalice."

"So you're saying Simon put all this in place just to..."

"Shaft me in the event of his untimely demise, yes."

"So if monitors are bad and those VT52 thingies are worse what's likely to be in the third shed?"

"At this rate, probably Daleks!"

"So what do we do?"

"We could just shut the doors and pretend we didn't see anything, but I suspect that if you had something in your diary there'll be appointments in someone else's diary and some form of automatic whistleblower email thing about the contents of sheds 3 and 4 flying off to the media and Greenpeace in the next day or two."

"So what do we do?"

"If I were you I'd order a skip full of empty boxes!"

"And what are you going to do?"

"Order another skip full of empty boxes - there's four shedsworth here!"

"Okay, I'll meet you back here in a couple of hours," he says.

. . . Two hours later . . .

"What is in the other sheds?" the head beancounter says, now that he's had two hours to wonder.

"It's safer not to know," I suggest.

"Oh, it's locked anyway," he says rattling the padlock on the door. "And the building master key doesn't fit it."

"No," I say, thinking furiously. "But just for laughs, try your door key in it."

"It's the same type as the building master..."

"No, I meant your home door key."

"Why would that fit the d... >snick< oh. How did that…" >eeeee< >SLAM!<

"What's in there?" I ask.

"You don't want to know. Or rather the company wouldn't want you to know. Documents, thousands of them, which should have been shredded. Definitely something auditors shouldn't see. OH! A poisoned chalice!"

"Indeed," I say. "But if it was a real poisoned chalice, by this stage there'd be a stack of Revenue and Customs agents banging down the do... >ring< >ring< Hello. Uh-huh. Okay, well if you could just get them to wait in the... oh, I see. Okay then."

"What was that?"

"Security. The timing was out by a minute or two but the Revenue agents are on their way up as we speak."


"Well I'm going to order another couple of skips but perhaps you'd like to consider the jumping game?"


"Or you could wait a couple of minutes for Revenue to break down the door?"


. . .

Oddly, a rational man would have chosen the bin from the company that HE had booked rather than the one from the company that I had booked. His one, full of empty cardboard boxes, rather that my bin, full of VT52s covered with several layers of cardboard...

That's the thing about a poison chalice - the best thing you can do is pass it on...

Eight steps to building an HP BladeSystem

More from The Register

next story
Sysadmin Day 2014: Quick, there's still time to get the beers in
He walked over the broken glass, killed the thugs... and er... reconnected the cables*
SHOCK and AWS: The fall of Amazon's deflationary cloud
Just as Jeff Bezos did to books and CDs, Amazon's rivals are now doing to it
Amazon Reveals One Weird Trick: A Loss On Almost $20bn In Sales
Investors really hate it: Share price plunge as growth SLOWS in key AWS division
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
BlackBerry: Toss the server, mate... BES is in the CLOUD now
BlackBerry Enterprise Services takes aim at SMEs - but there's a catch
The triumph of VVOL: Everyone's jumping into bed with VMware
'Bandwagon'? Yes, we're on it and so what, say big dogs
Carbon tax repeal won't see data centre operators cut prices
Rackspace says electricity isn't a major cost, Equinix promises 'no levy'
prev story


Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.