This podcast episode explores the challenges of process improvement in IT operations, using examples from data centers, automotive, and cybersecurity. The discussion covers the slow evolution of secure boot, the difficulties cloud providers face in translating their processes to the broader market, and the emergence of vehicle-to-anything ecosystems. The group delves into the need for standardization and security in vehicle ecosystems, as well as the policy management and automation challenges enterprises face. The conversation also examines the balance of trust in technology versus human expertise, particularly around the use of AI and the risks of generative AI. The CrowdStrike incident is analyzed, with debate around the responsibility of CrowdStrike, Microsoft, and Delta's operational controls. The impact on cyber insurance and the need for broader risk management approaches are also discussed, highlighting the interconnectedness of process improvement and risk management, and the call for greater industry collaboration to address these challenges. Transcript: https://otter.ai/u/93JhNjmekqf0ttX21gsupz4OeBY?utm_source=copy_url

In this episode, we continue our TechOps series, diving deep into the topic of container management. As containers become increasingly mainstream, the need to effectively manage and orchestrate these lightweight, purpose-built environments is crucial. We'll explore the distinctions between container management and orchestration, discussing the different tools, techniques and trade-offs involved. We'll also hear insights from the RackN team on how they've approached container lifecycle management within their own infrastructure management platform, Digital Rebar. This is a rich discussion that touches on everything from Kubernetes to system design trade-offs. So let's jump in and learn how to wrangle those containers!

In this episode, we dive deep into a recent and highly sophisticated SSH intrusion attack that was discovered in the Linux kernel. We'll discuss how the attackers were able to inject a backdoor into a critical compression library, leveraging social engineering tactics to become a trusted maintainer over several years. The attack was designed to bypass security checks and evade detection, even from advanced techniques like eBPF monitoring. We'll explore the technical details of how the backdoor was triggered, the potential impact on various Linux distributions, and the broader implications for software supply chain security. This incident highlights the challenges of maintaining trust in open-source projects and the need for robust security measures to protect critical infrastructure. Join us as we unpack this fascinating case and consider the lessons it holds for the future of secure software development.

A software bill of materials is the idea that we can define and document exactly what goes into a system. We look at governance today and SBOMs as we put it together, both from a software and an operation side. From an operations perspective, it truly is a big challenge. This conversation is a little bit more theoretical than some of the TechOps discussions have been. Enjoy! Transcript: https://otter.ai/u/VXWwg-ltdlwYBFYI_jNCOUmJz6M?utm_source=copy_url

SSH and Secure Shell is one of those topics that people take for granted because it is a ubiquitous way to log in and access systems. True to form for the TechOps series, though, we break that down into much more detailed and granular components. We talk about how to secure it and what best practices are. We also discuss how to use it for tunneling, or, more specifically, not use it for tunneling, and why all of this matters to your operations environment. Listen to what new things we're doing that avoid having to have network access at all. Transcript: https://otter.ai/u/XSRBfnifZOF0-nlNU5Vo_hyoSVU?utm_source=copy_url

Is high availability always a good thing? Today our discussion takes an operations perspective. We look at places where you were over or under committing high availability, where you were confusing disaster recovery for high availability, and perhaps even securing the wrong service or looking at it the wrong way. We cover all of these scenarios with practical, hands-on examples that I know you will get a lot out of. This is good prep for talking about HA clusters, because the idea of coordinating and monitoring systems is core to HA and HA clusters. In our journey with RackN, a lot of customers who thought they needed very aggressive HA systems, once they are confronted with the overhead of maintaining an HA system, have to ask if you really need it. We started with an active/passive HA implementation using third party monitoring to monitor for when the system failed and spin up the second system, creating a live streaming back up to the failover system. Transcript: https://otter.ai/u/vOVZadHvRTFCZGqcI2DC3nQzDgY?utm_source=copy_url

We dive into AI, manufacturing and how to improve manufacturing outcomes by better analyzing data. If you are interested in manufacturing or advanced applications of AI and digital twins - which is where we create accurate representations of physical items - this episode will hit all of your favorite topics! Transcript: https://otter.ai/u/xNB0GZQXB4hQMly991Wk1MwFhjw?utm_source=copy_url

We explore the UEFI certificate issue in which secure boot is potentially compromised. Certificates that are included in most UEFI BIOSes have been compromised in ways that could easily be used as an attack vector, a very significant flaw and something that should be on your purview and radar to fix and patch. We're going to talk about what the issue is, why it's important, how secure boot works, and what you can do to mitigate this problem in your own infrastructure. An important episode for anybody running or managing desktops, data centers or any infrastructure of any type. Transcript: https://otter.ai/u/H15Z2NZDom8Hta8gHJn2mQwziFM?utm_source=copy_url

We discuss the impact AI and data sovereignty data protection will have on platforms, consolidated management of your data like in Office by Microsoft or Google, on premises, and systems. This includes a whole bunch of data that you will want to use to train AI models to improve your day to day operations, but you probably don't want a lot of vendors pulling that data apart and transiting it. We have a fascinating discussion about how the market is impacting these forces. Transcript: https://otter.ai/u/gpyotjoYz5ev-1Q2yvokQi--ipg?utm_source=copy_url

This episode is one of our book club episodes starring John Walpole, who wrote the Two But Rule, which is very tongue in cheek while also very serious about momentum thinking and using a negative bouncy discussion pattern. I like to think of it as a bouncy discussion pattern to really explore ideas and drive ideation in a positive way by asking and challenging people's ideas in a constructive way. Transcript: https://otter.ai/u/2-CzhoZXo1U9URwEc3xnrV-f6-w?utm_source=copy_url