CozyNet Blog

Wednesday & Thursday Journal (20260730)

Publish Date: 2026-08-01

Wednesday morning was smooth sailing. I had breakfast and lunch already prepared and in the fridge, and my coffee pot programmed to startup in before I could get out of bed. I'm writing this in retrospect and can't recall most of the events that happened at work that day.

I remember my boss being upset over something with some people and was ranting on a call with them. My co-worker is kind of tone deaf and started playing videos from his phone while laughing aloud, but my boss told him to lower the volume since it was a distraction.

Later my co-worker showed me the video he was laughing at earlier which was some screw loose (I'm assuming from TikTok) that talked with a forced southern accent and his face right up in the camera while whining about how people in church whine over trivial things such as the thermostat instead of being like David and cutting heads off his enemies in the Bible. I didn't think it was very funny because it was just an awful message trying to be humorous.

After work, I went to an arts and crafts store to find some picture hanging wire and a small picture stand. I bought a hanging wire kit, but it turns out it didn't include the "D-rings" which I didn't know I would need until later. I also should have got a larger picture stand.

I'm trying to put up some paintings I got from my dad last year from out of his storage shed. The paintings come from a distant relative of mine who after World War II, took up painting. He's made a lot of these paintings, but perhaps the one that I would like most is in the possession of my aunt who got it from my uncle, who got it from my grandfather. It's a painting of a family property from the 1800's who were county pilgrims and part of where my family comes from. Oh well, she got to it first... But I do have a lot of these old paintings and they're quite nice with a characteristic charm that I find fitting.

Thursday morning I woke up well rested since it's my remote work day. I had waffles and coffee for breakfast. Things were going swell until it was 10AM and that's when the rest of my day and mood went south.

The morning scrum meeting had our security guy and a few others on the call to rattle our cages (specifically mine) over why vulnerabilities weren't being addressed. It's suppo

So cage rattling doesn't bother me much, I'm used to it, but what got me upset was two things specifically. My boss threw everyone under the bus to say that we weren't doing anything, that we were dropping the ball despite my previous work in addressing device policy discrepancies found in an audit or the .NET stuff brought up in a security review meeting. It's okay to say that it wasn't enough, but to belly ache about nobody doing anything is kind of spitting in my face here.

The second thing that upset me was that one of the guys from the IT team of the parent company said that most of the vulnerabilities he saw were for detections (that is to say, endpoints) coming from my company and that his stuff was golden. This wasn't true at all.

I didn't have any time to counter them though because I'm not interested in their stories, but instead my focus was on appeasing our security goon because his attention was only on the vulnerability count and not so much the severity of those vulnerabilities. A point that I was trying to make was that I've been working slowly to address the higher severity discoveries which were taking time, but when I brought this up he quickly shifted tactic to say that "we have a security team that already monitors for high severity items, I'm talking about breached SLA's" which was actually going back to the root of my point where everyone is just raising a stink over a number line going up without understanding the context or nuance behind it. The SLA by the way isn't actually a real SLA in the sense of there being a contract; it was just a timer tacked onto an auto generated task in Jira. There is no contract and arbitrarily tacking a timer onto something isn't going to make me work any faster; cage rattling would be more effective. So I got a little grumpy with him in the meeting for not trying to understand because I think he intended to come in guns blazing then leave without any resistance. I later apologized for my behavior in an email though, but he did not...

Also I didn't bring it up, but this supposed security team is slacking something horrible because the servers they maintain thru a managed service provider (which thank the Lord I'm not responsible for) are to the moon in both vulnerabilities. What are they up to?

So after that meeting concluded, I spent the rest of the day without taking a break to dive back into Qualys and clean it up. First order of operation was to make a new dashboard, yay...

The dashboard that we were working from originally had everything on it from servers to all the company devices, including the kitchen sink. I couldn't make heads or tails of anything because it was just thousands of duplicated junk detections and irrelevant vulnerabilities for stuff we don't maintain. I eventually figured out a better filtering method to export a report for only my domain while excluding everything else and guess how many detections came up then? Only 164, many of which were recent and would be addressed by Microsoft in a future security update.

I ran the report for Mr. Golden boys environment too and he was sitting on over just shy a thousand! Most of that looked like Google Chrome and Oracle Java SE to me, but whooie, he's got his work cut out for him. I sent him the report because I don't think he knows how to use Qualys, ergo if he can't see anything because he can't figure it out, then that must certainly mean the vulnerabilities don't exist in his books.

Meanwhile the "high severity" stuff will get a back seat for now because I gotta make that number line go down. Sorry state sponsored hijacked notepad++, but we've got out-of-date Zoom installs to address first!

Thinking back on all of this, it has me wondering what other offices are doing with their IT and security. Does it look the same as mine? I feel like we've got too many people running around that don't know what they're doing while pretending that they do as they attempt to do everything (and poorly too might I add.) I'd prefer to stay in my lane and not venture too far from it because you'd have to be a neurotic crack head Quixote to keep up with this windmill farm.

The bureaucratic controls and sign off requirements is also hampering operations too all because of a profound mistrust of one another; make no mistake in thinking it's about safety or doing things the right way because that sort of authoritarian soft speech is the pretense and excuse for covering up insecurity and dysfunction. It took me nearly a week just to get my .NET 6 removal utility and remediation script approved because one of the signers was out of office.

I guess this is just the reality of modern corporate IT. I really miss those days before these middle management MBA productivity busy body positions flooded the industry to pad out job hiring counts all to make the country look like it's doing better than it really is. It's had its consequences to say the least, especially in the competency department.

Someday soon I'd like to leave all this behind to become a goat herder or maybe a historic millwork-er because this IT junk is for the birds.

Thanks for reading my blog!