dmj

I guess that's why Bromcom didn't bother. https://aws.amazon.com/s3/storage-classes/glacier/

It kind of needs to be on and checked for bitrot if you want to preserve the data. I'd just do a dump of the data into a readable format and stick it in glacier, it will cost pennies.

That's exactly what we did - automate it and let someone else take the decision. I think that's how it should work really, IT is there to provide the systems and if someone from SMT or HR want to override it then that's their prerogative. The less TOIL the better when it all happens automatically.

lol

I don't see how that would work. If you start to do the work when you're not in contract then they don''t have any obligation to pay you and you don't have any obligation to follow their rules.

That's code for "I'm not going to take responsibility for it". If they have DBS clearance/contract/AUP in place then it seems reasonable to give them access.

Since moving to 'industry' I've done far fewer professional qualifications than I ever did in education. Qualifications are great for getting you're foot in the door for an interview, but so is experience. As soon as you get to the technical part of the interview the qualifications count for zero.

That escalated quickly!

For WPAD to be a risk, the attacker would have to setup a fast DHCP/DNS server to redirect to an incorrect pac file, then setup a proxy to sniff for passwords. I would say that if you already have 802.1x on the network then WPAD would be fine for most applications. Its really convenient for devices without any MDM and dead easy to configure.

Sounds good, but in practice it would take a lot of client>server calls to achieve or a very heavy client side application. Either way it's going to be a way off in the future considering the limitations others have discussed with their current network setups.

When we did out trial we had only half a year group, which was 150 students at a time. Wifi really wasn't an issue with 4AP's and at the time we did some calculations that it would easily scale to a full sized group. Of course it will depend on current setups - but this was six years ago so and my school wasn't that far ahead of the curve. We had a handful of spare chromebooks to hand out. We only ran a few sessions but they all went quite smoothly. I suspect it would be much more difficult if it were the exams team and not the IT team running those exams though. It's all workable, but can't seem to help thinking that this will end up be a way of letting the exam boards make more money at the expense of schools.

Worrying, scaling out servers on demand is about the easiest bit to this. Then again, it is exam boards we are talking about.

Not at all. We managed to use 1:1 computers in mock exams back in 2017 by just switching chromebooks between exam mode and user mode. IIRC we used this: https://www.digiexam.com/ We did it as a trial for year9 as they had all been using 1:1 since year 7 so would have qualified for 'normal way of working'. I left the school after that so i'm not sure if they persued it. Exam boards would save millions if this were rolled out, but I somehow doubt their shareholders would let them pass it onto schools to pay for the 1:1 schemes.

This TBH. It's how we used to backup an entire university site. We were even doing snapshots every 5mins so could recover even the silliest user mistake.

There's some advantages to having access to internal DNS, other than for resolving internal services. For example it's a good idea to force safe-search on youtube to restrict.youtube.com I'm sure there's other examples where this is useful. You don't need a fully fledged DNS server either, put a lightweight cache on the network with forwarding to your main DNS. DNSMasq, unbound etc would work for this.

ZFS replication over wireguard VPN would be my go to. But TBH it's an open question still. It really depends on what the data you are backing up is, how quickly it needs to be recovered, how much data, how in sync the backup needs to be with the source, how skilled your friend is in setting up this sort of thing, how much money he has to spend on it.

I think the point is that with API access to AI it's now trivial to add some form of AI to websites and it's virtually impossible to tell what generative AI and what is not. How would you know?

Yes if you are able to deploy them to *all* devices, and never use them externally. IMO you would be better off using an ACME service and just use a real DV certificate, it doesn't cost anything and is just as easy to setup as an internal cert. Unless you're a high end bank or something EV is overated these days IMO.

It's also been a while since I last did this. So, from the top of my head, the service account provides wifi access pre-authentication for devices that have not been logged into, not for userspace 802.1x. The configuration is done in google workspace and you can setup a new network with $USER or $USERID and $PASSWORD. As soon as the user logs in the wifi disconnects and passes the credentials to the userspace wifi . The user then logs into that network automatically. It's pretty seamless. IIRC we used EAP-TLS against freeradius - it's tiny enough to run a couple as containers in front of a loadbalancer, and the containers are ephemeral so it's easy to scale with load.

Can't you setup a federation from O365 with Google, use google MFA for staff and either leave the student MFA auth off or use a browser plugin once the students have logged in based on IP restriction ?

each? Have you seen the enterprise TL-SG-3452X and TL-SG3428XMP ? They are under £500 ea and unbeaten for features/price https://www.tp-link.com/uk/service-provider/managed-switch/tl-sg3452x/#specifications https://www.tp-link.com/uk/business-networking/managed-switch/tl-sg3428xmp/#specifications

I bet he did for 2 blokes at £500 per day !

Did you setup an SPF record as well? Run your domain through this https://dmarcly.com/tools/

Suspensions great for downhill, it's just all that effort going into compressing the springs seems such a waste when you need to get somewhere.

I can't help thinking this is the wrong way around. Isn't all the MFA stuff and context aware access (ip restrictions, encrypted drives etc) free on google education standard but extra cost on azure ?