My Data Matters

[00:00:09] Welcome everybody to another episode of MSP 1337. I'm joined this week by none other than Charles Love of Show Tech Solutions. Charles, welcome to the show. Thanks, Chris. Appreciate it. Last time we talked, it was before the end of the year, and we did our annual predictions look back. And I was thinking about, you know, if we just said, did, hey, all of those predictions come true in January?

[00:00:36] And I thought that wasn't fair because, well, it's just barely February, and I'm not sure that we've given those predictions a chance to come true yet. But one thing that has been floating around in my head, and I wanted to get your take on this, is, for lack of a better title, the world we live in is consumed by applications to solve problems in our daily lives. Are we sacrificing convenience over privacy? I guess would be where I want to start that.

[00:01:06] Full conversation. Yeah, and the answer is, nobody knows. Right? Nobody knows, right? They just, there's a thing, and somebody says, hey, you should try this thing. And, you know, nobody reads the, you know, the disclaimer or whatever. Nobody looks at the permissions it's giving you or using. They just kind of roll with it. And we've all done it, right? I am no less guilty of this than the next person on.

[00:01:36] I found an app that solves a problem for me. I've used tools like Zapier and, you know, Power Apps to help automate things. You know, maybe sometimes it's as simple as writing a rule in Outlook to help it navigate and put something, create a task somewhere.

[00:01:53] But as I was having this conversation last week with Jeff from Andromeda, we were talking about the things that we're taking for granted that when you go into, and we see this a lot in more of the, I'll call them less technical verticals.

[00:02:09] Maybe it's, I'm not downplaying that there aren't people that work in these spaces that are very technical, but you think about things like manufacturing or medical or any sort of like where the overall, the job itself isn't tied to technology. A doctor isn't diagnosing a patient, just asking, you know, the robot in the corner, like, well, what do you think?

[00:02:32] Like, not saying that's not in our future, but I mean, like, those industry verticals are often looking at technology through the lens of, is it going to inhibit me from getting work done? Is it going to just cost me more money because now you're telling me I got to replace the multimillion dollar MRI machine because it's running Windows XP, but it still works just like it did when we bought it. Why do I need to upgrade? So with that in mind, I look at the technology space and kind of through the same lens and go, okay, ban on TikTok.

[00:03:03] Now I'm using Red Note. For me, consumer, I solved my problem, right? I went from this app to that app without even taking into consideration what am I sacrificing, giving up or otherwise just giving away to have that convenience. Well, you know, we kind of went through this journey, God, six, you know, six to eight months ago. As you know, we're going through the, you know, GTI Trustmark.

[00:03:33] Sure. And as we start really evaluating all the things that we have set up, we start tightening, you know, tightening the bolts, right? Just making everything just a little bit more secure than it was, or in a lot of cases, a lot more secure. Right.

[00:03:50] One of the things that people absolutely take for granted is OAuth authentication against, say, we'll just use Office 365 just because that was our example. Yeah. So we went through and said, nobody can sign up new OAuth apps, right? So if I want to log into something that new, there's that little cool Microsoft button.

[00:04:16] I click it and it tells me, you know, the guy in charge, sorry, you don't have permissions. Talk to your administrator. Would you like to request this app? Yes. Yes. So now what it makes us do is go, all right, before I hit this button, do I need the thing? No. A lot of times people are like, I don't want to bother. I just wanted to check something out.

[00:04:39] And then because a part of the Trustmark has taught us, you really got to read what it does. Sure. And the amount of things out there that you unknowingly are giving access to SharePoint, OneDrive, like location data, stuff like that, like for a PDF reader. Mm-hmm. Why do you need access to OneDrive? That makes no sense. I'm not even saving it to OneDrive.

[00:05:08] It has nothing to do with OneDrive. Yet before, you would just be like, well, I want to use it to log in. Click. Now, you know, people are taking this a little more serious. And when they start saying, no, we're going to put a little bit of governance around this stuff, it really makes you stop and think, should I be doing this? And what is it doing? And why is a PDF reader wanting access to SharePoint and OneDrive?

[00:05:38] You know, well, let me ask you a question along those lines because I've been struggling with this too. You use the reference to, say, Acrobat or your PDF reader or whatever it might be, whoever it might be from, you know, the permissions. But it also got me thinking about some of this is also happening inside of the ecosystems that are allegedly under one product suite or one authentication package by default. So, like, we'll just use 365 as an example since we're already on that one.

[00:06:06] You know, people joke or you can go, you know, search YouTube and you'll find plenty of videos around taking advantage of the hidden gems, the hidden applications inside the 365 ecosystem that you didn't know about. And you're like, ooh, what is the loop? What is list? What is fill in the blank, right? But that's, like, the best case example that I've seen thus far, right?

[00:06:27] Like, we know that these apps are either being built inside their ecosystem or they've been built and acquired and have now been integrated into their ecosystem, right? But if you look at other ecosystems out there, and we don't need to get around the rabbit hole of names because I might end up with a target on my back. But, like, such and such acquisition just happened. Nothing's going to change. Pricing is not changing. You're like, cool. And then you're like, well, how do these apps talk to each other?

[00:06:57] These apps are talking to each other. Should they be talking to each other? And going back to the 365 example, I've noticed that there are apps in that ecosystem that as soon as you go click on that app, it immediately prompts you to do your SSO sign-on again, even though you're already logged in in the browser to 365. Yeah. And use, like, you know, just lack of a better word, the Facebook login, right? Sure.

[00:07:25] So a lot of sites, well, it's like, do you want to use Microsoft? Do you want to use Facebook? Do you want to use the Google machine? You know, heck, Apple ID. And it's not necessarily, like, straight SSO, but now all I have to do is click on the Facebook thing, and then I can do the thing. But now it has access to that, right? And, you know, we all joke about every time you, you know, hey, we should buy a Mach-E, right?

[00:07:55] The 2025 Mach-E. Next thing you know, all you see is ads for a Mach-E. You know what I mean? You know what they haven't added, though, is single sign-on for your CarPlay. Yeah, exactly. But it's just, you know, it's little things like that. So now when you start linking all these things together, you know, depending upon what they're doing, if they're backfeeding that telemetry data or whatever data that is.

[00:08:20] So wait, now I'm going to get ads for the new car and this platform, and then am I going to get emails, too, because it tied into 365? There's all these crazy scenarios. Now you're bringing up something that I've really struggled with. So when is the conversation okay to have? Let's just say you and I have, maybe it's a hiring opportunity or it's a disciplinary action or any number of things.

[00:08:46] Are we safe having that conversation in your office? Let's just say hypothetically no one is in the office except for you and me. You know, just thinking about the things that are picking up audio that are all around us. From close circuit cameras to you name it. And I hate to go down the path of Big Brother, but like what are your thoughts on that? Like the other day I was like, put it in the Faraday cage, run outside into the middle of the field, and then we can have a conversation.

[00:09:13] Well, I struggle from forgetting which robot I'm talking to, right? Is it Siri? Is it Hey Google? Is it Amazon? Like which one are we doing, right? And for those of you listening, I hope we triggered all of your IoT devices. So I'll give you a funny. This is so topical for what you just said. As you know, I have a print farm, a 3D print farm, right? Yeah, we know.

[00:09:43] We watched the power lights blip there in Tampa. Yeah. Don't wait. Here's where it gets weird. So because the holiday rush is over, I brought some of the printers to the office, right? So that the guys can like print whatever they want. So because I don't like the camera that comes on the bamboo, I buy these Wyze cameras. Mind you, I don't pay for the recording storage. I don't care.

[00:10:12] It's it's I don't need to go see the history of a part printing. I just want to see if the part is printing. Right. Right. I'm not being cheap. I just I don't need it. Right. It's like the water bottle that tells you you should drink more water. Great. Yeah, exactly. So but when it's empty, I know I did good. Well, here's where it gets weird. So I know they have sound capabilities and I know this because every time I set up a new printer, I always forget to turn it off.

[00:10:39] And then my phone just goes sound detected, sound detected, sound detected. So I am, I don't know, an hour out of Clearwater at this point, which is about 45 minutes during traffic away from Tampa. And I look at my phone and I'm getting a message saying the alarm is going off, like at the office. I'm like, huh. What happened?

[00:11:08] So I'm sitting there trying to log into the app to see what's why is the alarm going off? Right. And next thing you know, I get a note from Wise that the smoke detector has it says smoke detected. So I'm like, oh, my God, I'm burning the office down with my printer. How do I explain that one? Right.

[00:11:37] And I'm sitting there and I'm like, you know, I'm panicking. Right. Because the alarm is going off and the printer is telling me it says smoke detected. OK. This is a very important part of the story. So I pull over. I'm like panicking, trying to. I'm like, I get on the cameras. Everything is groovy. And I look and an employee didn't realize they dilly dally. You don't like the alarm when you turn it on. And they dilly dally too long.

[00:12:04] And then when they open the door, it triggered. And, you know, they're oblivious. They're going down the stairs. Do do do. You know, yeah. But I do. Right. They're gone. And that guy is long gone. He's already on the bridge. And I'm figuring out that the alarm is going off. So now I'm like, all right, cool. So I address that. So now I start looking at the where's the smoke? And I'm watching the camera feed. You know, of course, my part is printing. So I'm happy. Everything is good.

[00:12:33] And every so often I see a flash. I see a flash. I'm like, oh, my God. So, like, we're getting ready to U-turn. And what it was is, I don't know if you could see it. There's a TV behind me. It was, it's an Apple TV. So it hit the screensaver. The flashing, trust me, this all makes sense in a second. The flashing was the pictures showing up on screen.

[00:12:58] So now I'm like, all right, what is up with the smoke detector or the smoke alarm? And I'm sitting here going, wait a minute. This thing doesn't have a smoke detector. It's a camera. 30 minutes into it, I'm like, this thing is a camera. So I start going into the app and I'm, like, looking through the audit log. The damn thing says smoke alarm detected. Oh.

[00:13:28] So, so. The audio. The, the, the little thing that came over said smoke detected. It, it did not see the word alarm. Right? So what it was is it, the printer, which I didn't know this thing listened. Right? That's a part of that story. Now I do. And God, the, you've been in my office. The, the alarm panel is all the way on the other side of the building. Right? It, it was loud enough.

[00:13:57] It came through the thing. And now it's telling me that basically the smoke alarm is on. So I'm like, damn, what else is that? So now I'm like looking into wise. I'm trying to figure out how to disable the microphone. Or like, what else can it do? Yeah. But my point here is remember, like I said, I don't pay the premium fee. I feel like that's a premium feature to tell me that the alarm is going off. Right? Yeah. But you're getting it for free. Yeah.

[00:14:27] So there's, there's, there's little, there's things like that where, yes, I have it on a BYOD network. Right? Just so I can watch my cameras when I'm not here on the printer. Uh, but that's a perfect case of, I put in a solution to, I put in a thing to address the solution, which was the bamboo cameras. Terrible. I wanted a better, you know, 2k camera. So I can, I don't know, see the part.

[00:14:55] Um, but unattended consequences. This thing is listening 24 seven. Well, I have so many questions now. So many questions. The first one, and we won't go into all the questions that I have, but the first question I turned off sound detection.

[00:15:24] So I guess, I guess they just have, and mind you, this is the $29 camera. It is the cheapest. It is the OG version. If you're familiar with wise, it's like no frills, no thrills. Um, but it's, it's a perfect use of somebody using a thing and they probably released the feature because printers can catch fire. Right. So, and they know that the, you know, there's a certain community that uses this to monitor

[00:15:53] their printers. Um, but it's, it's just kind of neat. So now, you know, of course we are aware and I have a little thing blocking the microphone hole, but, um, but like sitting in my office now, right. I've got four different, four different robots. We'll say, uh, listening, listening for commands. So, and a lot of these things will have unintended consequences for good and for bad.

[00:16:24] What if wise decides they're going to just, I don't know, sell the recording? I don't know. This is super. I mean, but you get the idea. Yeah. And I think this goes back to kind of where we started this conversation around, you know, if, if I had an app that I built today and I, and I took it to, you know, publish in another

[00:16:48] country, but my disclaimer, whether I included it or not was to exfiltrate data to, to the U S and anything doesn't have to be government, right? Like anything there would immediately be like a concerned whistleblower saying we need to consider the, uh, sensitivity of data and whether or not this should be allowed in our ecosystem. Right. We don't have that really happening at all.

[00:17:15] I mean, the first example we were really given was the potential ban on Tik TOK we've seen really. And now they're talking about obviously, uh, deep seek being more of a concern and, and it raises questions like, wait, if we were already, you know, here on the back of our neck up with Tik TOK, why are we even having to debate this with deep seek? Like this shouldn't even be like a conversation, but yet we're seeing things like Microsoft has rolled it out in their ecosystem.

[00:17:40] It's available for you to install in your Azure or wherever, like at the level that we have impact, right? Like at the, the client base that you, you provide it services to your own staff, your own friends and family. What, what is the appropriate approach? Cause I think education is so easy to just be, you know, trivialize the ability to just, you

[00:18:07] know, educate somebody on, on what it means to now be conscious and aware of the things that they do. It's, it's more complicated than that. Right. But what, what does that look like? Because I feel like that's where we are today. We are at a point where we can't just say, don't do that. We have to be able to explain the why and show evidence to support that we're not crazy. Yeah. And, and like, how do you know all the capabilities of the thing? Right. Right.

[00:18:36] And how do you handle the evolution of the capabilities of the thing? Like just going back to my goofy camera example, I'm sure it didn't ship with alarm detection. I mean, maybe it did, but chances are it didn't. Right. They probably added that with a feature update or something like that. Like it just, this is the, this is the ecosystem we live in now. Right. Well, and you can't keep, you can't keep up with all of them, but it raises the question for me.

[00:19:03] So like, I'm always excited when I see a patch available for iOS, good, bad, or otherwise I don't want to know what new weird features they felt that I needed to have on my device. And so I usually I'll read through that list, especially when it's a feature that we've all been waiting for. That's been in the media, but it got me thinking about, you know, when apps are rolled out to us as employees of organizations and, you know, here you go, here's Slack, here you go, here's

[00:19:31] like, okay, but like, what am I actually getting? So, you know, it's one thing to have the app, but what, what channels are important? How are they supposed to be used? Assuming that you have some of that information. You brought this up on 365, like, sorry, Charles, you don't have permission to install that. Would you like to ask your administrator to approve it? Like, is that an area where we should really be focused? Because I feel like when you, when you roll an application out or you update apps for your

[00:20:00] clients, are you giving them the, what this update means? Like I get, we get the security stuff, but are we even telling them like, Hey, you know, we, we're doing a patch this Tuesday or tomorrow. It's addressing these things because of the concerns that have been raised through the ecosystem around threat actors. You know, obviously most, most of your clients are like, I really don't care about that stuff. Just take care of them. Keep me safe. But what about the features and the productivity?

[00:20:28] Because I think we go back to what I was trying to say is shadow IT, which I think is a bad choice of words at this point. Do you need that application? Do you need that version of, of a PDF, whatever, fill in the blank? Cause you've got six of them already on your machine. Well, it's, it's on both sides, right? So without naming the vendor, we'll just say a vendor released a, a, what I like to think is a pretty impressive feature, right?

[00:20:55] And they released it three weeks before their conference. Nobody knew it was there, right? Like we kind of saw it. We didn't understand what it was. We just assumed it was a new thing. Go to the conference. They jazz you up on it. And we're like, oh my God, this is like the coolest thing. Get back to the office and the trial, you know, the free trial that we didn't know we had expired three days later. Right?

[00:21:21] So sometimes the, the vendor, whoever the manufacturer, uh, rushes to market without telling people, Hey, we've done these things. And, you know, just because you said it once doesn't mean I've retained it. There's some, some vendor has the something pilot product that, uh, I don't know if you

[00:21:46] saw on the news that it's basically triggering your plans to be an increase, but you do have a path if you want to opt out to not have that feature get added so that you don't incur the increasing cost, but you have to be able to find it. Yeah. It's just, you know, I think there's clarity needs to be the focus for 2025. Right. And, and on both sides. Right.

[00:22:11] Uh, I I'll never forget customer, you know, we've worked together, you know, I'll call up the customer and say, Hey, here's what's happening. You know, Chris, he's new. He's, uh, he, he, he zigged when he should have zagged and all this stuff. He still keeps clicking on stuff. Yeah. Yeah. And, and I just, I'll never forget it. The guy goes to me, uh, you're, I want you to be like Tico and that's the Tampa electric company. I go, what do you, what do you mean?

[00:22:41] I thought that was a character on Dora the Explorer. No, that could be. And, and this is very true. He goes, if I, if we lose power, I don't have my rep calling me to tell me about the squirrel and his name and what he had for lunch and the fact that he buzzed himself in the, in the light box and it exploded. And that's why the lights went out. Rest in peace, Mr. Squirrel.

[00:23:09] Uh, like they, they don't tell me any of the details. Like you're telling me right now. And he, and he goes, you're telling me the name of the squirrel, what he does, what he learned. He goes, I don't care. It, I want the lights on. Just, you don't even have to tell me when the lights are on. I'll see them on. No way. Yeah. He goes, I'm paying you guys to handle it without getting me into minutia. He goes, if I want, if I, if I have minutia questions, I'll ask.

[00:23:37] So going back to your question, um, about, do you tell customers about things? You know, it really depends on the customer, but I would say probably 95%. A aren't going to understand what I'm saying. B think I'm trying to sell them something. And, and see next time they have the renewal, they'll be like, oh, now you're going to charge me for it. Right.

[00:24:04] So it's just, it's one of those, it's one of those things where we have to, as an industry kind of get better at, but also on the customer side, they have to, they can't always be mad that we don't call them. And then when we call them, they just don't want to be talking. You know, I think, I think you're onto something though. I think it's not necessarily the act of telling as much as it is the act of being able to have proof that you could have told.

[00:24:29] So like, I think it's easy to patch, especially when we're, so when we talk about security vulnerabilities, obviously we track that pretty extensively, right? Like even if we're not intentionally, uh, naming the security vulnerability that was patched, it's, it's being tracked by the tools that are doing that patching. But when someone asks for an application update, we often, I think in our space, look at it slowly through the lens of, because it's a security fix.

[00:24:59] But oftentimes apps also get features that can be great. You know, we wanted them, we've been waiting for them. You have the, what we call the unintentional features, which is the by-product of not maybe locking something down or, but it would still, you know, bug in one eye, you know, create value, to somebody else through a different lens. And then of course the third one is, is it breaks something?

[00:25:23] And I think that particularly with like business line applications, I think we should be doing a better job of being aware of those things that are being added to, not just the things that are being prevented from happening. Like we locked this down, but. But it's so funny because talk about customers, right? Hey, I want to upgrade you to windows 11. Oh, I don't want to go through that, all that stuff. Right? So now it's a fight.

[00:25:53] Look, windows 10 is going away. We need to update it. Da da da da da. Right? So I have to argue with them to get them to windows 11. But boy, just because QuickBooks releases a patch, we must install it immediately. That's a great point. You know what I mean? And, and so there's a lot of, and then, then they change something. They get mad at us. So you guys up. No, no, no. We, we got a nasty letter stating this is the third day this week. There's an update and we, and we have to update it. Right?

[00:26:24] So it's. Warning. Warning. Yeah. Right? Like an update could just be, oh, we fixed punctuation. Oh, and then we sunset this other, this, this thing that you probably were using. But the punctuation is now fixed. Right? And there's no real. No, and there's no clear indicator of what happened. Right? Or what's changing. Sure. I can go look at the notes, but think in the, in the lens of an MSP. I don't know. QuickBooks. Yeah.

[00:26:53] Uh, like, I don't know the, that's an accountant thing. I don't know the inner workings. So it's like, I read it and it says decommissioned legacy payroll system. Oh, that sounds good. Right? Right. But unbeknownst, 90% of the populace uses that, that feature that is now gone. So I wonder if there needs to be like a disclaimer or some sort of like, cause I feel like the challenge here is, and you know, we, we see this with what's happening in the, with the UK

[00:27:19] government right now, uh, you know, going down this path of requiring Apple to allow for a backdoor for the encrypted devices through the iCloud central repository. And they're, they're basically mums the word, right? You're not allowed to talk about this conversation. You're like, if this happens or doesn't happen, you can't, there is no disclosing that at this point, but it, but it raises questions around the things like what you just described,

[00:27:45] because you were in the know about that legacy app going or legacy functionality going away. Is that a burden of responsibility? And to circle this all the way back around to like, you know, the deep seeks and the, and the different products that are out there that we agree or don't agree with how they handle sensitive data and where that data goes. But we install apps every single day and we're not asking those questions, but we have no problem asking questions around things like what security vulnerability does this fix?

[00:28:14] What, uh, you know, why am I patching? Oh, there's new features. Go ahead and roll them out. We're basically speaking out of both sides of our mouths with what we're doing today when it comes to what we should be doing from a security standpoint, because we literally are saying, but we don't need the policy, the security policy or the release notes when we go to add the features and functionality. But yet we can get bent out of shape and wrapped around the axle around the tick tock red note fill in the blank. Yeah, exactly.

[00:28:43] It's just, there's a little bit of shared responsibility there and customers sometimes forget that, but it's, it's just, it's a battle we fight, right? Like I'm not going to know the context of what I'm reading on a QuickBooks update. I just, I just don't do it. And usually it's like tax code or bug fixes, you know, like we don't necessarily need to know. Right. But I think, I think the point I was trying to make and maybe I'm out, out of line here

[00:29:12] is do we need to keep track of that? But there's, that's a problem, right? So like for whatever bizarre reason, I watched this guy, Brandon on YouTube and 40 minutes, this dude will rail on about iOS 13.1.2 beta. Right. And he'll give you the full story about everything and all the way down to the modem firmware

[00:29:40] has been updated by two decibels. Right. Like just all this stuff. Right. And it's 45 minutes of my life for a device that I receive phone calls and text messages on. Right. Right. I can't possibly, I don't even imagine. I don't know. I'm going to send you a senior phone is what I'm going to do. I want to make sure that you can do those two things well and that's it. No, but like nobody's out there that I'm aware of making, let's talk about QuickBooks update 5.2.3.

[00:30:09] Well, and there probably is, right? Yeah. You just like you said, they're doing beta 13. But to your point, what I'm saying is when we tell a client or we even tell our own staff or ourselves that there's this update available, click install. Why did I do that? Because it's there. Because it keeps bothering you until you do it. Exactly. But I feel like this is a piece of the equation that suddenly more than ever is coming into

[00:30:39] the spotlight because of the things that we're seeing with products that someone did go to the version 13 beta release updates and what it may change us to, right? Ooh, the modem update. Oh, it now talks to fill in the blank country. I mean, just case in point from the commercial that we saw during the Super Bowl with T-Mobile and Starlink. If you caught subtly at the end, it says available for Verizon and whoever else the subscribers were in that list through July for free. Yep.

[00:31:09] Am I opting into it? Is it just turned on? Am I going to get told that my trial is up and I didn't know I had a trial, which means I was communicating with satellites without even giving permission? Yeah. Yeah. It's, you know, all I know, just to make it funny, with all these firmware updates on modems and iOS and things like that, all I know is there's a bad thing. I've got a 10 foot span on the Howard Franklin Bridge where I guarantee if I'm talking to you, I'll drop the call.

[00:31:36] So if they could figure out something to make that call not drop, I'm all for it. Does it matter which direction you're going? It's always when I go home because that's when I call you and I call other people. But I would venture, so I run into this too. You know how rural where I live is. You're like, oh, he must be almost to his house. I can tell you that if I make the call as I'm coming out of my driveway, going the other direction, I generally don't lose the call. It's funny. Yeah. It's just, I want to bend the antenna. Which direction am I calling? Yeah, right?

[00:32:04] Like maybe if I lick my finger and put my finger on the windshield while I'm driving, I'll be okay. Okay. Well, there you have it. We went in circles around things around privacy and security and when to do the patching. But more importantly, and I think we left this open-ended, how are you communicating to your staff and your clients when it comes to the appropriate use and disclosure of information? Because as Charles so eloquently told us, you could have a device that has built-in smoke alarm functions and you didn't even know it.

[00:32:33] And what kind of drama or liability is that bringing to your workplace just because you wanted to give your staff the opportunity to print Lego bricks? Yep, exactly. Any last word, Charles? No. Just think before you click. There you go. That's right. That's right. Think before you click. I feel like that's like click it, no ticket. For those of you listening, this has been an episode of MSP 1337. Thanks and have a great week.