Matthew Pollotta

Technical product leader. IoT integrations, APIs, and the strategy behind them. Gym bro and tech nerd on the side.

[Matthew Pollotta @mpollotta]

@AlexHormozi Entrepreneurship requires sacrifice. For most entrepreneurs, you don’t do it simply because you want to, you do it because you need to. It’s a calling.

[Matthew Pollotta @mpollotta]

@LoganMohtashami Is a language not a tool itself? Likewise mathematics can be both.

[Matthew Pollotta @mpollotta]

@bobbyfijan Having a supportive partner is invaluable. Having to date is distracting and inordinately time consuming.

[Matthew Pollotta @mpollotta]

@scottbelsky It was always valued. Now that the barrier for entry has dropped so precipitously, it will be magnified even further than before.

[Matthew Pollotta @mpollotta]

Saturday morning lifts are my ultimate form of meditation. No meetings to prepare for, no agenda, no slides. Pure decompression.

[Matthew Pollotta @mpollotta]

@steveonomics I just want to avoid a dealership. DTC is a huge selling point for me.

[Matthew Pollotta @mpollotta]

@readswithravi Wake up early, brew some coffee, lift heavy, work, family.

[Matthew Pollotta @mpollotta]

@coryalthoff The onus is still on the human. No one is going to yell at AI for screwing up. The human is the integrity challenge for content submission. Git, PP, or otherwise.

[Matthew Pollotta @mpollotta]

Nvidia and Siemens want AI to run up to 80% of factory work. Step one is getting data from sensors, controllers, and business systems to speak the same language.

Same story in buildings. AI is the easy part. Getting data to agree is the hard part.

https://t.co/9k5mcVVuQZ

[Matthew Pollotta @mpollotta]

@arpitrage Mildly exciting. Like ICQ in the nineties.

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[Matthew Pollotta @mpollotta]

@tunguz @hnshah The silent killer. The cancer of infrastructure.

[Matthew Pollotta @mpollotta]

@jockowillink I like boring. Boring and progress. Because progress isn’t boring.

[Matthew Pollotta @mpollotta]

@scottbelsky As it should be.

[Matthew Pollotta @mpollotta]

@AlexHormozi Never understood your love for nicotine. And we agree on so many things.

[Matthew Pollotta @mpollotta]

@RyanHoliday I would consider experience data for knowledge to post process.

[Matthew Pollotta @mpollotta]

@OfficialLoganK The issue is, unless fusion pulls through, it’s going to be a matter of limited energy resources. The next race is compute power efficiencies.

[Matthew Pollotta @mpollotta]

@joshcorman Did we ever figure out if it actually stood for “Personal Home Page”?

[Matthew Pollotta @mpollotta]

Design systems to fail safely. Loxone was hacked this weekend, but its isolated architecture kept customers' buildings running. That's how it should be done.

https://t.co/cYSqyUllVc

[Matthew Pollotta @mpollotta]

@nejatian I don't think easy services caused the damage. It’s that nobody owned how they communicated. You can’t put that genie back, but teams can agree on the interface before shipping.