I’ve let this one kick around in the back of my mind for a while, because I’m about to accuse someone, in public, of being grossly unprofessional which could, itself, be considered unprofessional. I confess that my first impulse was to simply post the whole email thread, edited only mildly to conceal identities, but that’s obviously petty and immature. With that caveat covered, I do have what I think is an important point to make here, so I’m going to attempt to walk this fine line.
Recently, my employer has gone forward with a hardware refresh of our backup infrastructure. The portions of this hardware refresh that were more or less up for grabs were the tape library that held LTO-4 drives and how we would do encryption key management for those drives. The tape library considerations were the HP MSL series (4048s already in the building, 8096s required for this usage), Sun StorageTek SL500s, or SpectraLogic T120s (or, at the outside T200s, but that’s overkill for this environment). I won’t go into which we selected or why here, because that’s not the point (feel free to drop me a line if you’re curious, but my take is: any of these options is acceptably serviceable, so it comes down to what fits best in your environment and cost from your relevant VAR). Each of these options locks one into that vendor’s key management (unless you choose to do it in your backup software, but I have a reason not to do so that is spelled VMS), which is an irritation that will be addressed at a later date.
My confessed discomfort should be painfully more clear by the dawdling length of the introduction. The point here is that one of those vendor’s sales representative (not the VAR, I take care to note) broached the borders of acceptable behavior on his part to an inexcusable extent: he got angry, at me, via email, for politely informing him that I planned to choose another vendor’s product. And he clicked “send” (or, probably, hit Alt-S; whatever). He should be ashamed, and I expect that he is, at this point, given that I intimated to the VAR salesperson that, regardless of whatever decision we’d already made, that would have sunk the sale.
I’d asked the VAR the same question that I asked the other two: is it feasible for us to buy your schlock and switch our backups to it, but stick an LTO-4 into our existing STK L180 library, duplicate from 9940 to LTO-4 media there, with encryption, and expect to be able to read those tapes for recovery. The answer, in all cases, was, “No, that shit don’t work because none of the vendors want to play nice with each other on key management.” This VAR slightly misunderstood the question (or was misinformed), so I wrote:
[REDACTED], your answer to number 1 is actually “No” [His answer had been a qualified "Yes", but the qualifications meant it wasn't useful for me]. That is, I can’t use [REDACTED]’s product in order to write an encrypted tape outside of a [REDACTED] library (which I could then read, later, inside a [REDACTED] library).
Thanks for the responses!
I wasn’t more irritated by this than by other VAR/vendor responses to the same question: you just can’t do that with the current state of affairs unless you do all of the key management yourself, and I’m uninterested in writing and supporting (potentially past my current employment) software to do that, so my thanks were genuine.
But he Cc’ed his sales rep from the vendor, and that’s where things got messy with just one email. He (the vendor now, not that VAR) wrote:
Please tell me a secure solution that can and we will point out more then one issue to dispute that claim. We have always talked about process not just glitzy marketing claims.
Now, that’s just unprofessional, without regard to context (of which a minute detail: he addressed me, outside of the quoted material, by my given name’s nickname without ever having been encouraged to do so; my co-workers call me that, but I never said he could and I sign emails with my full name… at least he spelled it correctly), but for bonus points it’s both technically and factually incorrect.
First, technically: I can write (it’s a three weekend hack; bet me three cases of Bols Genever and I’ll prove it, but check the price on that first, because it approaches half my hourly for the same work, and I’d be releasing it under either a CC or BSD license with my name on it) a secure solution to manage keys for LTO-4 tape drives across various disparate libraries and even backup products, restricting the latter to POSIX-(mostly-)compliant operating systems. (Making it also work for our VMS systems would require some consultation with the relevantly skilled parties at my employer and another weekend or two. And another case of Genever at the bare minimum, because I’ll be fucked if I’m writing code for OpenVMS for my goddamn health.)
Second, factually: this particular vendor’s presentation is nothing but “glitzy marketing”. I have, on my desk at work, no fewer than three spiral-bound, high-gloss, heavy-stock brochures about their products, in three different form factors, only two of which even pertain to tape libraries. This is, in fact, the second time (across disparate employers) I’ve been pitched by them, and they remain the most gut-wrenchingly, plasticly cheerful saleslime I’ve ever had the misfortune to encounter.
Curiously, that wasn’t the tape library I chose to buy. Twice now. They should consider just a dab of tact, I think.