5 ms·
I like do harmless pranks on coworkers who don't lock their computers yes "lock your computer, numbskull" | xargs say Just repeats the phrase in a monoton
by benihana 11y ago
I like do harmless pranks on coworkers who don't lock their computers
yes "lock your computer, numbskull" | xargs say
Just repeats the phrase in a monotone computer voice over their headphones. I only do this to engineers, tried it on a PM once, never again.
- melling 11y agoHave you ever asked yourself if maybe you're just being annoying? I don't lock my computer. It'll time out and lock after an hour but I prefer to leave it unlocked.
- akerl_ 11y agoThat's pretty terrible opsec. It presents a risk to separation of roles / compartmentalization if a coworker can walk over to your workstation and have access to it, to say nothing of malicious access by somebody who shouldn't be in the office in the first place.
- vinceguidry 11y agoSecurity requires a threat model to rise above theatre. If there are operations threats to your organization, then you need opsec to mitigate those threats. Is China or someone else trying to steal your trade secrets? If so, I would hope the responsibility for setting opsec policy isn't resting in one sysadmin.
- Angostura 11y ago> Is China or someone else trying to steal your trade secrets? Or more prosaically, do you have any semi-confidential e-mail on your machine, that a coworker might fancy reading?
- vinceguidry 11y agoIf you can't trust your coworkers not to go snooping on your machine while you're not there, then you should find a better job. Threat models balloon in complexity when you can't use tools like zones of trust and choke points.
- aclissold 11y agoI'd argue that the coworkers that are the most dangerous are the ones you do trust. :)
- matwood 11y agoIf locking your computer in the office is required opsec, then you have already lost. First, you shouldn't have random people walking around the office. Once someone has physical access the battle is already over. Second, rogue employees are still rogue employees, and an unlocked computer is the least of your worries. With that said, I always lock my computer out of habit.
- mentat 11y agoNot sure what size company you're working in nor what the requirements for opsec are their nor your privilege levels but it certainly does not mean you have already lost.
- deleted 11y ago[deleted]
- bluejekyll 11y agoThen why have it lock at all? You must never have access to critical things like a bank account, source code, internal documentation of business ongoings. So basically if you have no sensitive information, by all means!
- melling 11y agoSure I have. And so did everyone else in my group. If you can't trust the people who you work with... In the middle of the day someone will notice someone else using your computer. If no one does then the camera overhead will.
- bluejekyll 11y agoThat's passive vs. active security. You can always go back and figure something out, but why allow for the potential at all? It's this type of attitude that continues to have developers ignore basic best practices around security when writing code. It's all a series of defenses, the last one you should ever rely on is piecing together what happened by video camera... what happens when they install a root user, or ssh authorized key on your system and then do whatever they want at some other time?
- dllthomas 11y agoOn my team, you would surely say many things about ponies in our internal chat.
- keithy 11y agoSeems like a harmless prank to me.
- delinka 11y ago"I don't lock my computer." This is a fire-able offense where I work.
- mrspeaker 11y agoThat's a metric I use to know when it's time to change jobs: if I can't trust the people around me not to mess with my computer (or there's too many people to trust the environment) then it's time to move on.
- matwood 11y agoI agree. If you cannot trust your co-workers/employees to the point where every computer has to be locked when someone leaves their desk then it is time to move on. If there are rogue employees then the battle is already lost and a locked computer isn't going to slow anyone down.
- reagency 11y agoThat's a also metric I use when I choose service providers. If every employee is allowed to abuse any other employee's credentials to access my private data, move on.
- nemothekid 11y agoThis seems like an insane metric. For any large enough organization that is difficult to identify who actually works for $company and who is there on "business" - and given that its rare for every developer to have a locked door, you can easily have a situation where a "guest" (maybe a software vendor, or partner, or friend of coworker) is on their way to the bathroom and decides to poke around on your machine. Barring myself from working at an company with more than ~150 people (Dunbar's number) because I'm too pompous to lock my laptop doesn't seem like a metric one would be wise to follow.
- PhasmaFelis 11y ago> This seems like an insane metric. For any large enough organization that is difficult to identify who actually works for $company and who is there on "business" - and given that its rare for every developer to have a locked door, you can easily have a situation where a "guest" (maybe a software vendor, or partner, or friend of coworker) is on their way to the bathroom and decides to poke around on your machine. This is like bricking up all your windows against thieves when you live in sleepy, low-crime suburbia. Site security needs to have a balance between paranoia and practicality. For public-facing code, history has shown us that it's impossible to be too paranoid. If you work in national security, or your industry is known to be a target for industrial espionage, then certainly strong precautions are in order. But if you're just building social media sites or whatever, and you're firing people because they failed to stand ever vigilant against the possibility that Bob the visiting vendor rep might stalk the corridors waiting for you to take a bathroom break so he can rifle through your code for exploits to sell to teh haxxorz, you are being absurd.
- dllthomas 11y agoI think it's more fun with at...
- deleted 11y ago[deleted]