21 ms·

So many questions... What does this say about Google's hiring, about its employee's values, about values across the tech community? I can remember a time when m

by rrggrr 10y ago

So many questions... What does this say about Google's hiring, about its employee's values, about values across the tech community? I can remember a time when managements would have shut this down, when employees would have said, "not my problem", when entire industries would have buried their heads in the sand. Is it the lack of liability and regulation that clears the way for this kind of corporate citizenship? Is it cultural?

ISL 10y ago
It may be, in part, Google's giant cash machine. It makes it possible to be altruistic. In a world of fierce/commoditized competition it is much harder to expend resources on 'side' projects. Google also thrives in a healthy internet.
- lloydde 10y ago
  "They were happy to see employees spontaneously self-organizing to put their 20% time to good use." Reminded me that I heard that Google's 20% time had generally like 10% participation and has had a number of conditions including manager approval for the last 4 years. Is this article breathing new life into the myth of 20% time or does this reflect the revival of the process? Either way, incredible accomplishment on the patch army!
  - nostrademons 10y ago
    20% time has always meant different things depending on who you talk to. It's likely that you're just talking to different people. I took copious amounts of 20% time in my time at Google (2009-2014). Usually I'd start a 20% project with neither my manager's knowledge nor his approval; if it looked like it had legs, I'd let him know about it and ask what he thought. I never had a manager outright forbid me from working on a 20% project; responses ranged from "You should consider this your main project now; it's critically important that we understand this area" (along with a spot bonus for delivering on it) to "Well, you can work on it, but you are unlikely to get credit for it come promo time." In general, as long as I got my work done, my managers didn't care what else I was working on.
    - ensignavenger 10y ago
      Was your workload such that you could put in a reasonable number of hours on your 'work' and still have 20% of your time for other projects? Or was 20% time just putting in an extra 20% on top of what other developers (who didn't do 20% projects) would do?
      - nostrademons 10y ago
        Over my career there, yes, I could put a reasonable number of hours on my work and still do 20% projects. There were short periods of time when I was asked to "bank" the time and focus entirely on my main project, eg. I might work straight for 5 weeks on my main project and then take a week straight of 20% time once it launched. This suited me fine - usually the way I took 20% time was to fit it into time periods when I didn't really have much else to do or I was bored with my main project. And splitting it up like this let me focus more intently on both of them, which helped in delivering.
        ensignavenger 10y ago
        Cool, sounds like it worked out for you about the way I would expect. I suppose it may depend some on your team, I have heard some people say it is just 20% extra work.
  - krasin 10y ago
    Googler here. I recently had a 20% project that sometimes had bursts of 100% busyness (but still ~20% on average). It also was not relevant to my team and was in the benefit of "everyone". No explicit manager approval was required. It certainly depends on the particular manager or even org, but in general 20% projects are still a thing for those who want them (not many).
    - ralfd 10y ago
      > in general 20% projects are still a thing for those who want them (not many). Why is that? Any more insight for that?
      - delroth 10y ago
        People enjoy their work in different ways. Some like being 100% on their main project, some like involving themselves in many smaller efforts (both across their main project and across 20%). Also, the default state is to not have a 20% project, the only people that will work 20% on something else are those that made a specific effort to do so.
      - krasin 10y ago
        It's not uncommon for people to put additional effort (that you can spend on a 20%) to fix stuff in the primary project. Like, voluntarily adding themselves to a build cop rotation or doing code / readability reviews as a service, and so on. And sometimes, the primary project is tight on deadlines and people want to stay focused. And even when a person is enjoying the 20% opportunity, most of the time there is no good project to take on. During my stays at Google, I've done many 20% projects (>10), but only had a 20% project may be a third of the time.
  - cjmcqueen 10y ago
    Googler here, 20% projects are very real. It's a flexible tool between employee and manager that gets used in a lot of ways. The only recent guidance was that 20% projects should benefit the company. And, mileage will vary depending on the relationship between employee and manager. Some employees and managers use the program well, others don't do as good of a job, but it's still very alive and well. IMHO, this is a good example of 20%.
  - spankalee 10y ago
    20% time never went away. There's especially a lot of code health 20% projects, and like the article says, this is applying that spirit to open source.
  - hemos 10y ago
    As other Googlers have said (and yes, I'm also one) 20% time is a bit misunderstood and always has been. Suffice it to say that it never died, and different groups have different levels of participation - some times, some teams are focused on a launch so the percentage of time spent goes up or down. But generally speaking, yes, this is exactly the sort of healthy thing that we encourage.
- ehsankia 10y ago
  Not sure I follow your first point but the latter one I think hits the nail on the head. Google benefits greatly from healthy code ecosystem. Any exploit could easily come back and bite them in the ass. As big as they are and as much code as they pump out, they still rely on third party code and less exploits in the wild is a big win for them.
- rimantas 10y ago
  Google is also a big part of the reason of the poor health of the web.
  - jpatokal 10y ago
    You're going to have to explain that one a bit. Or perhaps you think Tim Berners-Lee is responsible for popunder ads, and Jon Postel for unsolicited Viagra spam?
    - dao- 10y ago
      Their browser market dominance (which they got in part through shady marketing strategies) is a big part of it. How do you think we got here: https://news.ycombinator.com/item?id=13763759 https://news.ycombinator.com/item?id=13763759
      - sjellis 10y ago
        > Their browser market dominance (which they got in part through shady marketing strategies) is a big part of it. I have to point out that Microsoft are still the biggest supplier of desktop Web browsers.
    - rimantas 10y ago
      Of course, we all know that Tim makes money by selling ads. And Google, on the other hand, has nothing to do with it /s
- dao- 10y ago
  Google is primarily a capitalist corporation and by definition not altruistic. It's accountable to its shareholders; if the CEO couldn't make a case for e.g. how employees spending part of their time on side projects somehow benefits the bottom line, this liberty wouldn't be allowed.
  - polishTar 10y ago
    Google employees own >50% of voting rights of the company stock. They aren't subject to external interests in the same way most other public companies are. On a tangent, why shouldn't we celebrate projects that benefit both private and public interests? IMO, society would be quite a bit better if the two were more often aligned (like you suggest they may be in this case).
    - dao- 10y ago
      And employees want to see the stock grow. Right? I wasn't implying that it's bad when private and public interests are aligned. What I'm saying is that this is not the same as altruism, and if private and public interests are at odds, the private ones will likely win as they have before at Google. This is just the nature of a capitalist company. Let's not have illusions about that.
      - hemos 10y ago
        While obviously, yes, we are a public company and aligned with shareholder value, you are vastly underestimating the core of the altruism in the Googlers doing this work (and working on Elections, and G4NP and so on)...and who are also a large amount of the shareholders involved.
openfuture 10y ago
It's great advertising.
- spydum 10y ago
  I mean yeah it kinda is, but you really think google needs advertising for its brand?? I think Google is doing some of the most impactful security work as a company I have ever seen. Between GOOG and MICROSOFT (within past few years) they have been instrumental in moving the bar and the industry. They both catch flack for the privacy issues (which is a leg of the InfoSec triad) but I think most people should be grateful for the work they do.
  - sushid 10y ago
    I always find it funny that people think like this. Do you think only struggling companies should strive to grow their brand? Market leaders stay market leaders with PR/branding and of course, their products. Products like Coke are internationally recognized but recognition != likeability, which is why they continue to pour in big $$$ in advertising.
  - UnoriginalGuy 10y ago
    > I mean yeah it kinda is, but you really think google needs advertising for its brand?? This is advertising BigQuery[0] which is a Google Product people may be less familiar with. This nicely shows off what can be done using a large dataset. I'm grateful for the work they've done here, and I have no doubt individual employees donated either their free time or 20% time (or w/e it is now). But that doesn't negate the fact that this is an advert for BigQuery. [0] https://cloud.google.com/bigquery/ https://cloud.google.com/bigquery/
    - amaks 10y ago
      I think you're wrong. Folks used the most convenient tool at their disposal that is based on the internal tool.
- ehsankia 10y ago
fudged71 10y ago
When your company is the web and the web is your company When you openly celebrate really nerdy technical achievements When you incentivize and promote side projects and open source There grows a camaraderie with the projects and tools that make the web what it is, and the volunteerism that open-source projects require Really inspiring.
curiousDog 10y ago
Well one thing is Google engineers are the highest paid in the Software industry. This allows anyone to move away from the "grow my career by preparing for interviews in my free time" mindset to coding for pure fun. This might not be the only reason but is definitely one of them. Hence why you won't find this attitude at say Microsoft (which has the least pay amongst the Big 4/5)
- doingmyting 10y ago
  I'm not certain this makes total sense since one company is based in Silicon Valley and the other is based in Seattle/Redmond which has very different cost of living figures (granted WA is now catching up to the valley). And to top that off, as a coder myself, I doubt I will simply decide to start coding for fun once I meet some mythical salary figure.
- mikulas_florek 10y ago
  > "grow my career by preparing for interviews in my free time" mindset That must be sad life, is this common? I work as game programmer and me and almost every other game programmer I know code for fun, and we are not paid very well.
  - hashhar 10y ago
    Well, it's a filter bubble. You can find enough people in both mindsets. It's mostly not related to pay -- related to job satisfaction, career growth options etc.
  - Fifer82 10y ago
    This attitude is why Game Development is such a terrible career. You get pennies for doing a difficult job under the guise of "yay fun" as though it is not a multi billion dollar business. You will be hard pressed to find a bigger mug than a mid level game developer. I remember working on the physics of Resistance at Sony for the PS3, and I was picking up 34 bags a year. Pretty much every other programming role I have had since is not only magnitudes easier, but pays way way more. It makes no sense to me at all.
sjwright 10y ago
Widespread community trust in the internet is what keeps Google financially viable.
StreamBright 10y ago
It is a showcase to BigQuery, also a big ad for any software engineer or security engineer who actually cares to join Google and at the same time doing something good. I guess it is a win, win, win situation. :)
cflewis 10y ago
Hey ho. So I'm on Google's open source team. Rosehub was driven entirely by rank-and-file Googlers who saw the MUNI hack and thought "This sucks and it's so simple to fix and it shouldn't happen." I remember Justine sending out some messages to various mailing lists with the identified vulnerable repos in a spreadsheet, and then people volunteered to send pull requests to repos they claimed off the spreadsheet. It's the sort of thing that happens because Googlers are actually passionate about software in the large; they just happen to work at Google. The only things I think that Google as a corporate entity does to foster that is hire the same sort of passionate people, and let them decide how best to use their work hours. This is the sort of effort that naturally arises from that. It's the same sort of thing that causes Googlers to want to open source their code (and get the director approval to do so). Googlers do it because they want to give back to software in the large, not for any perceived benefit of getting a community to work on the code (we have thousands of repos on https://github.com/google https://github.com/google that never get any external contributions).
- willnorris 10y ago
  To clarify the timeline a little bit here... Rosehub wasn't actually motivated by the MUNI hack, as it predated it by 8 months (Rosehub started in March 2016, MUNI hack was announced in November). As noted in the blog post, it was instigated by Justine seeing that open source packages weren't updating their dependencies to protect themselves, then doing some digging and realizing just how widespread the problem was. However, the MUNI hack certainly did motivate being more public about the project and writing this blog post, since it really helped underscore the severity of this vulnerability in very real, concrete terms.

by rrggrr 10y ago

ISL 10y ago

It may be, in part, Google's giant cash machine. It makes it possible to be altruistic. In a world of fierce/commoditized competition it is much harder to expend resources on 'side' projects. Google also thrives in a healthy internet.

lloydde 10y ago
"They were happy to see employees spontaneously self-organizing to put their 20% time to good use." Reminded me that I heard that Google's 20% time had generally like 10% participation and has had a number of conditions including manager approval for the last 4 years. Is this article breathing new life into the myth of 20% time or does this reflect the revival of the process? Either way, incredible accomplishment on the patch army!
- nostrademons 10y ago
  20% time has always meant different things depending on who you talk to. It's likely that you're just talking to different people. I took copious amounts of 20% time in my time at Google (2009-2014). Usually I'd start a 20% project with neither my manager's knowledge nor his approval; if it looked like it had legs, I'd let him know about it and ask what he thought. I never had a manager outright forbid me from working on a 20% project; responses ranged from "You should consider this your main project now; it's critically important that we understand this area" (along with a spot bonus for delivering on it) to "Well, you can work on it, but you are unlikely to get credit for it come promo time." In general, as long as I got my work done, my managers didn't care what else I was working on.
  - ensignavenger 10y ago
    Was your workload such that you could put in a reasonable number of hours on your 'work' and still have 20% of your time for other projects? Or was 20% time just putting in an extra 20% on top of what other developers (who didn't do 20% projects) would do?
    - nostrademons 10y ago
      Over my career there, yes, I could put a reasonable number of hours on my work and still do 20% projects. There were short periods of time when I was asked to "bank" the time and focus entirely on my main project, eg. I might work straight for 5 weeks on my main project and then take a week straight of 20% time once it launched. This suited me fine - usually the way I took 20% time was to fit it into time periods when I didn't really have much else to do or I was bored with my main project. And splitting it up like this let me focus more intently on both of them, which helped in delivering.
      - ensignavenger 10y ago
        Cool, sounds like it worked out for you about the way I would expect. I suppose it may depend some on your team, I have heard some people say it is just 20% extra work.
- krasin 10y ago
  Googler here. I recently had a 20% project that sometimes had bursts of 100% busyness (but still ~20% on average). It also was not relevant to my team and was in the benefit of "everyone". No explicit manager approval was required. It certainly depends on the particular manager or even org, but in general 20% projects are still a thing for those who want them (not many).
  - ralfd 10y ago
    > in general 20% projects are still a thing for those who want them (not many). Why is that? Any more insight for that?
    - delroth 10y ago
      People enjoy their work in different ways. Some like being 100% on their main project, some like involving themselves in many smaller efforts (both across their main project and across 20%). Also, the default state is to not have a 20% project, the only people that will work 20% on something else are those that made a specific effort to do so.
    - krasin 10y ago
      It's not uncommon for people to put additional effort (that you can spend on a 20%) to fix stuff in the primary project. Like, voluntarily adding themselves to a build cop rotation or doing code / readability reviews as a service, and so on. And sometimes, the primary project is tight on deadlines and people want to stay focused. And even when a person is enjoying the 20% opportunity, most of the time there is no good project to take on. During my stays at Google, I've done many 20% projects (>10), but only had a 20% project may be a third of the time.
- cjmcqueen 10y ago
  Googler here, 20% projects are very real. It's a flexible tool between employee and manager that gets used in a lot of ways. The only recent guidance was that 20% projects should benefit the company. And, mileage will vary depending on the relationship between employee and manager. Some employees and managers use the program well, others don't do as good of a job, but it's still very alive and well. IMHO, this is a good example of 20%.
- spankalee 10y ago
  20% time never went away. There's especially a lot of code health 20% projects, and like the article says, this is applying that spirit to open source.
- hemos 10y ago
  As other Googlers have said (and yes, I'm also one) 20% time is a bit misunderstood and always has been. Suffice it to say that it never died, and different groups have different levels of participation - some times, some teams are focused on a launch so the percentage of time spent goes up or down. But generally speaking, yes, this is exactly the sort of healthy thing that we encourage.
ehsankia 10y ago
Not sure I follow your first point but the latter one I think hits the nail on the head. Google benefits greatly from healthy code ecosystem. Any exploit could easily come back and bite them in the ass. As big as they are and as much code as they pump out, they still rely on third party code and less exploits in the wild is a big win for them.
rimantas 10y ago
Google is also a big part of the reason of the poor health of the web.
- jpatokal 10y ago
  You're going to have to explain that one a bit. Or perhaps you think Tim Berners-Lee is responsible for popunder ads, and Jon Postel for unsolicited Viagra spam?
  - dao- 10y ago
    Their browser market dominance (which they got in part through shady marketing strategies) is a big part of it. How do you think we got here: https://news.ycombinator.com/item?id=13763759 https://news.ycombinator.com/item?id=13763759
    - sjellis 10y ago
      > Their browser market dominance (which they got in part through shady marketing strategies) is a big part of it. I have to point out that Microsoft are still the biggest supplier of desktop Web browsers.
  - rimantas 10y ago
    Of course, we all know that Tim makes money by selling ads. And Google, on the other hand, has nothing to do with it /s
dao- 10y ago
Google is primarily a capitalist corporation and by definition not altruistic. It's accountable to its shareholders; if the CEO couldn't make a case for e.g. how employees spending part of their time on side projects somehow benefits the bottom line, this liberty wouldn't be allowed.
- polishTar 10y ago
  Google employees own >50% of voting rights of the company stock. They aren't subject to external interests in the same way most other public companies are. On a tangent, why shouldn't we celebrate projects that benefit both private and public interests? IMO, society would be quite a bit better if the two were more often aligned (like you suggest they may be in this case).
  - dao- 10y ago
    And employees want to see the stock grow. Right? I wasn't implying that it's bad when private and public interests are aligned. What I'm saying is that this is not the same as altruism, and if private and public interests are at odds, the private ones will likely win as they have before at Google. This is just the nature of a capitalist company. Let's not have illusions about that.
    - hemos 10y ago
      While obviously, yes, we are a public company and aligned with shareholder value, you are vastly underestimating the core of the altruism in the Googlers doing this work (and working on Elections, and G4NP and so on)...and who are also a large amount of the shareholders involved.

openfuture 10y ago

It's great advertising.

spydum 10y ago
I mean yeah it kinda is, but you really think google needs advertising for its brand?? I think Google is doing some of the most impactful security work as a company I have ever seen. Between GOOG and MICROSOFT (within past few years) they have been instrumental in moving the bar and the industry. They both catch flack for the privacy issues (which is a leg of the InfoSec triad) but I think most people should be grateful for the work they do.
- sushid 10y ago
  I always find it funny that people think like this. Do you think only struggling companies should strive to grow their brand? Market leaders stay market leaders with PR/branding and of course, their products. Products like Coke are internationally recognized but recognition != likeability, which is why they continue to pour in big $$$ in advertising.
- UnoriginalGuy 10y ago
  > I mean yeah it kinda is, but you really think google needs advertising for its brand?? This is advertising BigQuery[0] which is a Google Product people may be less familiar with. This nicely shows off what can be done using a large dataset. I'm grateful for the work they've done here, and I have no doubt individual employees donated either their free time or 20% time (or w/e it is now). But that doesn't negate the fact that this is an advert for BigQuery. [0] https://cloud.google.com/bigquery/ https://cloud.google.com/bigquery/
  - amaks 10y ago
    I think you're wrong. Folks used the most convenient tool at their disposal that is based on the internal tool.
ehsankia 10y ago

fudged71 10y ago

When your company is the web and the web is your company When you openly celebrate really nerdy technical achievements When you incentivize and promote side projects and open source There grows a camaraderie with the projects and tools that make the web what it is, and the volunteerism that open-source projects require Really inspiring.

curiousDog 10y ago

Well one thing is Google engineers are the highest paid in the Software industry. This allows anyone to move away from the "grow my career by preparing for interviews in my free time" mindset to coding for pure fun. This might not be the only reason but is definitely one of them. Hence why you won't find this attitude at say Microsoft (which has the least pay amongst the Big 4/5)

doingmyting 10y ago
I'm not certain this makes total sense since one company is based in Silicon Valley and the other is based in Seattle/Redmond which has very different cost of living figures (granted WA is now catching up to the valley). And to top that off, as a coder myself, I doubt I will simply decide to start coding for fun once I meet some mythical salary figure.
mikulas_florek 10y ago
> "grow my career by preparing for interviews in my free time" mindset That must be sad life, is this common? I work as game programmer and me and almost every other game programmer I know code for fun, and we are not paid very well.
- hashhar 10y ago
  Well, it's a filter bubble. You can find enough people in both mindsets. It's mostly not related to pay -- related to job satisfaction, career growth options etc.
- Fifer82 10y ago
  This attitude is why Game Development is such a terrible career. You get pennies for doing a difficult job under the guise of "yay fun" as though it is not a multi billion dollar business. You will be hard pressed to find a bigger mug than a mid level game developer. I remember working on the physics of Resistance at Sony for the PS3, and I was picking up 34 bags a year. Pretty much every other programming role I have had since is not only magnitudes easier, but pays way way more. It makes no sense to me at all.

sjwright 10y ago

Widespread community trust in the internet is what keeps Google financially viable.

StreamBright 10y ago

It is a showcase to BigQuery, also a big ad for any software engineer or security engineer who actually cares to join Google and at the same time doing something good. I guess it is a win, win, win situation. :)

cflewis 10y ago

Hey ho. So I'm on Google's open source team. Rosehub was driven entirely by rank-and-file Googlers who saw the MUNI hack and thought "This sucks and it's so simple to fix and it shouldn't happen." I remember Justine sending out some messages to various mailing lists with the identified vulnerable repos in a spreadsheet, and then people volunteered to send pull requests to repos they claimed off the spreadsheet. It's the sort of thing that happens because Googlers are actually passionate about software in the large; they just happen to work at Google. The only things I think that Google as a corporate entity does to foster that is hire the same sort of passionate people, and let them decide how best to use their work hours. This is the sort of effort that naturally arises from that. It's the same sort of thing that causes Googlers to want to open source their code (and get the director approval to do so). Googlers do it because they want to give back to software in the large, not for any perceived benefit of getting a community to work on the code (we have thousands of repos on https://github.com/google https://github.com/google that never get any external contributions).

willnorris 10y ago
To clarify the timeline a little bit here... Rosehub wasn't actually motivated by the MUNI hack, as it predated it by 8 months (Rosehub started in March 2016, MUNI hack was announced in November). As noted in the blog post, it was instigated by Justine seeing that open source packages weren't updating their dependencies to protect themselves, then doing some digging and realizing just how widespread the problem was. However, the MUNI hack certainly did motivate being more public about the project and writing this blog post, since it really helped underscore the severity of this vulnerability in very real, concrete terms.