19 ms·

Basecamp Employee Handbook

274 points by josemrb 9y ago

laktek 9y ago
Is there a similar publicly available product to Shipshape? https://github.com/basecamp/handbook/blob/master/our-internal-systems.md#shipshape https://github.com/basecamp/handbook/blob/master/our-interna...
philip1209 9y ago
Wow - they advise employees to remove all company data from devices, leave the company 1password account, disable touch ID, and put their attorney on speed dial every time they go through customs.
- jameskegel 9y ago
  This is the responsible thing to do in 2017.
- SomeHacker44 9y ago
  I don't go that far, but I do have all my hardware encrypted (MBP, iPhone, iPad) and I power these things off so that they will be unable to trivially decrypt them when I go through customs. I wish iDevices had a thing that would let me "double click" the power button to passcode-lock the device and disable TouchID until unlocked again. I don't use the TouchID on my MBP at all.
  - maccard 9y ago
    I've only got one thumb set up for touch ID. If you use the wrong finger 3 times, it'll disable touch ID until you put your passcode in, so you could use your other hand 3 times before you enter the airport.
  - tptacek 9y ago
    That's not enough: they can demand that you unlock the device at the border, including powering it on. If your battery is depleted, they'll give you a charger and wait. If you refuse, they can and will confiscate the devices. You can't outsmart them: for pretty much every major country, they're better at this than you are. They can do all of this even if you're a citizen. In the US, citizens (and, to a lesser but still meaningful extent, LPRs) cannot be denied entry to the country. But you can still lose all your devices. You can be detained, potentially overnight, no matter who you are. If you're not a citizen, you can be detained and then sent back without your devices. The only realistic answer is not to have sensitive data on your devices at the border at all, nor any indication of where your sensitive data is or any means of getting access to it.
    - toomuchtodo 9y ago
      It seems like the best course of action is to ship devices ahead of you and not transit the border with any tech on your person.
      - maccard 9y ago
        The best course of action is either don't travel to the US, or don't carry the devices at all. I wouldn't be surprised to find my electronics had been confiscated when importing them ahead of my travels.
        tptacek 9y ago
        With just a few possible exceptions, the real rule you're advocating for is "don't travel internationally with electronic devices". Your protections in most of Europe are also not great, and the big .EU countries are if anything more hair-trigger about sending people back. Agree or not, really all I'm saying is: "don't try to leverage your superior tech skills to outsmart customs". You are probably better at tech than the customs agent you talk to first at the border. You are not better than the customs department as a whole. Money buys a lot of tech ability, and countries have a lot of money.
        toomuchtodo 9y ago
        I'm a US citizen who lives in the US. Not traveling to the US is not an option.
        slantyyz 9y ago
        >> I'm a US citizen who lives in the US. Not traveling to the US is not an option. Why isn't it an option? The only way for you to "travel to the US" is to leave the US in the first place. You have the option to not travel outside of the US. AFAIK, while you have to deal with the TSA, you don't have to deal with customs/immigration for domestic flights.
        9y ago
- run4yourlives2 9y ago
  It's smart, but that also struck me... this is the USA we're talking about. I used to be able to enter that country with a driver's licence and a hello. Amazing how things have changed.
- richardwhiuk 9y ago
  Yeah - https://github.com/basecamp/handbook/blob/master/international-travel-guide.md https://github.com/basecamp/handbook/blob/master/internation... - ouch. It feels like this has changed a lot in a very small number of years. Does anyone know how common it is to actually be put through this rigmorole?
  - mahyarm 9y ago
    I'm guessing very uncommon, but still a possibility.
bluetidepro 9y ago
> Sabbatical - Every three years, employees are eligible to take a one-month-long sabbatical. Just give a heads-up preferably three months in advance, so we can coordinate the work-load accordingly. I wish this was more common in the tech industry. I know for other industries this is basically a standard thing, but it seems like many tech companies don't do this.
- skolos 9y ago
  One-month-long? Isn't it too short for sabbatical? How is it different from vacation? I think I might not understand what they mean by sabbatical.
  - snarf21 9y ago
    Intel has something similar. It isn't super different from vacation but it is in addition to vacation and you can attach them for a super long one.
  - bspn 9y ago
    Yes, I believe the origins of the sabbatical are in academia where it was intended to give people the ability to take an extended period of time away from their traditional role and try something different (often travel or an overseas post). This helped keep them fresh and allow them to broaden their range of experience without needing to permanently leave the institution. More recently, the term has been bastardized to a certain extent by start-ups who use it as a form of "bonus vacation" for long-serving team members.
  - fernandotakai 9y ago
    that's also what i thought -- vacations for me means a month away from work where i don't have to check anything work related (email, slack, pagerduty). according to google, sabbatical is: > a period of paid leave granted to a university teacher or other worker for study or travel, traditionally one year for every seven years worked.
    - giaour 9y ago
tangue 9y ago
It's a well thought and nicely written document though I'm not sure I'd like something like the 5x12s ( https://github.com/basecamp/handbook/blob/master/our-rituals.md https://github.com/basecamp/handbook/blob/master/our-rituals... )
- Mister_Snuggles 9y ago
  I think the "5x12s" actually sound pretty neat. Sure, it's not work related, but it's nice to have some kind of socialization with your co-workers that isn't just focused on work.
  - kossae 9y ago
    The fact that the founders are involved as well is awesome. I'd say it really humanizes them in an environment where upper-level management could seem unreachable or distant.
andygcook 9y ago
For anyone interested in handbooks and culture codes, my startup, Tettra, curated all the ones we could find on CultureCodes.co. Will add Basecamp to the list soon too.
- jamiewilson 9y ago
  Excellent resource. Thanks for sharing.
- movengeance 9y ago
  Looks like the slideshow framework you're using to iframe in the handbooks is broken; i couldn't page through any of the companies I clicked through on.
  - andygcook 9y ago
    Sorry about the issue. Which company's broken for you and which browser are you using?
tptacek 9y ago
There's a lot of good stuff here. I'm surprised about their take on speaking engagements (they're OK as long as they don't involve multi-day travel obligations). I get that you don't want team members touring talks or becoming conference tourists. But a lot of companies want their employees doing speaking engagements; Matasano/NCC, my old employer, pays a pretty substantial cash bonus for every time you do that.
- barrkel 9y ago
  Indeed; it increases the thought leadership halo around the company brand. And it's good for hiring, not just sales.
- 1337biz 9y ago
  > pays a pretty substantial cash bonus for every time you do that Super smart move - probably the cheapest but most personal marketing effort a small firm can create. Did they have an upper cap on the speaking gigs or available time?
  - tptacek 9y ago
    Not really explicitly, but implicitly they won't pay you to travel to conferences nobody has heard of (there was a list of acceptable conferences for the benefit at one point --- it covered pretty much all the well known conferences in our field, and there were a bunch of them). Part of the idea is, the good conferences do some of the vetting for the bonus for you. They discourage "touring" talks, and have a high bar for inclusion, so if you're speaking at e.g. Black Hat, CanSecWest, Recon, and Toorcon, there's probably a reason that's happening and NCC is probably very happy about that reason.
- ryandrake 9y ago
  Is "doing speaking engagements" really a big thing in tech? I've been in the industry for close to 20 years and have never felt the need to (or been asked to) go drone on about something at a conference somewhere, or even to go attend one for that matter. I couldn't even tell you what any major software conferences are, although I'd probably recognize the names of some of them.
stevenwu 9y ago
Community Supported Agriculture (CSA) Allowance Fresh, organic, local fruits and vegetables are great to have on-hand, so we'd also like to offer a CSA membership to you. Finding a local provider will be up to you, but you can expense the cost of a seasonal or annual CSA share as an employee benefit, up to $1,000/year. Count that as a perk I've never heard of before. Cool peek into how a company that works remotely can function successfully. This handbook could be a blueprint for that model - are there any other examples of remote companies publishing their internal handbooks?
- janpieterz 9y ago
  GitLab also publishes their handbook. [1] [1] https://about.gitlab.com/handbook/ https://about.gitlab.com/handbook/
- cmahler7 9y ago
  not sure if they have their whole handbook public but Zapier posts a lot of good stuff about how to run a remote startup
- santaclaus 9y ago
  > Count that as a perk I've never heard of before. A company I used to work for used to send people to the local farmers markets and stock up the kitchen at work. Employees were allowed to take home whatever they wanted and to cook whatever they wanted at lunch -- it was awesome! You quickly learn to make friends with the skilled amateur chefs in your department.
  - stinkytaco 9y ago
    As a skilled amateur chef myself, this would be awesome. I feel pretty strongly about the power of a shared meal and I make an effort to regularly make meals for groups. I think being able to share a meal as coworkers would be a fantastic workplace team builder that wouldn't take that much investment on the part of a company.
- gberger 9y ago
  Valve: http://www.valvesoftware.com/company/Valve_Handbook_LowRes.pdf http://www.valvesoftware.com/company/Valve_Handbook_LowRes.p...
josefresco 9y ago
37receipts@gmail.com - is there any risk to putting information like this "out there"? Sounds like an invitation for a phishing attempt.
- mtrpcic 9y ago
  I dont understand why they wouldn't do "receipts@37signals.com" and have it be an email address that only accepts internal mail.
  - BinaryIdiot 9y ago
    I was wondering this very same thing. Even on my small side project I have all sorts of specialized rules for certain types of email addresses.
  - chatmasta 9y ago
    Because then every vendor looking at its CRM knows it just landed a whale of a customer.
misiti3780 9y ago
seems like it would be a pretty awesome company to work for.
- mr_ndrsn 9y ago
  It is. We're hiring for Ops, too! https://m.signalvnoise.com/become-the-newest-member-of-our-ops-team-d465e4232f3d https://m.signalvnoise.com/become-the-newest-member-of-our-o... Looking to spread our timezones a bit more, hoping to see lots of EU/Pac applicants!
  - toomuchtodo 9y ago
    Looking at the job req, it mentions the expectation is for 5 minute response times when you're on call (from alert to being online) and that you're on call one week a month. Is the compensation provided in line with essentially working 24 hours a day for a week once per month? https://basecamp.workable.com/j/A5A189B311 https://basecamp.workable.com/j/A5A189B311 "We have a shared on call responsibility which is about 1 week (5 week days, and 2 weekend days) a month. (The responsibility means you'll be online within 5 minutes of receiving an alert.) We constantly work on making the on call responsibility as calm as we can. We try to finish what we start vs leaving it for someone else to clean up. When there is a code red event (like a site outage), we all pitch in to help until we are sailing on calmer seas again."
    - themcgruff 9y ago
      (I run our Ops team.) The time burden goes down with the more people we have. It's still a burden though -- and our compensation (in theory) reflects that. FWIW We're doing everything we can to make this "work hours only" M-F, which we could solve by hiring tons of people immediately, but we also have other ideals like keeping the company as small as possible that we want to realize too. There's an open and ongoing discussion about making improvements in this area and I'm thankful that David and Jason have been receptive to many of the suggestions I, or anyone else on our team has had. My personal stance is that we should do everything we can to give Ops a 40 hour work week that's during regular working hours and no more, even if that means people get cut a lot of extra slack to recover after a late night page, etc. (Hopefully our team would back me up in saying I encourage people to take reasonable time to make up "lost" hours.) (Also fwiw, I participate equally in the on call rotations.)
piqufoh 9y ago
Under parental leave; > You may also choose to take an additional 8 weeks leave unpaid. Note that this does not guarantee your employment. We're simply keeping your job open for an additional 8 weeks, unless your position becomes redundant. Is it just me, or does that sound a little harsh? (Maybe I'm used to UK workers rights) Isn't this exactly the reason why many parents don't take the parental leave they probably should? ie that they fear they will become obsolete simply from not being in the office...
- scurvy 9y ago
  This is curious considering DHH's involvement in Basecamp and how often he espouses European ideals. You'd think they had a year of maternity and paternity leave.
  - tptacek 9y ago
    50 person companies can't as a rule guarantee year-long parental leave; that's just not realistic. They can do their best to make it work, but no company of this size in this kind of market can make promises like that.
    - kayhi 9y ago
      "Employees at the Bill & Melinda Gates Foundation, the largest private foundation in the world, will be able to enjoy up to one year of paid time with their newborns during the child's first year after birth or adoption starting next year." - Business Insider
      - tptacek 9y ago
        The Bill & Melinda Gates Foundation can promise a lot of things that a 50 person competitive startup can't reasonably promise.
        zip1234 9y ago
        Also, the Bill and Melinda Gates Foundation does not make a profit...
dceddia 9y ago
I didn't know Basecamp was behind WeWorkRemotely.com. That's cool to learn. Evidently, they also sold it off recently: https://github.com/basecamp/handbook/blob/master/product-histories.md#weworkremotelycom https://github.com/basecamp/handbook/blob/master/product-his...
madmax108 9y ago
> TL;DR: Don't Travel With Work Data > If you don't need your work laptop (or tablet/phone), don't bring it with you! > Wipe company data from your phone before crossing the border. Restore it afterward. I've heard this advice quite a few times in recent times. Wonder how useful advice like this (and the implications of this) actually is.
- tptacek 9y ago
  Can you rephrase the question? What are you wondering?
  - madmax108 9y ago
    How useful is it to clean all my work data every time before crossing the border? And if I'm asked why there's no data on my system, should I say I wiped it clean? or that it's a new system? or that it's a personal system?
    - yebyen 9y ago
      If you find yourself in the position of answering why there's no data on the system, I think you'd already know the answer. It takes a pretty invasive search to come to that conclusion. (Unless your definition of wipe is like, cat /dev/zero >/dev/sda, in which case they'd probably ask why it doesn't work pretty shortly after asking you to turn it on, and then you'd get to the conclusion fairly quickly.) I've never had to deal with an invasive search like this but I've also never gone through customs with a laptop, at all. I think this kind of policy instruction is more useful as a way of simplifying the kinds of questions that General Counsel has to answer, especially in a corporate environment where you have a lot of (nerds) extremely privacy-conscious developers. That eliminates a whole class of questions. "What should I do if I am asked to unlock my computer by a customs agent?" Let them search anything they want to, if they have legal authority to do it. "What if I have sensitive company data on my work laptop and we've signed XYZ NDA with LMNO Company?" This question and a whole host of related questions will never come up at all if there is a policy against carrying any type of sensitive data through customs. If you are an employee of such company and you have issues with this policy, there is a pretty good chance it's because you aren't in the habit of keeping great backups. So that's one more great reason for the company to have this policy, as that's information that you'll want to become known and have addressed some time well before it matters.
kzisme 9y ago
> Basecamp will pay up to $100/month for your gym membership, yoga studio membership, or whatever activity you do to stay in shape. Is this sort of thing common? I wish my current employer did something like this. While I'm still skimming some of the documents - Basecamp sounds like a cool place to work.
- felixrieseberg 9y ago
  At least on the West Coast it seems pretty common - considering that companies here also pay for your health insurance, it seems like an overall decent idea.
- deleted 9y ago
  [deleted]
- fnazeeri 9y ago
  Pretty common.
- knodi123 9y ago
  I think it is often subsidized by your health insurance. But even if it isn't, it just makes sense - healthy employees need fewer sick days, and have better mental health and energy levels.
  - kzisme 9y ago
    Thanks for the reply - I was just curious because currently (first job post graduation) nothing like that is offered where I work and I would take advantage of it if I got the chance.
- kornakiewicz 9y ago
  In Poland, almost all companies offer "sport card", which can be used at gyms, pools and other facilities with no limits (or very little). I could basically spend all my free time at gym or whatever. Employee has to participate in small fraction of subscription fee (say, 10$). https://www.benefitsystems.pl/en/for-you/multisport/ https://www.benefitsystems.pl/en/for-you/multisport/
AVTizzle 9y ago
There's a few comments here pointing out their rules for wiping company data from devices when traveling through customs. As a frequent international traveler, I feel naive here... can anyone point out any resources as to why this is best practice? What's on the line here, and what's going on that we need to be aware of?
- yebyen 9y ago
  Well it's probably a lot simpler than you think. If you carry it through Customs then it is subject to search. If you don't carry it through Customs then you can be searched, and you're not disclosing any proprietary company data. Easy peasy. For any company that has external NDA obligations, this seems like a no-brainer to make legal compliance very easy. You don't want to disclose your proprietary company data, well then make a policy that says don't put proprietary company data in a position where it is likely to be subject to legal searches without any strong requirement for a warrant (probably a very short list of situations, maybe just when passing through Customs.) Now you can sign NDAs and pass through customs too, and don't worry about any potential that a conflict between the two could put you in a precarious legal position. Customs has very broad legal latitude to perform invasive searches on a whim. (Here in the US, I don't think I even need to pass through customs to be subjected to invasive searches like this when passing through an airport.)
  - amorphid 9y ago
    That makes Johnny Mnemonic sound a little less crazy.
- mattste 9y ago
  The EFF has an excellent guide on this that goes through all of the details[0]. [0]: https://www.eff.org/wp/digital-privacy-us-border-2017 https://www.eff.org/wp/digital-privacy-us-border-2017
nodesocket 9y ago
Anybody else surprised that their billing and identity system[1] is publically accessible (login required of course). Shouldn't this only be accessible within a trusted zone (office/VPN)? [1] https://billing.37signals.com https://billing.37signals.com
- jpalomaki 9y ago
  Not necessarily, Google is doing something similar: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/ And of course there's many companies who use Github and various other online services for core activities.
famousactress 9y ago
Is the sabbatical paid?
- mr_ndrsn 9y ago
  Yes!
donkaye 9y ago
i hack you boe XD
donkaye 9y ago
i hack you boe XD
donkaye 9y ago
i hack you boe XD
raja 9y ago
What is ShipShape @ Basecamp that is mentioned in the getting started guide regarding security protocol monitoring?
- t3rabytes 9y ago
  Shipshape is just a security and config audit tool that ensures that you have proper MacOS security settings (FileVault, proper password requirements, Gatekeeper, SIP, etc.) and a few other things installed (1Password, etc.).
  - danielneri 9y ago
    Any publicly available equivalent tools?
    - hb3b 9y ago
      Puppet/Salt/Chef.
epsilongreedy 9y ago
Is it just me or are their "real" benefits pretty poor? Health Care: no vision, I assume no dental. 25% copay on the PPO is on the higher end too, no? 401K: Not matching up to max. Certainly not all companies do, but still. I guess it's rare for startups. Equity pool: (1) What happens on year 6? You don't vest any more equity? (2) This feels to me like it would not reward tenured employees as much. If you joined the company at 10 people and it IPOs at 300, you would be diluted significantly more than if you started with 1-2% of the company and diluted at investment rounds (I know they don't like to take on investor money, but just for comparison) Seems like if you decide to work at Basecamp, you are trading some "real" benefits for the unique company culture.
- t3rabytes 9y ago
  Dental is there... https://github.com/basecamp/handbook/blob/master/benefits-and-perks.md https://github.com/basecamp/handbook/blob/master/benefits-an...
- deleted 9y ago
  [deleted]
- mahyarm 9y ago
  What is the difference between matching and just giving you more salary, which you could put into your 401k? Does it enable you to put even more into your 401k tax free?
  - dginsburg 9y ago
    Yes, the 401k contribution limit doesn't include what the employer matches.
  - praneshp 9y ago
    You're limited to 18k a year, which many people probably hit.S So extra salary would not help. That's one reason.
- dginsburg 9y ago
  Matching 401K up to 6% with no vesting period is exceptional. Yes, paying 25% of the cost of an individual health plan is on the high end for a tech company. However, Basecamp continues to pay 75% of the premium for family plans. Often companies pay for a much lower portion of these expensive plans. It's also a very good health plan with nationwide coverage.
aspencer8111 9y ago
This company publishes a handbook that puts most corporations to shame in every benefit category. So we are picking them apart for their 401k and their parental leave? Seriously!?! I don't understand HN any more...
- abuani 9y ago
  It's always easier to identify the bad then it is to identify the good. Especially if you're coming at this from a specific perspective "This company sucks!", then you're bound to find something that doesn't strike you as excellent. At my current company, I do not get any 401k matching, and it sucks. However, the company fully covers medical insurance for each employee and their ENTIRE family. My copay's are more then fair, and unless I end up in an emergency and I'm rushed to a hospital that's out network and it turns out that it wasn't an emergency, I have no other costs. Being married, I save thousands a year in my paycheck by not having to cover any of my insurance. Compared to the cost of my previous job, the difference is enough to fully fund my IRA which is roughly equivalent to a 4% match in my 401k which is the best any company has offered me to date. So in the end, I lost an employee match, but save $6k a year in medical insurance for my family. It's a balance, and I can understand why people would be upset to "only" see six weeks of Paternal leave, but when you look at their entire portfolio of perks, it's amazing. It is among the best. Can they do better? Sure. Should people flay them for two sticking points? Absolutely not.
krallja 9y ago
Campfire seems missing from the Product Histories. edit: filed https://github.com/basecamp/handbook/issues/11 https://github.com/basecamp/handbook/issues/11 edit2: and it's fixed already
rdslw 9y ago
I find this discussion of "benefits" fascinating. In Europe, standard in IT companies (Central Europe, mind you), is: * 25 fullt paid days (or more) of vacation every year (no need to call it a sabatical and limit it to once a three years), not including national holidays etc. * one year of (or more) paid maternity leave (or more), while second parent gets few weeks (two at my country) * free gym membership (so I can yoga/climb/whatever for free) * private health coverage (in addition to the public one, if your country (most EU has) * sickness time at least 80% paid (in most IT it's 100%) * fresh fruits daily (I don't even mention drinks etc) * education budget per employee (conferences etc) Thats a STANDARD if you want to recruit software engineer here you must have.
- mahyarm 9y ago
  The health coverage is a lot cheaper for the company. In the USA it starts at $500/month for a single dude.
  - rdslw 9y ago
    It is, but not that much as you think. Adjusted for PPP it's only 30% cheaper here.
    - apexalpha 9y ago
      My health insurance is €90 a month for full coverage. Only missing Dental. I don't think the PPP difference is that much.
      - rdslw 9y ago
        I don't think that your insurance covers things like MRI. Does it? The one I wrote about does. Dental too, but missing dental, like missing optic is the thing I dont understand. I want to be healthy, except my eyes and teeth ;)
        mahyarm 9y ago
ezyjules 9y ago
I'm pretty immersed in the field of parental leave benefits in the US and UK, having setup Pledge Parental Leave www.pledgepl.org. Important to get the full perspective on the market in the US. You're taking a crap on a company with extremely progressive benefits across the board, furthermore so, one offering them at a 'meager' size of 50, where the relative cost is much greater than compared to a 'large' company. It is very easy to make simple comparisons between UK and European standards vs US standards. The fact is that there is almost zero government funding/support for parental leave in the US. The US is the only developed country in the world without any government mandated parental leave standards. What Basecamp offer in terms of paid leave to either parent is top tier in the US. If you take a look at Facebook, Google and others they offer close to similar benefits - https://docs.google.com/presentation/d/1Ibj79Eh8Cvk4Wy_dPZNc19894N8zcQNgYem0K4EWrAg/edit?usp=sharing https://docs.google.com/presentation/d/1Ibj79Eh8Cvk4Wy_dPZNc... In the US, any company stepping up in this area is doing so of its own volition and cost - again the government gives a company zero funding. In the UK, German, Sweden etc they pick up most of the tab of extended leave. In the US, the only form of support is for mothers through expensive health insurance for the 'disability' of having a child. So before you engage in moral relativism, it's healthy to get the context and the facts. Check out http://www.pledgepl.org http://www.pledgepl.org if you want to clue up or help fix this situation.
- duncan_bayne 9y ago
  Language matters in this case, especially when you're in an advocacy role. "The government... pick[s] up most of the tab of extended leave" is simply not true. Other taxpayers - including other parents - pick up the tab.
  - ezyjules 9y ago
    Yes, point well made. This is how taxes work. In this case I was highlighting that the company itself does not have to cover the majority.
    - duncan_bayne 9y ago
      Sure - because that burden has been pushed, in part, onto its staff. I know it may seem pedantic but phrases like "Government funding", "free", and "entitlements" muddy the waters when discussing the morality of policies. Is the same as hearing "the US Government declared war on North Korea". Sounds much more heroic than it'd wind up being. At least, since Davy Crockett died ;)
rahoulb 9y ago
Everyone's going on about parental leave. To me the big thing is 37 Signals spent years railing against companies with their handbooks and written down procedures. Calling them rituals doesn't change the fact that they have processes
dginsburg 9y ago
There has been little mention of the most amazing perk at Basecamp which are the four day work weeks for four months of the year. This doesn't mean working four days of ten hours each day. You work four normal, eight hour days and get one day off.

274 points by josemrb 9y ago

Is there a similar publicly available product to Shipshape? https://github.com/basecamp/handbook/blob/master/our-internal-systems.md#shipshape https://github.com/basecamp/handbook/blob/master/our-interna...

philip1209 9y ago

Wow - they advise employees to remove all company data from devices, leave the company 1password account, disable touch ID, and put their attorney on speed dial every time they go through customs.

jameskegel 9y ago
This is the responsible thing to do in 2017.
SomeHacker44 9y ago
I don't go that far, but I do have all my hardware encrypted (MBP, iPhone, iPad) and I power these things off so that they will be unable to trivially decrypt them when I go through customs. I wish iDevices had a thing that would let me "double click" the power button to passcode-lock the device and disable TouchID until unlocked again. I don't use the TouchID on my MBP at all.
- maccard 9y ago
  I've only got one thumb set up for touch ID. If you use the wrong finger 3 times, it'll disable touch ID until you put your passcode in, so you could use your other hand 3 times before you enter the airport.
- tptacek 9y ago
  That's not enough: they can demand that you unlock the device at the border, including powering it on. If your battery is depleted, they'll give you a charger and wait. If you refuse, they can and will confiscate the devices. You can't outsmart them: for pretty much every major country, they're better at this than you are. They can do all of this even if you're a citizen. In the US, citizens (and, to a lesser but still meaningful extent, LPRs) cannot be denied entry to the country. But you can still lose all your devices. You can be detained, potentially overnight, no matter who you are. If you're not a citizen, you can be detained and then sent back without your devices. The only realistic answer is not to have sensitive data on your devices at the border at all, nor any indication of where your sensitive data is or any means of getting access to it.
  - toomuchtodo 9y ago
    It seems like the best course of action is to ship devices ahead of you and not transit the border with any tech on your person.
    - maccard 9y ago
      The best course of action is either don't travel to the US, or don't carry the devices at all. I wouldn't be surprised to find my electronics had been confiscated when importing them ahead of my travels.
      - tptacek 9y ago
        With just a few possible exceptions, the real rule you're advocating for is "don't travel internationally with electronic devices". Your protections in most of Europe are also not great, and the big .EU countries are if anything more hair-trigger about sending people back. Agree or not, really all I'm saying is: "don't try to leverage your superior tech skills to outsmart customs". You are probably better at tech than the customs agent you talk to first at the border. You are not better than the customs department as a whole. Money buys a lot of tech ability, and countries have a lot of money.
      - toomuchtodo 9y ago
        I'm a US citizen who lives in the US. Not traveling to the US is not an option.
        slantyyz 9y ago
        >> I'm a US citizen who lives in the US. Not traveling to the US is not an option. Why isn't it an option? The only way for you to "travel to the US" is to leave the US in the first place. You have the option to not travel outside of the US. AFAIK, while you have to deal with the TSA, you don't have to deal with customs/immigration for domestic flights.
        9y ago
run4yourlives2 9y ago
It's smart, but that also struck me... this is the USA we're talking about. I used to be able to enter that country with a driver's licence and a hello. Amazing how things have changed.
richardwhiuk 9y ago
Yeah - https://github.com/basecamp/handbook/blob/master/international-travel-guide.md https://github.com/basecamp/handbook/blob/master/internation... - ouch. It feels like this has changed a lot in a very small number of years. Does anyone know how common it is to actually be put through this rigmorole?
- mahyarm 9y ago
  I'm guessing very uncommon, but still a possibility.

bluetidepro 9y ago

> Sabbatical - Every three years, employees are eligible to take a one-month-long sabbatical. Just give a heads-up preferably three months in advance, so we can coordinate the work-load accordingly. I wish this was more common in the tech industry. I know for other industries this is basically a standard thing, but it seems like many tech companies don't do this.

skolos 9y ago
One-month-long? Isn't it too short for sabbatical? How is it different from vacation? I think I might not understand what they mean by sabbatical.
- snarf21 9y ago
  Intel has something similar. It isn't super different from vacation but it is in addition to vacation and you can attach them for a super long one.
- bspn 9y ago
  Yes, I believe the origins of the sabbatical are in academia where it was intended to give people the ability to take an extended period of time away from their traditional role and try something different (often travel or an overseas post). This helped keep them fresh and allow them to broaden their range of experience without needing to permanently leave the institution. More recently, the term has been bastardized to a certain extent by start-ups who use it as a form of "bonus vacation" for long-serving team members.
- fernandotakai 9y ago
  that's also what i thought -- vacations for me means a month away from work where i don't have to check anything work related (email, slack, pagerduty). according to google, sabbatical is: > a period of paid leave granted to a university teacher or other worker for study or travel, traditionally one year for every seven years worked.
  - giaour 9y ago

tangue 9y ago

It's a well thought and nicely written document though I'm not sure I'd like something like the 5x12s ( https://github.com/basecamp/handbook/blob/master/our-rituals.md https://github.com/basecamp/handbook/blob/master/our-rituals... )

Mister_Snuggles 9y ago
I think the "5x12s" actually sound pretty neat. Sure, it's not work related, but it's nice to have some kind of socialization with your co-workers that isn't just focused on work.
- kossae 9y ago
  The fact that the founders are involved as well is awesome. I'd say it really humanizes them in an environment where upper-level management could seem unreachable or distant.

andygcook 9y ago

For anyone interested in handbooks and culture codes, my startup, Tettra, curated all the ones we could find on CultureCodes.co. Will add Basecamp to the list soon too.

jamiewilson 9y ago
Excellent resource. Thanks for sharing.
movengeance 9y ago
Looks like the slideshow framework you're using to iframe in the handbooks is broken; i couldn't page through any of the companies I clicked through on.
- andygcook 9y ago
  Sorry about the issue. Which company's broken for you and which browser are you using?

tptacek 9y ago

There's a lot of good stuff here. I'm surprised about their take on speaking engagements (they're OK as long as they don't involve multi-day travel obligations). I get that you don't want team members touring talks or becoming conference tourists. But a lot of companies want their employees doing speaking engagements; Matasano/NCC, my old employer, pays a pretty substantial cash bonus for every time you do that.

barrkel 9y ago
Indeed; it increases the thought leadership halo around the company brand. And it's good for hiring, not just sales.
1337biz 9y ago
> pays a pretty substantial cash bonus for every time you do that Super smart move - probably the cheapest but most personal marketing effort a small firm can create. Did they have an upper cap on the speaking gigs or available time?
- tptacek 9y ago
  Not really explicitly, but implicitly they won't pay you to travel to conferences nobody has heard of (there was a list of acceptable conferences for the benefit at one point --- it covered pretty much all the well known conferences in our field, and there were a bunch of them). Part of the idea is, the good conferences do some of the vetting for the bonus for you. They discourage "touring" talks, and have a high bar for inclusion, so if you're speaking at e.g. Black Hat, CanSecWest, Recon, and Toorcon, there's probably a reason that's happening and NCC is probably very happy about that reason.
ryandrake 9y ago
Is "doing speaking engagements" really a big thing in tech? I've been in the industry for close to 20 years and have never felt the need to (or been asked to) go drone on about something at a conference somewhere, or even to go attend one for that matter. I couldn't even tell you what any major software conferences are, although I'd probably recognize the names of some of them.

stevenwu 9y ago

Community Supported Agriculture (CSA) Allowance Fresh, organic, local fruits and vegetables are great to have on-hand, so we'd also like to offer a CSA membership to you. Finding a local provider will be up to you, but you can expense the cost of a seasonal or annual CSA share as an employee benefit, up to $1,000/year. Count that as a perk I've never heard of before. Cool peek into how a company that works remotely can function successfully. This handbook could be a blueprint for that model - are there any other examples of remote companies publishing their internal handbooks?

janpieterz 9y ago
GitLab also publishes their handbook. [1] [1] https://about.gitlab.com/handbook/ https://about.gitlab.com/handbook/
cmahler7 9y ago
not sure if they have their whole handbook public but Zapier posts a lot of good stuff about how to run a remote startup
santaclaus 9y ago
> Count that as a perk I've never heard of before. A company I used to work for used to send people to the local farmers markets and stock up the kitchen at work. Employees were allowed to take home whatever they wanted and to cook whatever they wanted at lunch -- it was awesome! You quickly learn to make friends with the skilled amateur chefs in your department.
- stinkytaco 9y ago
  As a skilled amateur chef myself, this would be awesome. I feel pretty strongly about the power of a shared meal and I make an effort to regularly make meals for groups. I think being able to share a meal as coworkers would be a fantastic workplace team builder that wouldn't take that much investment on the part of a company.
gberger 9y ago
Valve: http://www.valvesoftware.com/company/Valve_Handbook_LowRes.pdf http://www.valvesoftware.com/company/Valve_Handbook_LowRes.p...

josefresco 9y ago

37receipts@gmail.com - is there any risk to putting information like this "out there"? Sounds like an invitation for a phishing attempt.

mtrpcic 9y ago
I dont understand why they wouldn't do "receipts@37signals.com" and have it be an email address that only accepts internal mail.
- BinaryIdiot 9y ago
  I was wondering this very same thing. Even on my small side project I have all sorts of specialized rules for certain types of email addresses.
- chatmasta 9y ago
  Because then every vendor looking at its CRM knows it just landed a whale of a customer.

misiti3780 9y ago

seems like it would be a pretty awesome company to work for.

mr_ndrsn 9y ago
It is. We're hiring for Ops, too! https://m.signalvnoise.com/become-the-newest-member-of-our-ops-team-d465e4232f3d https://m.signalvnoise.com/become-the-newest-member-of-our-o... Looking to spread our timezones a bit more, hoping to see lots of EU/Pac applicants!
- toomuchtodo 9y ago
  Looking at the job req, it mentions the expectation is for 5 minute response times when you're on call (from alert to being online) and that you're on call one week a month. Is the compensation provided in line with essentially working 24 hours a day for a week once per month? https://basecamp.workable.com/j/A5A189B311 https://basecamp.workable.com/j/A5A189B311 "We have a shared on call responsibility which is about 1 week (5 week days, and 2 weekend days) a month. (The responsibility means you'll be online within 5 minutes of receiving an alert.) We constantly work on making the on call responsibility as calm as we can. We try to finish what we start vs leaving it for someone else to clean up. When there is a code red event (like a site outage), we all pitch in to help until we are sailing on calmer seas again."
  - themcgruff 9y ago
    (I run our Ops team.) The time burden goes down with the more people we have. It's still a burden though -- and our compensation (in theory) reflects that. FWIW We're doing everything we can to make this "work hours only" M-F, which we could solve by hiring tons of people immediately, but we also have other ideals like keeping the company as small as possible that we want to realize too. There's an open and ongoing discussion about making improvements in this area and I'm thankful that David and Jason have been receptive to many of the suggestions I, or anyone else on our team has had. My personal stance is that we should do everything we can to give Ops a 40 hour work week that's during regular working hours and no more, even if that means people get cut a lot of extra slack to recover after a late night page, etc. (Hopefully our team would back me up in saying I encourage people to take reasonable time to make up "lost" hours.) (Also fwiw, I participate equally in the on call rotations.)

piqufoh 9y ago

Under parental leave; > You may also choose to take an additional 8 weeks leave unpaid. Note that this does not guarantee your employment. We're simply keeping your job open for an additional 8 weeks, unless your position becomes redundant. Is it just me, or does that sound a little harsh? (Maybe I'm used to UK workers rights) Isn't this exactly the reason why many parents don't take the parental leave they probably should? ie that they fear they will become obsolete simply from not being in the office...

scurvy 9y ago
This is curious considering DHH's involvement in Basecamp and how often he espouses European ideals. You'd think they had a year of maternity and paternity leave.
- tptacek 9y ago
  50 person companies can't as a rule guarantee year-long parental leave; that's just not realistic. They can do their best to make it work, but no company of this size in this kind of market can make promises like that.
  - kayhi 9y ago
    "Employees at the Bill & Melinda Gates Foundation, the largest private foundation in the world, will be able to enjoy up to one year of paid time with their newborns during the child's first year after birth or adoption starting next year." - Business Insider
    - tptacek 9y ago
      The Bill & Melinda Gates Foundation can promise a lot of things that a 50 person competitive startup can't reasonably promise.
      - zip1234 9y ago
        Also, the Bill and Melinda Gates Foundation does not make a profit...

dceddia 9y ago

I didn't know Basecamp was behind WeWorkRemotely.com. That's cool to learn. Evidently, they also sold it off recently: https://github.com/basecamp/handbook/blob/master/product-histories.md#weworkremotelycom https://github.com/basecamp/handbook/blob/master/product-his...

madmax108 9y ago

> TL;DR: Don't Travel With Work Data > If you don't need your work laptop (or tablet/phone), don't bring it with you! > Wipe company data from your phone before crossing the border. Restore it afterward. I've heard this advice quite a few times in recent times. Wonder how useful advice like this (and the implications of this) actually is.

tptacek 9y ago
Can you rephrase the question? What are you wondering?
- madmax108 9y ago
  How useful is it to clean all my work data every time before crossing the border? And if I'm asked why there's no data on my system, should I say I wiped it clean? or that it's a new system? or that it's a personal system?
  - yebyen 9y ago
    If you find yourself in the position of answering why there's no data on the system, I think you'd already know the answer. It takes a pretty invasive search to come to that conclusion. (Unless your definition of wipe is like, cat /dev/zero >/dev/sda, in which case they'd probably ask why it doesn't work pretty shortly after asking you to turn it on, and then you'd get to the conclusion fairly quickly.) I've never had to deal with an invasive search like this but I've also never gone through customs with a laptop, at all. I think this kind of policy instruction is more useful as a way of simplifying the kinds of questions that General Counsel has to answer, especially in a corporate environment where you have a lot of (nerds) extremely privacy-conscious developers. That eliminates a whole class of questions. "What should I do if I am asked to unlock my computer by a customs agent?" Let them search anything they want to, if they have legal authority to do it. "What if I have sensitive company data on my work laptop and we've signed XYZ NDA with LMNO Company?" This question and a whole host of related questions will never come up at all if there is a policy against carrying any type of sensitive data through customs. If you are an employee of such company and you have issues with this policy, there is a pretty good chance it's because you aren't in the habit of keeping great backups. So that's one more great reason for the company to have this policy, as that's information that you'll want to become known and have addressed some time well before it matters.

kzisme 9y ago

> Basecamp will pay up to $100/month for your gym membership, yoga studio membership, or whatever activity you do to stay in shape. Is this sort of thing common? I wish my current employer did something like this. While I'm still skimming some of the documents - Basecamp sounds like a cool place to work.

felixrieseberg 9y ago
At least on the West Coast it seems pretty common - considering that companies here also pay for your health insurance, it seems like an overall decent idea.
deleted 9y ago
[deleted]
fnazeeri 9y ago
Pretty common.
knodi123 9y ago
I think it is often subsidized by your health insurance. But even if it isn't, it just makes sense - healthy employees need fewer sick days, and have better mental health and energy levels.
- kzisme 9y ago
  Thanks for the reply - I was just curious because currently (first job post graduation) nothing like that is offered where I work and I would take advantage of it if I got the chance.
kornakiewicz 9y ago
In Poland, almost all companies offer "sport card", which can be used at gyms, pools and other facilities with no limits (or very little). I could basically spend all my free time at gym or whatever. Employee has to participate in small fraction of subscription fee (say, 10$). https://www.benefitsystems.pl/en/for-you/multisport/ https://www.benefitsystems.pl/en/for-you/multisport/

AVTizzle 9y ago

There's a few comments here pointing out their rules for wiping company data from devices when traveling through customs. As a frequent international traveler, I feel naive here... can anyone point out any resources as to why this is best practice? What's on the line here, and what's going on that we need to be aware of?

yebyen 9y ago
Well it's probably a lot simpler than you think. If you carry it through Customs then it is subject to search. If you don't carry it through Customs then you can be searched, and you're not disclosing any proprietary company data. Easy peasy. For any company that has external NDA obligations, this seems like a no-brainer to make legal compliance very easy. You don't want to disclose your proprietary company data, well then make a policy that says don't put proprietary company data in a position where it is likely to be subject to legal searches without any strong requirement for a warrant (probably a very short list of situations, maybe just when passing through Customs.) Now you can sign NDAs and pass through customs too, and don't worry about any potential that a conflict between the two could put you in a precarious legal position. Customs has very broad legal latitude to perform invasive searches on a whim. (Here in the US, I don't think I even need to pass through customs to be subjected to invasive searches like this when passing through an airport.)
- amorphid 9y ago
  That makes Johnny Mnemonic sound a little less crazy.
mattste 9y ago
The EFF has an excellent guide on this that goes through all of the details[0]. [0]: https://www.eff.org/wp/digital-privacy-us-border-2017 https://www.eff.org/wp/digital-privacy-us-border-2017

nodesocket 9y ago

Anybody else surprised that their billing and identity system[1] is publically accessible (login required of course). Shouldn't this only be accessible within a trusted zone (office/VPN)? [1] https://billing.37signals.com https://billing.37signals.com

jpalomaki 9y ago
Not necessarily, Google is doing something similar: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/ And of course there's many companies who use Github and various other online services for core activities.

famousactress 9y ago

Is the sabbatical paid?

mr_ndrsn 9y ago
Yes!

donkaye 9y ago

i hack you boe XD

donkaye 9y ago

i hack you boe XD

donkaye 9y ago

i hack you boe XD

raja 9y ago

What is ShipShape @ Basecamp that is mentioned in the getting started guide regarding security protocol monitoring?

t3rabytes 9y ago
Shipshape is just a security and config audit tool that ensures that you have proper MacOS security settings (FileVault, proper password requirements, Gatekeeper, SIP, etc.) and a few other things installed (1Password, etc.).
- danielneri 9y ago
  Any publicly available equivalent tools?
  - hb3b 9y ago
    Puppet/Salt/Chef.

epsilongreedy 9y ago

Is it just me or are their "real" benefits pretty poor? Health Care: no vision, I assume no dental. 25% copay on the PPO is on the higher end too, no? 401K: Not matching up to max. Certainly not all companies do, but still. I guess it's rare for startups. Equity pool: (1) What happens on year 6? You don't vest any more equity? (2) This feels to me like it would not reward tenured employees as much. If you joined the company at 10 people and it IPOs at 300, you would be diluted significantly more than if you started with 1-2% of the company and diluted at investment rounds (I know they don't like to take on investor money, but just for comparison) Seems like if you decide to work at Basecamp, you are trading some "real" benefits for the unique company culture.

t3rabytes 9y ago
Dental is there... https://github.com/basecamp/handbook/blob/master/benefits-and-perks.md https://github.com/basecamp/handbook/blob/master/benefits-an...
deleted 9y ago
[deleted]
mahyarm 9y ago
What is the difference between matching and just giving you more salary, which you could put into your 401k? Does it enable you to put even more into your 401k tax free?
- dginsburg 9y ago
  Yes, the 401k contribution limit doesn't include what the employer matches.
- praneshp 9y ago
  You're limited to 18k a year, which many people probably hit.S So extra salary would not help. That's one reason.
dginsburg 9y ago
Matching 401K up to 6% with no vesting period is exceptional. Yes, paying 25% of the cost of an individual health plan is on the high end for a tech company. However, Basecamp continues to pay 75% of the premium for family plans. Often companies pay for a much lower portion of these expensive plans. It's also a very good health plan with nationwide coverage.

aspencer8111 9y ago

This company publishes a handbook that puts most corporations to shame in every benefit category. So we are picking them apart for their 401k and their parental leave? Seriously!?! I don't understand HN any more...

abuani 9y ago
It's always easier to identify the bad then it is to identify the good. Especially if you're coming at this from a specific perspective "This company sucks!", then you're bound to find something that doesn't strike you as excellent. At my current company, I do not get any 401k matching, and it sucks. However, the company fully covers medical insurance for each employee and their ENTIRE family. My copay's are more then fair, and unless I end up in an emergency and I'm rushed to a hospital that's out network and it turns out that it wasn't an emergency, I have no other costs. Being married, I save thousands a year in my paycheck by not having to cover any of my insurance. Compared to the cost of my previous job, the difference is enough to fully fund my IRA which is roughly equivalent to a 4% match in my 401k which is the best any company has offered me to date. So in the end, I lost an employee match, but save $6k a year in medical insurance for my family. It's a balance, and I can understand why people would be upset to "only" see six weeks of Paternal leave, but when you look at their entire portfolio of perks, it's amazing. It is among the best. Can they do better? Sure. Should people flay them for two sticking points? Absolutely not.

krallja 9y ago

Campfire seems missing from the Product Histories. edit: filed https://github.com/basecamp/handbook/issues/11 https://github.com/basecamp/handbook/issues/11 edit2: and it's fixed already

rdslw 9y ago

I find this discussion of "benefits" fascinating. In Europe, standard in IT companies (Central Europe, mind you), is: * 25 fullt paid days (or more) of vacation every year (no need to call it a sabatical and limit it to once a three years), not including national holidays etc. * one year of (or more) paid maternity leave (or more), while second parent gets few weeks (two at my country) * free gym membership (so I can yoga/climb/whatever for free) * private health coverage (in addition to the public one, if your country (most EU has) * sickness time at least 80% paid (in most IT it's 100%) * fresh fruits daily (I don't even mention drinks etc) * education budget per employee (conferences etc) Thats a STANDARD if you want to recruit software engineer here you must have.

mahyarm 9y ago
The health coverage is a lot cheaper for the company. In the USA it starts at $500/month for a single dude.
- rdslw 9y ago
  It is, but not that much as you think. Adjusted for PPP it's only 30% cheaper here.
  - apexalpha 9y ago
    My health insurance is €90 a month for full coverage. Only missing Dental. I don't think the PPP difference is that much.
    - rdslw 9y ago
      I don't think that your insurance covers things like MRI. Does it? The one I wrote about does. Dental too, but missing dental, like missing optic is the thing I dont understand. I want to be healthy, except my eyes and teeth ;)
      - mahyarm 9y ago

ezyjules 9y ago

I'm pretty immersed in the field of parental leave benefits in the US and UK, having setup Pledge Parental Leave www.pledgepl.org. Important to get the full perspective on the market in the US. You're taking a crap on a company with extremely progressive benefits across the board, furthermore so, one offering them at a 'meager' size of 50, where the relative cost is much greater than compared to a 'large' company. It is very easy to make simple comparisons between UK and European standards vs US standards. The fact is that there is almost zero government funding/support for parental leave in the US. The US is the only developed country in the world without any government mandated parental leave standards. What Basecamp offer in terms of paid leave to either parent is top tier in the US. If you take a look at Facebook, Google and others they offer close to similar benefits - https://docs.google.com/presentation/d/1Ibj79Eh8Cvk4Wy_dPZNc19894N8zcQNgYem0K4EWrAg/edit?usp=sharing https://docs.google.com/presentation/d/1Ibj79Eh8Cvk4Wy_dPZNc... In the US, any company stepping up in this area is doing so of its own volition and cost - again the government gives a company zero funding. In the UK, German, Sweden etc they pick up most of the tab of extended leave. In the US, the only form of support is for mothers through expensive health insurance for the 'disability' of having a child. So before you engage in moral relativism, it's healthy to get the context and the facts. Check out http://www.pledgepl.org http://www.pledgepl.org if you want to clue up or help fix this situation.

duncan_bayne 9y ago
Language matters in this case, especially when you're in an advocacy role. "The government... pick[s] up most of the tab of extended leave" is simply not true. Other taxpayers - including other parents - pick up the tab.
- ezyjules 9y ago
  Yes, point well made. This is how taxes work. In this case I was highlighting that the company itself does not have to cover the majority.
  - duncan_bayne 9y ago
    Sure - because that burden has been pushed, in part, onto its staff. I know it may seem pedantic but phrases like "Government funding", "free", and "entitlements" muddy the waters when discussing the morality of policies. Is the same as hearing "the US Government declared war on North Korea". Sounds much more heroic than it'd wind up being. At least, since Davy Crockett died ;)

rahoulb 9y ago

Everyone's going on about parental leave. To me the big thing is 37 Signals spent years railing against companies with their handbooks and written down procedures. Calling them rituals doesn't change the fact that they have processes

dginsburg 9y ago

There has been little mention of the most amazing perk at Basecamp which are the four day work weeks for four months of the year. This doesn't mean working four days of ten hours each day. You work four normal, eight hour days and get one day off.