7 ms·

I wouldn't be surprised if this actually didn't happen. Let's see if there are elements in the story that stand out if we take this perspective. (It is much har

I wouldn't be surprised if this actually didn't happen. Let's see if there are elements in the story that stand out if we take this perspective. (It is much harder than detecting photoshop effects). + He could have been on holidays, or getting a child, but it is the death of his mother. Of course, we are gonna feel really bad for him. That's really good for the story. + The security of the system is such that on one hand a dongle is needed, but on the other hand someone can fake sending email through your account. This is apparently widely known by non-expert colleagues to just joke around, but not known by the security staff. + Technological "details" that do not seem to make sense such as SQL to make it sound like a true story to the uneducated. + The writer already assumes that we think he is lying. Hence, he comes up with the dongle story. We would already have been fine with his word that he just didn't send the resignation letter. + He physically shows up 6 weeks later without checking his email once (reply email). Of course the effect of the story is much stronger in that case. However, is it very likely not to check your email at least just before you show up at work 6 weeks later? [Edit: incorrect assumption, see @c8g.] Then what would be motive of the person asking the question. It is a throwaway account. + A researcher who wants to see what the difference is between a fake story on Facebook versus one asked on StackOverflow? How could such an effect be properly compared?

jamespo 9y ago
Most suspicious to me is if I really wanted help, like this purports to, I'd be following up all the replies for more information avidly.
Lewton 9y ago
+ The lack of follow up answer to the question "Which country are you in?"
- MrQuincle 9y ago
  True, I've omitted the things that seem to be platform specific. + No follow up comments on questions for some more info or thanking people that feel for him. + Using a very general name as nickname (although not English). + A throwaway account. Although it's understandable, because it is a personal story; if this would happen to me everyone would know. It also interesting to see how good the story is. When people respond to this in the sense of "who did it?", they come up with the CEO. If he would have weaved in the name of one of his colleagues that used to joke around with fake email addresses, the story plot becomes weaker.
  - jamespo 9y ago
    Yup, doesn't want to give any more details in case the story gets unpicked
djsumdog 9y ago
If the poster didn't really send these e-mails/IMs/communications, this would be a huge fraud, security, workers rights, BS situation. In most situations in IT, directors will pay these types of situations out, mark them as redundancies and move on. I agree. Everything about this story should be examined carefully.
c8g 9y ago
> is it very likely not to check your email at least just before you show up at work 6 weeks later? a work dongle is needed to read reply email and he said that he didn't bring it.
- MrQuincle 9y ago
  Of course, my bad! That actually neatly fits the story line.
- RockyMcNuts 9y ago
  But you're not going to call or email that you're coming in on X date after being gone for 6 weeks or so with no specified return date?
chki 9y ago
Thanks for actually pointing out all those things that made me feel as if the story was made up. I would add the general style of the write up. It does not seem like a person being actually keen to receive an answer but is written like a tale. For example, notice the start of each paragraph: "Anyway"; "now maybe"; "the fact is". (That might be his personal way of writing as well, but it adds to the suspicious feeling) And of course the fact that one can simply quit by Email, especially after having worked at a company for a long time seems highly unlikely, I would at least expect them to call you before moving on.
- spuz 9y ago
  I know of a few instances of people resigning by email. Two weeks ago, one project manager and one engineer quit by email from my parents' company on the same day. In one instance, I started working as a replacement for the engineer the day after. It's not inconceivable to me that a CEO would take that email as formal notice, or that they might find a replacement within 6 weeks.
staeff 9y ago
Also, he is protecting his CEO. Let him stand in a positive light, with his/her hands bound. If my boss would react like him "there was nothing he could do because they already hired someone to replace me". I'd be really really mad at him.
sinaa 9y ago
+ Shrugging-off an act of felony being committed. Nevertheless, it does pose a more general question. Given that in many workplaces the employer has access to your work email/account, how can one prove that he/she did not send a particular email?
- rwmj 9y ago
  There's a large amount of information generated when you send an email, and a whole branch of IT (digital forensics) with many dedicated professionals who deal with such things routinely. Even though I only worked peripherally with digital forensics people, and I know a lot about how email/computers/networks work, I know enough to know that I could never get away with forging an email (especially not one where anything serious depended on it).
  - sinaa 9y ago
    Still, as far as I understand it, it comes down to how good/competent the IT dept is at log-keeping, and how complicit they are in the forgery. In a more broader way, how can one prove innocence if their company use the employee's credentials (ID/email/etc.) to drop the blame on them? Wouldn't it be the employees words against the employer, while at the same time the employer has the control over the data/evidence?
    - jamespo 9y ago
      If they are clued up enough to require 2FA to send email remotely, they're clued up enough to keep logs.
    - rwmj 9y ago
      Digital forensics professionals deal all the time with attempts at active fraud (eg. people deleting logs, clearing caches, etc). Even if the IT department didn't keep the logs, or tried to delete them, there would be some "Data remanence" on one of the various machines involved in sending/transmitting/receiving the email.
      - 9y ago
martyvis 9y ago
Also the fact that it seems no one from his work (bosses or colleagues) phoned him or made contact in his absence to enquire about his or his mother's wellbeing to empathise with him on his resignation (which would have therefore eliminated his "surprise" on his return.
deathhand 9y ago
Assuming it is fake then it could possibly be a CEO asking the experts "can I get away with this?"
- Cthulhu_ 9y ago
  CEO couldn't, it's fraud, but employee laws / rights in the US are pretty shoddy to begin with so I'm sure just firing the guy normally wouldn't be too difficult.
darklajid 9y ago
I see a lot of company mail servers misconfigured to allow authenticated users send mail as anyone. So while the SQL part makes no sense to me, sending mails for another account seems rather widespread whereever I .. tested. And then there's of course the ability to just send from your account and change only the FROM header.
- lostboys67 9y ago
  Your can send mail from SQL a simple form and a suitable SPROC - I have done this from Oracle back in the day
iicc 9y ago
Alternatively (if it's not a complete fabrication - which I agree is most likely). The author implies that he's used the 'SQL' way of sending emails. Calling it 'SQL' sounds like a way of feigning ignorance of the details - and therefore giving a defense on future cross-examination. I suspect he either used it personally to resign, or asked a colleague to, who has effectively been set up.
charlysisto 9y ago
Although some of these hypotheses are vaguely plausible I think it is outrageous to lay all the suspicion on a potential victim. I'm not saying we should be naive and take everything for granted in this story but the least we can do is assume he's telling the truth before advocating the devil - specially in regards of a mothers death. Also : + if it was holidays or a child he wouldn't have left in a rush : those departure should arguably be prepared in advance + "Technological details" are very vague and sounds like something he overheard but didn't understand or know how to use. + the throwaway account means nothing and could very well plead in his favour : he's not sure he wants to spend time attacking his company so he stays anonymous before taking a rushed decision. + not checking his email is consistent with not having the dongle !
- MrQuincle 9y ago
  > but the least we can do is assume he's telling the truth before advocating the devil - specially in regards of a mothers death. Thanks for your counterarguments. I of course admit that my assumptions are assumptions and henceforth definitely not airtight. However, I just wanted to say that I would have never actually responded to that question itself with how I commented on HN, just to be safe.
  - charlysisto 9y ago
    I am biased because I read HN daily and kind of assume everybody does - including the author of the story. Which is silly... Nevertheless I strongly believe in the presumption of innocence, even outside of court, as a general moral rule we owe to others. Outrageous might of been a little strong though :)
- Chris2048 9y ago
  Who's "advocating the devil"? It's only outrageous if you act on the suspicion.
  - cyphar 9y ago
    https://en.wikipedia.org/wiki/Devil%27s_advocate https://en.wikipedia.org/wiki/Devil%27s_advocate
loup-vaillant 9y ago
A lot of good points, but not all of them feel valid. > not known by the security staff. They may just not care, or at least not make that a priority. If the dongle stuff was done just to comply to some norm or regulation, actual security could be perceived to be secondary. > The writer already assumes that we think he is lying. Not quite. He assumes we think he could be mistaken. ("[…] it could be conceivable […] that, in my grief, I remotely logged in, sent the email and forgot I did it"). Still a bit fishy, but not as much as you make it sound. > is it very likely not to check your email at least just before you show up at work 6 weeks later? That can be estimated, but not that if it were me, that would be a virtual certainty. I never check my work email outside of work. I go to work first, then I check my email. > It is a throwaway account. Of course it is. One does not want to tie a long term account (which may be tied to a meat-space identity) with negative stuff like that. The evidence by throwaway is practically nil.
- mseebach 9y ago
  > > The writer already assumes that we think he is lying. > Not quite. He assumes we think he could be mistaken. ("[…] it could be conceivable […] that, in my grief, I remotely logged in, sent the email and forgot I did it"). Still a bit fishy, but not as much as you make it sound. Not quite assuming that we think he's lying, but a very common tell for lies is that the lier is preempting challenges to weak points in the story. A lot hinges on his location and the exact job, but it smells very fishy that he apparently is set up for remote access to email (so it sounds like a "regular" knowledge worker job where checking your email from not-the-office at times is not uncommon), but when leaving very suddenly, ie. with no time to hand over work to colleagues, as you'd normally do for planned leave, he wouldn't bring the dongle with him, to be able to check in and make sure his colleagues have what they need to move on without him.
pfisch 9y ago
I also thought this seemed fake when I read it. Just a gut feeling though.
noway421 9y ago
Would be interesting indeed to know what kind of set up they are using that emails are stored in SQL and don't specifically go for example through postfix/exim where it can be easily detected by logs. Or why they are not using gmail/exchange.
Grustaf 9y ago
Plus, how could they have found and hired a replacement in just 6 weeks?
- spuz 9y ago
  For what it's worth, my parents asked me to replace one of their contracting engineers who had just resigned. I started working for them the next day. Obviously hiring contractors is different from permanent employees, but if you have the right connections, you can fill a position quickly enough.
  - Grustaf 9y ago
    Your parents didn't have to search for very long, and you happened to be available. Both of these circumstances are quite unusual.
- RugnirViking 9y ago
  He doesn't specify what country or what position he held - if it was a low-skill position then that's more than enough time for some areas
ktr 9y ago
The other thing that is odd is that they mentioned their mother's illness took a turn for the worse and they were communicating with only the CEO via phone. It seems unlikely that you only let the CEO know at the beginning of your absence and then don't let him/her know when you will actually be coming back. It also seems unlikely that the company would accept your resignation, post the position, interview, make an offer, and have the new person start all within 6 weeks. Perhaps it is just me, but that seems like an aggressive timeframe to get all of that done.
ebbv 9y ago
You don't even need to poke specific holes in this story. It's an internet story, so if it smells like bullshit it probably is. Apply Occam's Razor to it. What's more likely; that some unknown person resigned on this guy's behalf or that he resigned and he's going with this b.s. story to save face or that none of this happened? One of the latter two is the most likely. It's a pile of baloney.
- spuz 9y ago
  I don't understand your application of Occam's razor. In what way is the scenario that he resigned by accident more likely? Maybe he was drunk, angry, depressed and overwhelmed and sent an email later to change his mind but then... why write about it on stackexchange? Or assuming none of it's true, again why bother writing it up and pretending a fake story? It's fine to say "this is the internet and people invent stories" but to apply Occam's razor you need to actually come up with a motivation that would cause this guy to actually invent this story and post it online.
  - ebbv 9y ago
    I don't feel like I need to explain his motive for posting on SE since the original story doesn't address it either (since he's already fired and seems to have given up. Why is he posting is still an open question even if you believe the original story.) Why he chose to post is a separate issue. People have any number of motives for doing things, and what you believe to be reasonable explanations depends on how you think about human psychology. Personally I have seen enough people post lies online that I don't even worry about what the motives are anymore. I just look at what I think is more likely; is this story true or not? This story reeks to me. There's no way some unknown person resigned for him. Either he did it and regretted it or this whole story is made up. Both of those are way simpler than the claim that some unknown person logged into his secure email and that the company reacted so nonchalantly to him telling them he didn't do it. If someone hated him enough to write a fake resignation letter and risk their own career like that, he would know who it was. Frankly it's one of the more obvious fake stories on HN in a while.
    - 9y ago
arethuza 9y ago
'Technological "details" that do not seem to make sense' It's not unusual for database servers to have functions available to send emails from stored procedures - it doesn't seem completely unlikely to me that someone could use something like this to send spoof emails.
rmc 9y ago
> is it very likely not to check your email at least just before you show up at work 6 weeks later? This very much depends on the country, and local employment expectations. There's the old joke comparing US and European "out-of-office" auto replies: US: "I am on holidays, but I'll check in with my email about every night. I can be reached at $PHONE_NUMBER for an emergency" Europe: "I am on holiday. I will return in 4 weeks."
- pc86 9y ago
  This is very much a personal preference and not a culture/company thing. I've worked for companies with great work-life balance where some employees (including non-management) would check emails over the weekend or when on vacation. And I've worked for companies that had an expectation you check email on the weekends where some employees (including management) would not do anything over a holiday.
lr4444lr 9y ago
It also makes no sense that HR would not have called him and/or his emergency contact in all that time once they were informed of his decision.

jamespo 9y ago

Most suspicious to me is if I really wanted help, like this purports to, I'd be following up all the replies for more information avidly.

Lewton 9y ago

+ The lack of follow up answer to the question "Which country are you in?"

MrQuincle 9y ago
True, I've omitted the things that seem to be platform specific. + No follow up comments on questions for some more info or thanking people that feel for him. + Using a very general name as nickname (although not English). + A throwaway account. Although it's understandable, because it is a personal story; if this would happen to me everyone would know. It also interesting to see how good the story is. When people respond to this in the sense of "who did it?", they come up with the CEO. If he would have weaved in the name of one of his colleagues that used to joke around with fake email addresses, the story plot becomes weaker.
- jamespo 9y ago
  Yup, doesn't want to give any more details in case the story gets unpicked

djsumdog 9y ago

If the poster didn't really send these e-mails/IMs/communications, this would be a huge fraud, security, workers rights, BS situation. In most situations in IT, directors will pay these types of situations out, mark them as redundancies and move on. I agree. Everything about this story should be examined carefully.

c8g 9y ago

> is it very likely not to check your email at least just before you show up at work 6 weeks later? a work dongle is needed to read reply email and he said that he didn't bring it.

MrQuincle 9y ago
Of course, my bad! That actually neatly fits the story line.
RockyMcNuts 9y ago
But you're not going to call or email that you're coming in on X date after being gone for 6 weeks or so with no specified return date?

chki 9y ago

Thanks for actually pointing out all those things that made me feel as if the story was made up. I would add the general style of the write up. It does not seem like a person being actually keen to receive an answer but is written like a tale. For example, notice the start of each paragraph: "Anyway"; "now maybe"; "the fact is". (That might be his personal way of writing as well, but it adds to the suspicious feeling) And of course the fact that one can simply quit by Email, especially after having worked at a company for a long time seems highly unlikely, I would at least expect them to call you before moving on.

spuz 9y ago
I know of a few instances of people resigning by email. Two weeks ago, one project manager and one engineer quit by email from my parents' company on the same day. In one instance, I started working as a replacement for the engineer the day after. It's not inconceivable to me that a CEO would take that email as formal notice, or that they might find a replacement within 6 weeks.

staeff 9y ago

Also, he is protecting his CEO. Let him stand in a positive light, with his/her hands bound. If my boss would react like him "there was nothing he could do because they already hired someone to replace me". I'd be really really mad at him.

sinaa 9y ago

+ Shrugging-off an act of felony being committed. Nevertheless, it does pose a more general question. Given that in many workplaces the employer has access to your work email/account, how can one prove that he/she did not send a particular email?

rwmj 9y ago
There's a large amount of information generated when you send an email, and a whole branch of IT (digital forensics) with many dedicated professionals who deal with such things routinely. Even though I only worked peripherally with digital forensics people, and I know a lot about how email/computers/networks work, I know enough to know that I could never get away with forging an email (especially not one where anything serious depended on it).
- sinaa 9y ago
  Still, as far as I understand it, it comes down to how good/competent the IT dept is at log-keeping, and how complicit they are in the forgery. In a more broader way, how can one prove innocence if their company use the employee's credentials (ID/email/etc.) to drop the blame on them? Wouldn't it be the employees words against the employer, while at the same time the employer has the control over the data/evidence?
  - jamespo 9y ago
    If they are clued up enough to require 2FA to send email remotely, they're clued up enough to keep logs.
  - rwmj 9y ago
    Digital forensics professionals deal all the time with attempts at active fraud (eg. people deleting logs, clearing caches, etc). Even if the IT department didn't keep the logs, or tried to delete them, there would be some "Data remanence" on one of the various machines involved in sending/transmitting/receiving the email.
    - 9y ago

martyvis 9y ago

Also the fact that it seems no one from his work (bosses or colleagues) phoned him or made contact in his absence to enquire about his or his mother's wellbeing to empathise with him on his resignation (which would have therefore eliminated his "surprise" on his return.

deathhand 9y ago

Assuming it is fake then it could possibly be a CEO asking the experts "can I get away with this?"

Cthulhu_ 9y ago
CEO couldn't, it's fraud, but employee laws / rights in the US are pretty shoddy to begin with so I'm sure just firing the guy normally wouldn't be too difficult.

darklajid 9y ago

I see a lot of company mail servers misconfigured to allow authenticated users send mail as anyone. So while the SQL part makes no sense to me, sending mails for another account seems rather widespread whereever I .. tested. And then there's of course the ability to just send from your account and change only the FROM header.

lostboys67 9y ago
Your can send mail from SQL a simple form and a suitable SPROC - I have done this from Oracle back in the day

iicc 9y ago

Alternatively (if it's not a complete fabrication - which I agree is most likely). The author implies that he's used the 'SQL' way of sending emails. Calling it 'SQL' sounds like a way of feigning ignorance of the details - and therefore giving a defense on future cross-examination. I suspect he either used it personally to resign, or asked a colleague to, who has effectively been set up.

charlysisto 9y ago

Although some of these hypotheses are vaguely plausible I think it is outrageous to lay all the suspicion on a potential victim. I'm not saying we should be naive and take everything for granted in this story but the least we can do is assume he's telling the truth before advocating the devil - specially in regards of a mothers death. Also : + if it was holidays or a child he wouldn't have left in a rush : those departure should arguably be prepared in advance + "Technological details" are very vague and sounds like something he overheard but didn't understand or know how to use. + the throwaway account means nothing and could very well plead in his favour : he's not sure he wants to spend time attacking his company so he stays anonymous before taking a rushed decision. + not checking his email is consistent with not having the dongle !

MrQuincle 9y ago
> but the least we can do is assume he's telling the truth before advocating the devil - specially in regards of a mothers death. Thanks for your counterarguments. I of course admit that my assumptions are assumptions and henceforth definitely not airtight. However, I just wanted to say that I would have never actually responded to that question itself with how I commented on HN, just to be safe.
- charlysisto 9y ago
  I am biased because I read HN daily and kind of assume everybody does - including the author of the story. Which is silly... Nevertheless I strongly believe in the presumption of innocence, even outside of court, as a general moral rule we owe to others. Outrageous might of been a little strong though :)
Chris2048 9y ago
Who's "advocating the devil"? It's only outrageous if you act on the suspicion.
- cyphar 9y ago
  https://en.wikipedia.org/wiki/Devil%27s_advocate https://en.wikipedia.org/wiki/Devil%27s_advocate

loup-vaillant 9y ago

A lot of good points, but not all of them feel valid. > not known by the security staff. They may just not care, or at least not make that a priority. If the dongle stuff was done just to comply to some norm or regulation, actual security could be perceived to be secondary. > The writer already assumes that we think he is lying. Not quite. He assumes we think he could be mistaken. ("[…] it could be conceivable […] that, in my grief, I remotely logged in, sent the email and forgot I did it"). Still a bit fishy, but not as much as you make it sound. > is it very likely not to check your email at least just before you show up at work 6 weeks later? That can be estimated, but not that if it were me, that would be a virtual certainty. I never check my work email outside of work. I go to work first, then I check my email. > It is a throwaway account. Of course it is. One does not want to tie a long term account (which may be tied to a meat-space identity) with negative stuff like that. The evidence by throwaway is practically nil.

mseebach 9y ago
> > The writer already assumes that we think he is lying. > Not quite. He assumes we think he could be mistaken. ("[…] it could be conceivable […] that, in my grief, I remotely logged in, sent the email and forgot I did it"). Still a bit fishy, but not as much as you make it sound. Not quite assuming that we think he's lying, but a very common tell for lies is that the lier is preempting challenges to weak points in the story. A lot hinges on his location and the exact job, but it smells very fishy that he apparently is set up for remote access to email (so it sounds like a "regular" knowledge worker job where checking your email from not-the-office at times is not uncommon), but when leaving very suddenly, ie. with no time to hand over work to colleagues, as you'd normally do for planned leave, he wouldn't bring the dongle with him, to be able to check in and make sure his colleagues have what they need to move on without him.

pfisch 9y ago

I also thought this seemed fake when I read it. Just a gut feeling though.

noway421 9y ago

Would be interesting indeed to know what kind of set up they are using that emails are stored in SQL and don't specifically go for example through postfix/exim where it can be easily detected by logs. Or why they are not using gmail/exchange.

Grustaf 9y ago

Plus, how could they have found and hired a replacement in just 6 weeks?

spuz 9y ago
For what it's worth, my parents asked me to replace one of their contracting engineers who had just resigned. I started working for them the next day. Obviously hiring contractors is different from permanent employees, but if you have the right connections, you can fill a position quickly enough.
- Grustaf 9y ago
  Your parents didn't have to search for very long, and you happened to be available. Both of these circumstances are quite unusual.
RugnirViking 9y ago
He doesn't specify what country or what position he held - if it was a low-skill position then that's more than enough time for some areas

ktr 9y ago

The other thing that is odd is that they mentioned their mother's illness took a turn for the worse and they were communicating with only the CEO via phone. It seems unlikely that you only let the CEO know at the beginning of your absence and then don't let him/her know when you will actually be coming back. It also seems unlikely that the company would accept your resignation, post the position, interview, make an offer, and have the new person start all within 6 weeks. Perhaps it is just me, but that seems like an aggressive timeframe to get all of that done.

ebbv 9y ago

You don't even need to poke specific holes in this story. It's an internet story, so if it smells like bullshit it probably is. Apply Occam's Razor to it. What's more likely; that some unknown person resigned on this guy's behalf or that he resigned and he's going with this b.s. story to save face or that none of this happened? One of the latter two is the most likely. It's a pile of baloney.

spuz 9y ago
I don't understand your application of Occam's razor. In what way is the scenario that he resigned by accident more likely? Maybe he was drunk, angry, depressed and overwhelmed and sent an email later to change his mind but then... why write about it on stackexchange? Or assuming none of it's true, again why bother writing it up and pretending a fake story? It's fine to say "this is the internet and people invent stories" but to apply Occam's razor you need to actually come up with a motivation that would cause this guy to actually invent this story and post it online.
- ebbv 9y ago
  I don't feel like I need to explain his motive for posting on SE since the original story doesn't address it either (since he's already fired and seems to have given up. Why is he posting is still an open question even if you believe the original story.) Why he chose to post is a separate issue. People have any number of motives for doing things, and what you believe to be reasonable explanations depends on how you think about human psychology. Personally I have seen enough people post lies online that I don't even worry about what the motives are anymore. I just look at what I think is more likely; is this story true or not? This story reeks to me. There's no way some unknown person resigned for him. Either he did it and regretted it or this whole story is made up. Both of those are way simpler than the claim that some unknown person logged into his secure email and that the company reacted so nonchalantly to him telling them he didn't do it. If someone hated him enough to write a fake resignation letter and risk their own career like that, he would know who it was. Frankly it's one of the more obvious fake stories on HN in a while.
  - 9y ago

arethuza 9y ago

'Technological "details" that do not seem to make sense' It's not unusual for database servers to have functions available to send emails from stored procedures - it doesn't seem completely unlikely to me that someone could use something like this to send spoof emails.

rmc 9y ago

> is it very likely not to check your email at least just before you show up at work 6 weeks later? This very much depends on the country, and local employment expectations. There's the old joke comparing US and European "out-of-office" auto replies: US: "I am on holidays, but I'll check in with my email about every night. I can be reached at $PHONE_NUMBER for an emergency" Europe: "I am on holiday. I will return in 4 weeks."

pc86 9y ago
This is very much a personal preference and not a culture/company thing. I've worked for companies with great work-life balance where some employees (including non-management) would check emails over the weekend or when on vacation. And I've worked for companies that had an expectation you check email on the weekends where some employees (including management) would not do anything over a holiday.

lr4444lr 9y ago

It also makes no sense that HR would not have called him and/or his emergency contact in all that time once they were informed of his decision.