5 ms·
Security team members modifying their tools that are deployed to a large number of employees for fun ?
by qaq 7y ago
Security team members modifying their tools that are deployed to a large number of employees for fun ?
- SiempreViernes 7y agoPart of the job was writing precisely that sort of pop-ups.
- Eikon 7y agoNo, part of the job was to write pop-ups related to _security_ not to random things. This was absolutely off limits.
- nonbirithm 7y agoOnly sort of related, but one time some of the YouTube engineering team made a code change to kill off usage of Internet Explorer 6 by bypassing the usual code screening process to circumvent management. Their boss reprimanded them but eventually got in on it, without going through the appropriate channels. Then the Docs team saw the banner they showed YouTube users, thought they had actually received approval from management and used it as evidence to convince their managers to implement their own banner (who would have normally refused). All they received was a small rebuke. In fact, management praised the team for the end result of decimating IE6 usage, as intended. Then one of the architects of the scheme blogged about it in retrospect years later. https://blog.chriszacharias.com/a-conspiracy-to-kill-ie6 https://blog.chriszacharias.com/a-conspiracy-to-kill-ie6
- username90 7y agoIt was a configuration change so there were no dangers adding it, so she being a security engineer isn't relevant. The right punishment would be to tell her what channels she can use to send union messages and tell her to just do security related popups in the future. If she continued sending messages like this then fire her, but it is dumb that she got fired over something that would take literally 5 minutes to fix.
- quotemstr 7y agoConfiguration is code. Many an outage has been caused by a bad configuration push.
- username90 7y agoConfiguration which consists of an url and a message to display on said url is not that kind of configuration push.
- qaq 7y agoIt's extremely relevant I will reiterate I know literally 0 large companies where this would be tolerated from a security team member.
- username90 7y agoGoogle did tolerate exactly the same kind of behavior from the internal OS distribution team before, you could argue that security is even more important there than in a browser plugin.
- qaq 7y agoI am not a Googler but I reiterate I know exactly 0 CSOs that would tolerate this. You providing an example outside of security team kindah reinforces my point.
- username90 7y ago