5 ms·

I'm sympathetic to this. But the fact that it's a security tool being misused is what I think made for the very harsh reaction. Two scenarios: A) Rogue employe

I'm sympathetic to this. But the fact that it's a security tool being misused is what I think made for the very harsh reaction. Two scenarios: A) Rogue employee messages a bunch of internal email lists about having the right to organize B) Rogue employee configures a security extension to issue a popup saying "Happy Birthday Sundar!" every time an employee visits google.com on June 10. I am confident that A) wouldn't result in any formal adverse action (they'd mostly get a pile of nasty responses about spamming internal lists), and I am confident that B) would at the least earn the employee a reprimand and plausibly get them fired.

anarchodev 7y ago
It's incredible watching tech people in this thread assert that she wasn't fired for union agitation but if she was, that's okay too because she should have known not to be "inflammatory."
- deleted 7y ago
  [deleted]
- loopz 7y ago
  We don't have all info on this though. Maybe there were more to it. If not, it follows US workplace culture and is unfortunate.
geofft 7y ago
> I am confident that B) would at the least earn the employee a reprimand and plausibly get them fired. Yikes! That sounds like a dangerous place to work. If an employee with legitimate, assigned access to such a tool makes a change through normal procedures (not bypassing required code review or anything) and it's still a fireable mistake - well, I'm glad I don't work there.
- lostmsu 7y ago
  You are making plenty of assumptions here.
- scarmig 7y ago
  So, let's walk through the reasoning here. Data is simultaneously Google's greatest strength and its biggest liability. If an employee uploads data to a not-known-to-be-secure third party, it can literally cost Google billions of dollars depending on the data locality. Or, it could plausibly cause a severe security breach (if e.g. an employee uploads a security token into a third party decoder). And so the security team builds an extension in order to very loudly alert employees when they're on one of these known-to-be dangerous domains. And, as it happens, the implementation of the loud popups could make it a general browser notification platform whenever an employee visits a particular domain. Is it a good idea for teams to start using it as a general notification platform? No, not on any level. On top of being annoying for employees, it breaks the security UX. When someone sees one of these popups, they know they're important and that they should be very wary of whatever they're doing. But if it starts being a popup that can be triggered by anyone in the company who can convince themselves that they're providing value by sending out the popup, people start ignoring it. And there's no going back at that point, because employees have been trained to ignore the popup because of it staying stupid shit like "Happy Birthday Sundar!" and "Read these NLRB rights!" and "You can go grab a burger at the cafe today!" Everyone's been made worse off, and the original security problem has come back.
  - lr 7y ago
    You obviously didn't read her blog post where she stated the following: "This kind of code change happens all the time. We frequently add things to make our jobs easier or even to just share hobbies or interests. For example, someone changed the default desktop wallpaper during the walkout last year so that the Linux penguin was holding a protest sign. The company has never reacted aggressively in response to a notification such as this in the past. It’s always been a celebrated part of the culture."
    - scarmig 7y ago
      No, the kind of code change she committed has never happened before. A change in desktop wallpaper is not the same as a change in a security extension. The fact that other employees have participated in pro-employee activism and not been disciplined speaks to that. Some things are fine, some things are not. Abusing security software is not.
skybrian 7y ago
I could see something like (B) happening because Google used to have a lot of April Fools jokes. But it would go through code review, so the team would know about it. Doing it through hacking would be something else.

anarchodev 7y ago

It's incredible watching tech people in this thread assert that she wasn't fired for union agitation but if she was, that's okay too because she should have known not to be "inflammatory."

deleted 7y ago
[deleted]
loopz 7y ago
We don't have all info on this though. Maybe there were more to it. If not, it follows US workplace culture and is unfortunate.

geofft 7y ago

> I am confident that B) would at the least earn the employee a reprimand and plausibly get them fired. Yikes! That sounds like a dangerous place to work. If an employee with legitimate, assigned access to such a tool makes a change through normal procedures (not bypassing required code review or anything) and it's still a fireable mistake - well, I'm glad I don't work there.

lostmsu 7y ago
You are making plenty of assumptions here.
scarmig 7y ago
So, let's walk through the reasoning here. Data is simultaneously Google's greatest strength and its biggest liability. If an employee uploads data to a not-known-to-be-secure third party, it can literally cost Google billions of dollars depending on the data locality. Or, it could plausibly cause a severe security breach (if e.g. an employee uploads a security token into a third party decoder). And so the security team builds an extension in order to very loudly alert employees when they're on one of these known-to-be dangerous domains. And, as it happens, the implementation of the loud popups could make it a general browser notification platform whenever an employee visits a particular domain. Is it a good idea for teams to start using it as a general notification platform? No, not on any level. On top of being annoying for employees, it breaks the security UX. When someone sees one of these popups, they know they're important and that they should be very wary of whatever they're doing. But if it starts being a popup that can be triggered by anyone in the company who can convince themselves that they're providing value by sending out the popup, people start ignoring it. And there's no going back at that point, because employees have been trained to ignore the popup because of it staying stupid shit like "Happy Birthday Sundar!" and "Read these NLRB rights!" and "You can go grab a burger at the cafe today!" Everyone's been made worse off, and the original security problem has come back.
- lr 7y ago
  You obviously didn't read her blog post where she stated the following: "This kind of code change happens all the time. We frequently add things to make our jobs easier or even to just share hobbies or interests. For example, someone changed the default desktop wallpaper during the walkout last year so that the Linux penguin was holding a protest sign. The company has never reacted aggressively in response to a notification such as this in the past. It’s always been a celebrated part of the culture."
  - scarmig 7y ago
    No, the kind of code change she committed has never happened before. A change in desktop wallpaper is not the same as a change in a security extension. The fact that other employees have participated in pro-employee activism and not been disciplined speaks to that. Some things are fine, some things are not. Abusing security software is not.

skybrian 7y ago

I could see something like (B) happening because Google used to have a lot of April Fools jokes. But it would go through code review, so the team would know about it. Doing it through hacking would be something else.