20 ms·

In BigCorps, if there's a stupid requirement, there's usually a reason for the stupid requirement to be there in the first place but getting to the reason might

by sfifs 6y ago

In BigCorps, if there's a stupid requirement, there's usually a reason for the stupid requirement to be there in the first place but getting to the reason might require un-peeling a few org layers to since the people enforcing the policy will not be the people who wrote the policy. A more productive use of time would be to understand the reason for the policy, document out why it doesn't apply to your case and then attempt to get approval. For instance, there's a restriction at my workplace (not a software company, a regular old industry fortune 500) which prevents git installs from pushing to any non corporate GitHub repo from our work machines. The obvious reason it exists is to prevent people (a lot of who are analysts or data scientists - not professional programmers) from shooting themselves in the foot by pushing code to their personal repos in error. It's annoying to work around if you need to say push a contribution to an open source project and you could rage at the infosec for enforcing it - but it obviously exists because stupid errors would have happened. This principle is also called Chesterton's fence https://en.m.wikipedia.org/wiki/Wikipedia:Chesterton%27s_fence https://en.m.wikipedia.org/wiki/Wikipedia:Chesterton%27s_fen...

Aeolun 6y ago
I think the problem with this logic is it hinders a hundred people on a daily basis to prevent one person from doing something stupid once a year. That’s just not great ROI.
- RcouF1uZ4gsC 6y ago
  Never underestimate the damage one person doing something stupid once can do.
  - bryanrasmussen 6y ago
    I actually think this whole one person doing one stupid thing per year argument is grossly underestimating the amount of stupid available. Stupidity is one of humanity's greatest renewable resources.
- taneq 6y ago
  It's a great ROI if that one stupid thing a year is someone pushing your company's codebase and all your trade secrets to a public repo.
  - Aeolun 6y ago
    By the same logic it’s good to have your company located in an armored bunker underground on the off chance that someone nukes the city you are in. I realize the chances are a bit different, but it illustrates the point.
- notimetorelax 6y ago
  Depends on the impact of a single erroneous action. I’ve seen cases when folks would push to GitHub passwords (that should be kept in git to start with).
  - bryanrasmussen 6y ago
    right, pushing github passwords leads to GDPR breach in end - anything preventing GDPR breach in the end is probably a great ROI.
- Maxion 6y ago
  Depends a lot on the company and what it's mission is, not every company needs to be able to move quickly on every front.
- DEADBEEFC0FFEE 6y ago
  Anyone who has spent a bit of time trying to calculate the lost productivity caused just the meetings needed to discuss breaches (internal, accidental), knows it's great ROI.
  - corty 6y ago
    Everyone greatly overestimates ROI in their own area of expertise and greatly underestimates costs in the rest. You might be right in some special instance, but generally you are not. One example: Sending files via Email is a security problem. So you prohibit this via settings, virus scanners, appliances, etc. Now you've solved the emailed worm problem. However, you've just created a "how do we move files/data/screenshots/..." problem for the whole company. Now everyone will need their own special solution for everything, support will need a screenshot upload tool because you cannot just email them screenshots anymore, marketing won't be able to do images in mails anymore, external people won't have access to internal file shares, etc.
    - DrAwdeOccarim 6y ago
      I appreciate you're giving an example, but this is pretty much solved at most big companies currently with OneDrive (or any other flavor of cloud storage). For external sharing, you just select if the link can be seen external to the org.
    - astura 6y ago
      Doesn't SharePoint trivially solve all this?
      - corty 6y ago
        For external people likely not, usually Sharepoint would be behind some VPN and Firewall. Some cloud service like Dropbox might work if allowed (which it often isn't). And then there will often be the resulting sprawl of various services: this for secret internal stuff, that for external people, yet another thing for marketing, etc.
      - 6y ago
- serioussecurity 6y ago
  I've seen individual engineers make a mistake that caused 100 engineer's salary worth of damage.
  - alexchamberlain 6y ago
    I suspect we all have. The question is rather: how much would it have cost to prevent that mistake? The flip side is the insurance argument: given a big enough organisation, a mistake like that will happen, even if the probability of each individual mistake is very low. So assuming one of these will happen, what can you do to reduce the impact or to reduce the latency of fixing such a mistake?
  - gjvc 6y ago
    I would love to know more about the details of this example :-)
    - gwd 6y ago
      So the company I work for made the front page of HN last year for a security breach. I won't go into details, but I will say one factor was a particular instance where security was overlooked for many years due to convenience. In response, the company has now sort of swung the other way: lots of things that have a perfectly valid reason and are reasonably safe have been forbidden or suddenly have needed to be justified in the face of extreme skepticism. That wasn't a case of a single engineer causing 100x engineers worth of damage, but it was the case where something made hundreds of people's jobs a tiny bit easier for two decades, then caused a massive public loss of face and who knows how much reputational damage. And I'd be willing to bet that a fair number of HN readers work at a company which has at least one system with similar properties (a bit more convenient, a bit less secure) to the one implicated in our security breach; but failure is a once-a-decade event, and their company isn't nearly that old yet. Would those engineers defend that setup using the argument from this article?
      - dtech 6y ago
        Was it the Twitter internal account management tool?
HenryBemis 6y ago
I believe it's all about Security (C-I-A). To mitigate this issue, on paper, an (usually) HR policy writes "do not do non-work related stuff with your work computer". And since many people ignore this rule, because "why have a second laptop?", the next best thing is to route all traffic from your laptop through the company, and weed out the GigHubs and GitLabs of this world (in the same manner that they block all sex-drugs-rocknroll stuff). You can't blame a company for wanted to protect itself against a disgruntled employee that wants to push the (example - not applicable to your company) ebanking software code out in the open. That said.. why would a person use the corporate computer for their (allow me the use of the word) 'hobby'? Unless it's for charity work, most companies don't appreciate spending resources (time, money, equipment) on other things. Re: Chesterton's Fence - didn't know it had a name, thank you for this!
- zeepzeep 6y ago
  > That said.. why would a person use the corporate computer for their (allow me the use of the word) 'hobby'? Because my work computer is around 100 times faster than my personal one.
  - anticensor 6y ago
    I have the opposite situation: My personal computer is faster .
    - munk-a 6y ago
      Assuming both are laptops and you don't have some insane personal computer - you should seriously examine why your workplace is skimping on a few hundred dollars extra on a machine that might save you, an employee with a salary in the tens of thousands (or higher) a few days of waiting for things to load, render or compile a year. There certainly is a logic around not wasting money where it'd do no good - but companies that are tight with employee capital expenditures make me really nervous. It's a thing I've avoided consciously in employers since my thirties - if you don't value me enough for a decent keyboard, a chair, and a sufficiently performing computer - then you don't have anyone who is sane at evaluating RoI at your upper echelons.
watwut 6y ago
> A more productive use of time would be to understand the reason for the policy, document out why it doesn't apply to your case and then attempt to get approval. My experiences with big organizations is that the above is complete absolute waste of time, unless you are in some kind of high level position already.
- brokenmachine 6y ago
  100%.
twhitmore 6y ago
Management works by creating processes and systems. There are always inaccuracies and imperfections in how these are targeted, and inefficiencies resulting. Yet creating processes and systems is the expected task of management -- it's a key way to scale. I'm fairly much averse to process myself, but have been occasionally involved.
- ISL 6y ago
  The critical bit is to continuously evaluate whether or not the processes and systems are achieving the mission of the organization. In my, academic, world, the core problem is that there is no overarching mission against which the process/system can be evaluated. We have 5-10 important goals of the institution/system and multiple sub-organizations with wildly different emphasis on each goal.
mehrdadn 6y ago
> Chesterton's fence Is there a "reverse" version of this where you do understand the reasoning, explain clearly why it doesn't apply anymore, but the other side just refuses to think for themselves and just sticks with the status quo because it must've been done with good reason and they don't want to second-guess it?
- noisy_boy 6y ago
  Quite often the other side is perfectly capable of thinking for themselves. They just don't want to lose their job on account of that one common-sense approval in case things go south. Self-preservation etc.
- yodelshady 6y ago
  I believe the phrase is "jobsworth", as in "more than my". The point of the article is that's kind of correct - the cost (risk) of deregulating is concentrated, but the benefit is distributed. There needs to be some way to capture the value-add of removing a rule. But if you do that the easiest way - turning the global metric of productivity into a target - then managers will asset strip, fire security (ahem, Mozilla), and walk off with a fat bonus (short-term productivity is up!) before people realise what's left is a the empty shell of a company. And that's why good management is hard.
  - mehrdadn 6y ago
    Learned a new (British?) word today, thanks!
- anoncake 6y ago
  Cargo-culting? At least it's similar.
- vharuck 6y ago
  Appeal to tradition: https://en.m.wikipedia.org/wiki/Appeal_to_tradition https://en.m.wikipedia.org/wiki/Appeal_to_tradition
swiley 6y ago
This shouldn’t need to be enforced by software. You really don’t have any business accessing a personal git repo from a coorperate machine; you’re spending time twice (stealing) and it’s a good way to lose ownership of IP. Furthermore this probably makes officially allowed open source contributions much more difficult.
- blackboxlogic 6y ago
  We depend on some open source tools. When my project is blocked by a bug in one of them, it absolutely is my job to fix it.
  - swiley 6y ago
    Maybe I could have phrased that better but I think you and I agree.
- vorpalhex 6y ago
  And how am I supposed to patch the OSS libraries I'm using otherwise?
the8472 6y ago
> but getting to the reason might require un-peeling a few org layers to since the people enforcing the policy will not be the people who wrote the policy. The issue is that all the policy documents often only contain the One True Way to achieve their goals, while the goals remain unstated. The documents should always come with a rationale. And appending "exceptions may be granted for equivalent or better processes" to requirements would also help. I was faced with a password "security policy" that pretty much only whitelisted SHA2 + salting for password hashing. We were using a time-hard (not memory-hard though) password hashing function instead and several levels of auditors were effectively asking us to downgrade to comply with their policy without even understanding the difference. It's terribly demotivating to have to argue with people enforcing policy they do not understand and erodes any willingness to engage with those policies instead of seeing them as theater and working around them.
- edoloughlin 6y ago
  several levels of auditors were effectively asking us to downgrade to comply with their policy without even understanding the difference The auditors' policy? Are you sure? An auditor's job is to check if you're doing what you say you should be doing. If you're arguing with an auditor then you're essentially arguing with your own organisation without any hope winning the argument.
  - ath0 6y ago
    Not really a fair assessment. An auditor's job is often to check if you're doing what an external standard says you should be doing (SOC 2 => AICPA trust principles; FedRAMP => NIST 800-53, etc.). Unfortunately, these external standards may be written vaguely and while you may have policies that define X as Y, the auditor doesn't have to accept your answers. For example, when PCI requirement 5 says "Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).", your policy may say "antivirus is not required inside containers that run on platforms like GKE, as these are not commonly affected by malicious software." It's very likely you'll have a discussion about your interpretation of that requirement.
qznc 6y ago
An example, I'm unable to resolve so far: ISO 26262 includes the requirement to prevent “implausible values, execution errors, division by zero, and errors in data flow and control flow” (8.4.4). I'm confident the division by zero aims at integer division because the result is undefined. For floating point, division-by-zero is perfectly fine and well defined by IEEE 754. Nevertheless, our safety folks require us to enable the traps and shut down the device in case a floating division by zero occurs. This is stupid because a division by a very small number has the same effect as division by zero. However, since it is explicitly mentioned in ISO 26262 nobody has the balls to allow it officially. I don't even want to estimate how many man-months have been burned to fix such "defects".
- aliswe 6y ago
  Mandatory additional detailed info: Division by zero in floating point equals to Infinity because in a floating point data structure there is space to represent such a value. For integers, there is no such information and therefore an exception should be thrown. For a 32-bit float, the following are true: Positive infinity: 011111111(and then 23 zeroes) Negative infinity: 111111111(and then 23 zeroes) NaN: x11111111(and then anything except all zeroes) ... x being either 0 or 1. Source: https://en.wikipedia.org/wiki/IEEE_754-1985#Positive_and_negative_infinity https://en.wikipedia.org/wiki/IEEE_754-1985#Positive_and_neg...
  - AnIdiotOnTheNet 6y ago
    Mathematically speaking though, infinity is not the correct answer to x/0 anyway. It's just a usefully incorrect result in a lot of situations.
    - colejohnson66 6y ago
      Well, it’s incorrect when dividing by 0, yes. But when you do the limit as the bottom factor approaches 0, it makes sense. So, below, the first one is defined, while the second one isn’t. lim_{x->0+} 1/x == +Infinity 1/0 != (anything)
danaris 6y ago
> In BigCorps, if there's a stupid requirement, there's usually a reason for the stupid requirement to be there in the first place Yes, but that doesn't mean it was ever a good reason, or that the reason still applies. In a very large number of cases—like the one mentioned in the article—the primary reason is to let the company's management feel more "in control" of their low-level employees. In a lot of (closely related) cases, it's straight-up racism, sexism, or classism. (Frankly, one can easily make a case that the working-from-home prohibitions fall into that category—they derive from an assumption that low-level employees are lazy and want to avoid work as much as possible, because they're analogous to the assembly-line employees of yesteryear, and thus assumed to be lower-class...which means lesser beings.)
michaelcampbell 6y ago
> In BigCorps, if there's a stupid requirement, there's usually a reason for the stupid requirement to be there in the first place Sometimes, this is to be able to hire the exactly one person they want to hire, but HR policies or some law requires it be an "open bid" system. So the tailor the requirements such that only the one person can qualify, and they can justify the hiring and the letter of the law.
Spooky23 6y ago
The other principle is separation of duties. Policy is made by people who aren't the practitioners so that the interests of the organization are ahead of the whim or convenience of the practitioner. People who served in the military usually get this concept, as it's more obvious that there is a long line of stupid actions on random soldiers' part that leads to a longer line of preventative rules. I'd also say that when I worked on a program for a big company that interfaced with alot of small companies and startups a few years, the startups in particular had really awful practices. The "bullshit" compliance checklists for security revealed awful practices that present real risks. The big company was more vulnerable to systemic risk due to inflexibility, the small companies are more vulnerable to individual risks due to employee action or lack of controls.
- heymijo 6y ago
  The big company was more vulnerable to systemic risk due to inflexibility, the small companies are more vulnerable to individual risks due to employee action or lack of controls. This is incredibly well said and worth highlighting.
MikeTaylor 6y ago
Side issue, but I have cause to mention Chesterton's Fence so often that it's become a real frustration that there is no Wikipedia article about it — only this essay about why Wikipedia contributors should honour it. I wish there was an actual article I could point to when I want people to know about it. (Why don't I just make one? I have basically given up on making substantial contributons to Wikipedia since the Deletion Police took over the asylum. There's a 90% probability that if I did spend a couple of hours writing a good article, someone would come along within a week and spend a couple seconds deleting it. It's out of control.)
- kotrunga 6y ago
  What is this Wikipedia "Deletion Police"? I haven't heard of quality content being consistently deleted.
  - jfengel 6y ago
    I often hear it called Deletionism, and there is a Wikipedia article about it: https://en.wikipedia.org/wiki/Deletionism_and_inclusionism_in_Wikipedia https://en.wikipedia.org/wiki/Deletionism_and_inclusionism_i... It cites a quote from Paul Graham (cofounder of Y Combinator) that begins "Deletionists rule Wikipedia."
- hrafn 6y ago
  You could use this redirect as a link: https://en.wikipedia.org/wiki/Chesterton%27s_fence https://en.wikipedia.org/wiki/Chesterton%27s_fence
- DanBC 6y ago
  > Why don't I just make one? I have basically given up on making substantial contributons to Wikipedia You don't have to put it up on Wikipedia. You could put it on Neocities or Medium or wherever.
- shalmanese 6y ago
  Just use this: https://en.wikipedia.org/wiki/G._K._Chesterton#Chesterton's_fence https://en.wikipedia.org/wiki/G._K._Chesterton#Chesterton's_...
globular-toast 6y ago
> In BigCorps, if there's a stupid requirement, there's usually a reason for the stupid requirement to be there in the first place I disagree. I've worked in a BigCorp and many requirements were in place not due to reason but due to feelings and inertia. The "butts in seats" requirement was one of the main ones. Even after showing my boss that I could at the very least work equally as effectively from home, he still felt it wasn't OK for me to work at home more than once a week. And never underestimate the power of inertia. Things are this way, they've always been this way.
- scarface74 6y ago
  I just left a company that was trying to rush us back into an open office post Covid. As if it weren’t bad and noisy enough pre-Covid. It kind of threw that whole “we are in this together. Accept your 10% pay cut.” bullshit out of the window. Especially when all of the management had separate offices.
rvense 6y ago
About five years ago, a place I was working at was selecting a new laptop for all employees. Mine was up for replacement, so I was interested in what they were picking. They'd arrived at some god-awful Lenovo gamer model. It fit the performance and price point they'd decided they needed. I said I'd prefer to have something smaller with less Christmas lights. "Policy is everyone has to have the same laptop, and some people need more graphics power than the one you're asking for." Turns out there'd been some big thing back and forth already about size and performance and this was the compromise that nobody liked. "But why does everyone have to have the same laptop?" I asked. "Well, it's just policy. Every desk has a docking station, and we don't want to have to buy different ones." So I flipped the selected monstrosity over to reveal the extremely lacking docking connector at the bottom. There were some awkward laughs and I got my Thinkpad.
- simonebrunozzi 6y ago
  I can only imagine the grin on your face :)
- Bootwizard 6y ago
  I did almost exactly the same thing at my last job. I'm a game dev and they provided us all with woefully underpowered MacBooks that didn't even have a dedicated GPU. The game engine was constantly crashing while working and making it very difficult to get anything done. I recorded the amount of time wasted on these crashes over the course of a week. I then proved to management that there was about 5 hours a week being completely wasted for me waiting for my machine to open applications after they crash. So after that we all got new MacBooks that were properly spec'd out for game development. I got to pick the specs :)
  - VHRanger 6y ago
    Why would anyone ever do game development on Apple hardware? You're making iOS games?
    - mcraiha 6y ago
      Yes, iOS cross compile is a pain. And Unity is a bit more stable in Macs (YMMV).
brianmcc 6y ago
It's "cool" to move fast, break things. It's less cool to tread carefully and do due diligence. People love to use folksy stories to justify the former (the one about the monkeys for example - https://workingoutloud.com/blog/the-five-monkeys-experiment-with-a-new-lesson https://workingoutloud.com/blog/the-five-monkeys-experiment-...). I really like Chesterton's Fence as a counter-story to it, not to stop meaningful change from actually happening but to neutralize decision-by-best-folksy-story from over-ruling other options unchallenged, and allowing case-by-case thinking to prevail.
rlwinm 6y ago
> For instance, there's a restriction at my workplace (not a software company, a regular old industry fortune 500) which prevents git installs from pushing to any non corporate GitHub repo from our work machines. Someone has to say it. I’ll admit to accidentally pushing some of my employer’s code to GitHub. The code was a fork of one of my GitHub repositories and I pushed to the wrong remote. I deleted the resulting commits afterwards and no PII was leaked but it’s a valid concern for employers.
mfenniak 6y ago
> For instance, there's a restriction at my workplace (not a software company, a regular old industry fortune 500) which prevents git installs from pushing to any non corporate GitHub repo from our work machines. Oh my! As I have struggled with security incidents caused by people either accidentally publishing GitHub repos that are "public" rather than "private", or pushing corporate code to their own repos (that are... you guessed it, "public"), I have long looked for another IT department that has grappled with this problem. GitHub Support hasn't helped, appealing to public forums hasn't helped. But here, a sign that my problem isn't unique! Of course, the solution sucks. sigh
- robszumski 6y ago
  I can report in on the container version of this. Docker would not accept patches from Red Hat about Docker Hub being the default push location. They wouldn't even accept to make this configurable. Our enterprise customers didn't even want it trying, regardless of if it was blocked at the network level. Quay.io makes all pushes private by default, to protect from this type of behavior. If you accidentally typo, you are protected.
kevin_thibedeau 6y ago
Who authorized you to push OS conributions on company time?
runarberg 6y ago
True, there is probably a reason for some stupid requirement, but that reason might still be stupid. Remember that upper management is people, and as people they have their own biases, fallacies, ignorance, etc. They are just as prone to make wrong decisions as you are. In fact in an area of your expertise, they are indeed more prone to make a wrong decision out of simple ignorance or bias. If you think a requirement from your area of expertise is stupid, it probably is a stupid requirement. If you can’t see a reason for that requirement, there probably isn’t a good one. The fact that the decision to make this stupid requirement comes from people in power gives you even more reason to question the validity of the requirement. People that hold high position and a great amount of power often face less scrutiny and questionable decisions made by them are far less criticized, then similar decisions made by people of less power.
m463 6y ago
I wish I could find the article, but I think Joel on Software (?) had something once about bigger companies adding on things like how some people stand by the door turning around and checking their wallet and keys carefully before going out. or some similar analogy.

by sfifs 6y ago

Aeolun 6y ago

I think the problem with this logic is it hinders a hundred people on a daily basis to prevent one person from doing something stupid once a year. That’s just not great ROI.

RcouF1uZ4gsC 6y ago
Never underestimate the damage one person doing something stupid once can do.
- bryanrasmussen 6y ago
  I actually think this whole one person doing one stupid thing per year argument is grossly underestimating the amount of stupid available. Stupidity is one of humanity's greatest renewable resources.
taneq 6y ago
It's a great ROI if that one stupid thing a year is someone pushing your company's codebase and all your trade secrets to a public repo.
- Aeolun 6y ago
  By the same logic it’s good to have your company located in an armored bunker underground on the off chance that someone nukes the city you are in. I realize the chances are a bit different, but it illustrates the point.
notimetorelax 6y ago
Depends on the impact of a single erroneous action. I’ve seen cases when folks would push to GitHub passwords (that should be kept in git to start with).
- bryanrasmussen 6y ago
  right, pushing github passwords leads to GDPR breach in end - anything preventing GDPR breach in the end is probably a great ROI.
Maxion 6y ago
Depends a lot on the company and what it's mission is, not every company needs to be able to move quickly on every front.
DEADBEEFC0FFEE 6y ago
Anyone who has spent a bit of time trying to calculate the lost productivity caused just the meetings needed to discuss breaches (internal, accidental), knows it's great ROI.
- corty 6y ago
  Everyone greatly overestimates ROI in their own area of expertise and greatly underestimates costs in the rest. You might be right in some special instance, but generally you are not. One example: Sending files via Email is a security problem. So you prohibit this via settings, virus scanners, appliances, etc. Now you've solved the emailed worm problem. However, you've just created a "how do we move files/data/screenshots/..." problem for the whole company. Now everyone will need their own special solution for everything, support will need a screenshot upload tool because you cannot just email them screenshots anymore, marketing won't be able to do images in mails anymore, external people won't have access to internal file shares, etc.
  - DrAwdeOccarim 6y ago
    I appreciate you're giving an example, but this is pretty much solved at most big companies currently with OneDrive (or any other flavor of cloud storage). For external sharing, you just select if the link can be seen external to the org.
  - astura 6y ago
    Doesn't SharePoint trivially solve all this?
    - corty 6y ago
      For external people likely not, usually Sharepoint would be behind some VPN and Firewall. Some cloud service like Dropbox might work if allowed (which it often isn't). And then there will often be the resulting sprawl of various services: this for secret internal stuff, that for external people, yet another thing for marketing, etc.
    - 6y ago
serioussecurity 6y ago
I've seen individual engineers make a mistake that caused 100 engineer's salary worth of damage.
- alexchamberlain 6y ago
  I suspect we all have. The question is rather: how much would it have cost to prevent that mistake? The flip side is the insurance argument: given a big enough organisation, a mistake like that will happen, even if the probability of each individual mistake is very low. So assuming one of these will happen, what can you do to reduce the impact or to reduce the latency of fixing such a mistake?
- gjvc 6y ago
  I would love to know more about the details of this example :-)
  - gwd 6y ago
    So the company I work for made the front page of HN last year for a security breach. I won't go into details, but I will say one factor was a particular instance where security was overlooked for many years due to convenience. In response, the company has now sort of swung the other way: lots of things that have a perfectly valid reason and are reasonably safe have been forbidden or suddenly have needed to be justified in the face of extreme skepticism. That wasn't a case of a single engineer causing 100x engineers worth of damage, but it was the case where something made hundreds of people's jobs a tiny bit easier for two decades, then caused a massive public loss of face and who knows how much reputational damage. And I'd be willing to bet that a fair number of HN readers work at a company which has at least one system with similar properties (a bit more convenient, a bit less secure) to the one implicated in our security breach; but failure is a once-a-decade event, and their company isn't nearly that old yet. Would those engineers defend that setup using the argument from this article?
    - dtech 6y ago
      Was it the Twitter internal account management tool?

HenryBemis 6y ago

I believe it's all about Security (C-I-A). To mitigate this issue, on paper, an (usually) HR policy writes "do not do non-work related stuff with your work computer". And since many people ignore this rule, because "why have a second laptop?", the next best thing is to route all traffic from your laptop through the company, and weed out the GigHubs and GitLabs of this world (in the same manner that they block all sex-drugs-rocknroll stuff). You can't blame a company for wanted to protect itself against a disgruntled employee that wants to push the (example - not applicable to your company) ebanking software code out in the open. That said.. why would a person use the corporate computer for their (allow me the use of the word) 'hobby'? Unless it's for charity work, most companies don't appreciate spending resources (time, money, equipment) on other things. Re: Chesterton's Fence - didn't know it had a name, thank you for this!

zeepzeep 6y ago
> That said.. why would a person use the corporate computer for their (allow me the use of the word) 'hobby'? Because my work computer is around 100 times faster than my personal one.
- anticensor 6y ago
  I have the opposite situation: My personal computer is faster .
  - munk-a 6y ago
    Assuming both are laptops and you don't have some insane personal computer - you should seriously examine why your workplace is skimping on a few hundred dollars extra on a machine that might save you, an employee with a salary in the tens of thousands (or higher) a few days of waiting for things to load, render or compile a year. There certainly is a logic around not wasting money where it'd do no good - but companies that are tight with employee capital expenditures make me really nervous. It's a thing I've avoided consciously in employers since my thirties - if you don't value me enough for a decent keyboard, a chair, and a sufficiently performing computer - then you don't have anyone who is sane at evaluating RoI at your upper echelons.

watwut 6y ago

> A more productive use of time would be to understand the reason for the policy, document out why it doesn't apply to your case and then attempt to get approval. My experiences with big organizations is that the above is complete absolute waste of time, unless you are in some kind of high level position already.

brokenmachine 6y ago
100%.

twhitmore 6y ago

Management works by creating processes and systems. There are always inaccuracies and imperfections in how these are targeted, and inefficiencies resulting. Yet creating processes and systems is the expected task of management -- it's a key way to scale. I'm fairly much averse to process myself, but have been occasionally involved.

ISL 6y ago
The critical bit is to continuously evaluate whether or not the processes and systems are achieving the mission of the organization. In my, academic, world, the core problem is that there is no overarching mission against which the process/system can be evaluated. We have 5-10 important goals of the institution/system and multiple sub-organizations with wildly different emphasis on each goal.

mehrdadn 6y ago

> Chesterton's fence Is there a "reverse" version of this where you do understand the reasoning, explain clearly why it doesn't apply anymore, but the other side just refuses to think for themselves and just sticks with the status quo because it must've been done with good reason and they don't want to second-guess it?

noisy_boy 6y ago
Quite often the other side is perfectly capable of thinking for themselves. They just don't want to lose their job on account of that one common-sense approval in case things go south. Self-preservation etc.
yodelshady 6y ago
I believe the phrase is "jobsworth", as in "more than my". The point of the article is that's kind of correct - the cost (risk) of deregulating is concentrated, but the benefit is distributed. There needs to be some way to capture the value-add of removing a rule. But if you do that the easiest way - turning the global metric of productivity into a target - then managers will asset strip, fire security (ahem, Mozilla), and walk off with a fat bonus (short-term productivity is up!) before people realise what's left is a the empty shell of a company. And that's why good management is hard.
- mehrdadn 6y ago
  Learned a new (British?) word today, thanks!
anoncake 6y ago
Cargo-culting? At least it's similar.
vharuck 6y ago
Appeal to tradition: https://en.m.wikipedia.org/wiki/Appeal_to_tradition https://en.m.wikipedia.org/wiki/Appeal_to_tradition

swiley 6y ago

This shouldn’t need to be enforced by software. You really don’t have any business accessing a personal git repo from a coorperate machine; you’re spending time twice (stealing) and it’s a good way to lose ownership of IP. Furthermore this probably makes officially allowed open source contributions much more difficult.

blackboxlogic 6y ago
We depend on some open source tools. When my project is blocked by a bug in one of them, it absolutely is my job to fix it.
- swiley 6y ago
  Maybe I could have phrased that better but I think you and I agree.
vorpalhex 6y ago
And how am I supposed to patch the OSS libraries I'm using otherwise?

the8472 6y ago

> but getting to the reason might require un-peeling a few org layers to since the people enforcing the policy will not be the people who wrote the policy. The issue is that all the policy documents often only contain the One True Way to achieve their goals, while the goals remain unstated. The documents should always come with a rationale. And appending "exceptions may be granted for equivalent or better processes" to requirements would also help. I was faced with a password "security policy" that pretty much only whitelisted SHA2 + salting for password hashing. We were using a time-hard (not memory-hard though) password hashing function instead and several levels of auditors were effectively asking us to downgrade to comply with their policy without even understanding the difference. It's terribly demotivating to have to argue with people enforcing policy they do not understand and erodes any willingness to engage with those policies instead of seeing them as theater and working around them.

edoloughlin 6y ago
several levels of auditors were effectively asking us to downgrade to comply with their policy without even understanding the difference The auditors' policy? Are you sure? An auditor's job is to check if you're doing what you say you should be doing. If you're arguing with an auditor then you're essentially arguing with your own organisation without any hope winning the argument.
- ath0 6y ago
  Not really a fair assessment. An auditor's job is often to check if you're doing what an external standard says you should be doing (SOC 2 => AICPA trust principles; FedRAMP => NIST 800-53, etc.). Unfortunately, these external standards may be written vaguely and while you may have policies that define X as Y, the auditor doesn't have to accept your answers. For example, when PCI requirement 5 says "Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).", your policy may say "antivirus is not required inside containers that run on platforms like GKE, as these are not commonly affected by malicious software." It's very likely you'll have a discussion about your interpretation of that requirement.

qznc 6y ago

An example, I'm unable to resolve so far: ISO 26262 includes the requirement to prevent “implausible values, execution errors, division by zero, and errors in data flow and control flow” (8.4.4). I'm confident the division by zero aims at integer division because the result is undefined. For floating point, division-by-zero is perfectly fine and well defined by IEEE 754. Nevertheless, our safety folks require us to enable the traps and shut down the device in case a floating division by zero occurs. This is stupid because a division by a very small number has the same effect as division by zero. However, since it is explicitly mentioned in ISO 26262 nobody has the balls to allow it officially. I don't even want to estimate how many man-months have been burned to fix such "defects".

aliswe 6y ago
Mandatory additional detailed info: Division by zero in floating point equals to Infinity because in a floating point data structure there is space to represent such a value. For integers, there is no such information and therefore an exception should be thrown. For a 32-bit float, the following are true: Positive infinity: 011111111(and then 23 zeroes) Negative infinity: 111111111(and then 23 zeroes) NaN: x11111111(and then anything except all zeroes) ... x being either 0 or 1. Source: https://en.wikipedia.org/wiki/IEEE_754-1985#Positive_and_negative_infinity https://en.wikipedia.org/wiki/IEEE_754-1985#Positive_and_neg...
- AnIdiotOnTheNet 6y ago
  Mathematically speaking though, infinity is not the correct answer to x/0 anyway. It's just a usefully incorrect result in a lot of situations.
  - colejohnson66 6y ago
    Well, it’s incorrect when dividing by 0, yes. But when you do the limit as the bottom factor approaches 0, it makes sense. So, below, the first one is defined, while the second one isn’t. lim_{x->0+} 1/x == +Infinity 1/0 != (anything)

danaris 6y ago

> In BigCorps, if there's a stupid requirement, there's usually a reason for the stupid requirement to be there in the first place Yes, but that doesn't mean it was ever a good reason, or that the reason still applies. In a very large number of cases—like the one mentioned in the article—the primary reason is to let the company's management feel more "in control" of their low-level employees. In a lot of (closely related) cases, it's straight-up racism, sexism, or classism. (Frankly, one can easily make a case that the working-from-home prohibitions fall into that category—they derive from an assumption that low-level employees are lazy and want to avoid work as much as possible, because they're analogous to the assembly-line employees of yesteryear, and thus assumed to be lower-class...which means lesser beings.)

michaelcampbell 6y ago

> In BigCorps, if there's a stupid requirement, there's usually a reason for the stupid requirement to be there in the first place Sometimes, this is to be able to hire the exactly one person they want to hire, but HR policies or some law requires it be an "open bid" system. So the tailor the requirements such that only the one person can qualify, and they can justify the hiring and the letter of the law.

Spooky23 6y ago

The other principle is separation of duties. Policy is made by people who aren't the practitioners so that the interests of the organization are ahead of the whim or convenience of the practitioner. People who served in the military usually get this concept, as it's more obvious that there is a long line of stupid actions on random soldiers' part that leads to a longer line of preventative rules. I'd also say that when I worked on a program for a big company that interfaced with alot of small companies and startups a few years, the startups in particular had really awful practices. The "bullshit" compliance checklists for security revealed awful practices that present real risks. The big company was more vulnerable to systemic risk due to inflexibility, the small companies are more vulnerable to individual risks due to employee action or lack of controls.

heymijo 6y ago
The big company was more vulnerable to systemic risk due to inflexibility, the small companies are more vulnerable to individual risks due to employee action or lack of controls. This is incredibly well said and worth highlighting.

MikeTaylor 6y ago

Side issue, but I have cause to mention Chesterton's Fence so often that it's become a real frustration that there is no Wikipedia article about it — only this essay about why Wikipedia contributors should honour it. I wish there was an actual article I could point to when I want people to know about it. (Why don't I just make one? I have basically given up on making substantial contributons to Wikipedia since the Deletion Police took over the asylum. There's a 90% probability that if I did spend a couple of hours writing a good article, someone would come along within a week and spend a couple seconds deleting it. It's out of control.)

kotrunga 6y ago
What is this Wikipedia "Deletion Police"? I haven't heard of quality content being consistently deleted.
- jfengel 6y ago
  I often hear it called Deletionism, and there is a Wikipedia article about it: https://en.wikipedia.org/wiki/Deletionism_and_inclusionism_in_Wikipedia https://en.wikipedia.org/wiki/Deletionism_and_inclusionism_i... It cites a quote from Paul Graham (cofounder of Y Combinator) that begins "Deletionists rule Wikipedia."
hrafn 6y ago
You could use this redirect as a link: https://en.wikipedia.org/wiki/Chesterton%27s_fence https://en.wikipedia.org/wiki/Chesterton%27s_fence
DanBC 6y ago
> Why don't I just make one? I have basically given up on making substantial contributons to Wikipedia You don't have to put it up on Wikipedia. You could put it on Neocities or Medium or wherever.
shalmanese 6y ago
Just use this: https://en.wikipedia.org/wiki/G._K._Chesterton#Chesterton's_fence https://en.wikipedia.org/wiki/G._K._Chesterton#Chesterton's_...

globular-toast 6y ago

> In BigCorps, if there's a stupid requirement, there's usually a reason for the stupid requirement to be there in the first place I disagree. I've worked in a BigCorp and many requirements were in place not due to reason but due to feelings and inertia. The "butts in seats" requirement was one of the main ones. Even after showing my boss that I could at the very least work equally as effectively from home, he still felt it wasn't OK for me to work at home more than once a week. And never underestimate the power of inertia. Things are this way, they've always been this way.

scarface74 6y ago
I just left a company that was trying to rush us back into an open office post Covid. As if it weren’t bad and noisy enough pre-Covid. It kind of threw that whole “we are in this together. Accept your 10% pay cut.” bullshit out of the window. Especially when all of the management had separate offices.

rvense 6y ago

About five years ago, a place I was working at was selecting a new laptop for all employees. Mine was up for replacement, so I was interested in what they were picking. They'd arrived at some god-awful Lenovo gamer model. It fit the performance and price point they'd decided they needed. I said I'd prefer to have something smaller with less Christmas lights. "Policy is everyone has to have the same laptop, and some people need more graphics power than the one you're asking for." Turns out there'd been some big thing back and forth already about size and performance and this was the compromise that nobody liked. "But why does everyone have to have the same laptop?" I asked. "Well, it's just policy. Every desk has a docking station, and we don't want to have to buy different ones." So I flipped the selected monstrosity over to reveal the extremely lacking docking connector at the bottom. There were some awkward laughs and I got my Thinkpad.

simonebrunozzi 6y ago
I can only imagine the grin on your face :)
Bootwizard 6y ago
I did almost exactly the same thing at my last job. I'm a game dev and they provided us all with woefully underpowered MacBooks that didn't even have a dedicated GPU. The game engine was constantly crashing while working and making it very difficult to get anything done. I recorded the amount of time wasted on these crashes over the course of a week. I then proved to management that there was about 5 hours a week being completely wasted for me waiting for my machine to open applications after they crash. So after that we all got new MacBooks that were properly spec'd out for game development. I got to pick the specs :)
- VHRanger 6y ago
  Why would anyone ever do game development on Apple hardware? You're making iOS games?
  - mcraiha 6y ago
    Yes, iOS cross compile is a pain. And Unity is a bit more stable in Macs (YMMV).

brianmcc 6y ago

It's "cool" to move fast, break things. It's less cool to tread carefully and do due diligence. People love to use folksy stories to justify the former (the one about the monkeys for example - https://workingoutloud.com/blog/the-five-monkeys-experiment-with-a-new-lesson https://workingoutloud.com/blog/the-five-monkeys-experiment-...). I really like Chesterton's Fence as a counter-story to it, not to stop meaningful change from actually happening but to neutralize decision-by-best-folksy-story from over-ruling other options unchallenged, and allowing case-by-case thinking to prevail.

rlwinm 6y ago

> For instance, there's a restriction at my workplace (not a software company, a regular old industry fortune 500) which prevents git installs from pushing to any non corporate GitHub repo from our work machines. Someone has to say it. I’ll admit to accidentally pushing some of my employer’s code to GitHub. The code was a fork of one of my GitHub repositories and I pushed to the wrong remote. I deleted the resulting commits afterwards and no PII was leaked but it’s a valid concern for employers.

mfenniak 6y ago

> For instance, there's a restriction at my workplace (not a software company, a regular old industry fortune 500) which prevents git installs from pushing to any non corporate GitHub repo from our work machines. Oh my! As I have struggled with security incidents caused by people either accidentally publishing GitHub repos that are "public" rather than "private", or pushing corporate code to their own repos (that are... you guessed it, "public"), I have long looked for another IT department that has grappled with this problem. GitHub Support hasn't helped, appealing to public forums hasn't helped. But here, a sign that my problem isn't unique! Of course, the solution sucks. sigh

robszumski 6y ago
I can report in on the container version of this. Docker would not accept patches from Red Hat about Docker Hub being the default push location. They wouldn't even accept to make this configurable. Our enterprise customers didn't even want it trying, regardless of if it was blocked at the network level. Quay.io makes all pushes private by default, to protect from this type of behavior. If you accidentally typo, you are protected.

kevin_thibedeau 6y ago

Who authorized you to push OS conributions on company time?

runarberg 6y ago

True, there is probably a reason for some stupid requirement, but that reason might still be stupid. Remember that upper management is people, and as people they have their own biases, fallacies, ignorance, etc. They are just as prone to make wrong decisions as you are. In fact in an area of your expertise, they are indeed more prone to make a wrong decision out of simple ignorance or bias. If you think a requirement from your area of expertise is stupid, it probably is a stupid requirement. If you can’t see a reason for that requirement, there probably isn’t a good one. The fact that the decision to make this stupid requirement comes from people in power gives you even more reason to question the validity of the requirement. People that hold high position and a great amount of power often face less scrutiny and questionable decisions made by them are far less criticized, then similar decisions made by people of less power.

m463 6y ago

I wish I could find the article, but I think Joel on Software (?) had something once about bigger companies adding on things like how some people stand by the door turning around and checking their wallet and keys carefully before going out. or some similar analogy.