7 ms·

That headline does not match the article contents. That is definitely the headline from the article, but it simply repeats the claim and doesn't even link to th

That headline does not match the article contents. That is definitely the headline from the article, but it simply repeats the claim and doesn't even link to the complaint or provide ANY details. > Spiers was fired after she created a pop-up for Google employees visiting the IRI Consultants website. Didn't she inject code into an unrelated internal extension? That sounds like a legit security issue no matter how just her cause. Like it's awesome you're for unionization, but that doesn't mean you get to roll code across the org - what if it had been a bitcoin mining script?

JeremyBanks 6y ago
If she had injected a BitCoin miner, for personal profit, that would have been an entirely different situation, wouldn't it?
- Pfhreak 6y ago
  Not sure why you are being downvoted. You've (correctly) pointed out that the parent comment has constructed a strawman to punch at, rather than the actual events. Arguments of the form, "Person did X. Imagine if they had done Y! (Where Y is some obviously unethical thing.)" are fallacious and they lead the discussion to useless dead ends. The point is that the person did do X, and NOT Y.
  - lotsofpulp 6y ago
    vorpalhex is stating action X was wrong in the first place, and describing a situation Y as an example to show why action X is wrong. I have policies at my workplace that disallow something because it's impractical to judge every single situation and then have to deal with the gray area.
    - JeremyBanks 6y ago
      That's a fair perspective, but that's not applicable here. The punishment isn't because of how much she violated the policies, it's to send a message. At Google, someone once disruptively modified the root permissions for the entire company-wide monorepo to show off that the permissions scheme was fallible. They were left off with a verbal warning, even though on paper they massively abused their position, and could have made the point without actually doing it. The engineer in the OP took a much smaller action, that was closer to the scope of her actual duties, but was punished more severely.
      - deleted 6y ago
        [deleted]
      - vorpalhex 6y ago
        > That's a fair perspective, but that's not applicable here. It's exactly applicable. If you violate say, finance reporting laws (KYC) then you've violated finance reporting laws. If you've added unauthorized code to an internal tool, well, you've added unauthorized code to an internal tool. And had it been part of a security disclosure, well, that might be different (did they try other disclosure avenues?), but pushing a political viewpoint isn't. Imagine instead if the employee had added the message "Trump 2020" - how would you feel about that?
        Jotra7 6y ago
        Saying people have a right to organize is not political speech if you aren't a reactionary.
  - buzzerbetrayed 6y ago
    But X is also unethical. Not sure why you're seemingly ignoring that.
    - Pfhreak 6y ago
      I'm not. I'm explicitly saying you should discuss X. Adding Y just muddies the discussion.
- manfredo 6y ago
  Abusing your position as a developer and turning your software into a political soapbox is not much better. People are trying to spin this as some sort of union busting move. I don't see it, this behavior is unacceptable regardless of what message is being spread. Would it have been fine if she added a message to say "Affirmative Action is racist" when people browsed information about Proposition 16 on the 2020 California ballot? Sure, she definitely has the right to spread that message on her own time. But adding this message is definitely breaching expectations of professionalism, and abusing her developer role to spread a personal political message. And given that Google/Alphabet is widely suspected of political bias, I it's fair to let go of employees who cannot refrain from modify software to advance their political views.
  - zobzu 6y ago
    A better way to think of it in my eyes is, employer pays you to write an app that shows cats. You start and you're like, yeah, no fuck that, and you write an app that shows dogs instead. Employer comes back to you and says "we pay you to show cats, since you don't wanna do it we'll find someone else". Sucks but seems logical to me. That's unrelated to the claims of spying and illegal procedures of course, that the new article claims. Very curious to see what they did that was illegal / what kind of spying they would have done. But right now its just claims.
davidcbc 6y ago
My recollection is that the extension was for notifying employees of relevant policies and laws regarding websites they were viewing. So no, it was not an unrelated extension.
- giantg2 6y ago
  Isn't the extension actually about the laws or policies related to using the site in question? Not necessarily about laws pertaining to things that happen outside of the use of the site, such as unionizing.
  - saghm 6y ago
    IIRC, the website the notice was added to was specifically a the site of law firm that Google had contracted with regards to the ongoing concerns of unionization. It seems like there's a fair argument to be made that it was related to the site, although there are arguments against that as well.
    - giantg2 6y ago
      But in that case, the notice would fall out of scope of the plugin - which is to notify Google employees of the relevant laws or company policies about the use of a site. This would be about the generic right to unionize, which wouldn't relate to that site specifically. What actions would a user be taking on that site in that capacity, especially if that firm is representing the opposition?
      - anonymousDan 6y ago
        She was reminding management (who are also employees) that anti-union stuff is illegal?
        giantg2 6y ago
        Not all anti-union stuff is illegal. Hiring a law firm to consult on employee management and unionization would not be illegal. If anything, they should be learning the correct and legal actions that they can take based on the consultant's recommendations. Not to mention, the comment the plugin displayed wasn't saying anything against illegal actions, but rather stating that concerted activities are protected. I don't see how that has any bearing on the use of a law firm's website.
613style 6y ago
"Injecting code," is not the way I'd describe making changes to a product that it's your job to maintain.
- annexrichmond 6y ago
  did the change have anything to do with their job? No, so it's basically injecting code.
- Rebelgecko 6y ago
  (am Googler but obviously not speaking in an official capacity) My understanding from articles I've read is that it wasn't her job to maintain the product. It was her first time interacting with that code base, and she intentionally altered the defaults of the code review tool so that the team responsible for the extension wouldn't be informed of her changes.
anonacct38 6y ago
> Didn't she inject code into an unrelated internal extension? Depending on your definition of code, that's probably not the case. She added an entry to a config file that contained a mapping of urls to messages. Such as: dropbox.com/upload -> Friendly reminder: please don't upload internal documents to dropbox Also, Google generally trusts engineers and it's not that unusual to have an engineer writing and deploying code. So essentially it was her job to work on and deploy this extension. I believe that had the message been an April fools day joke she wouldn't have been fired. So in my opinion arguments that others have made (not you) that: "this was a unauthorized code change therefore obviously she should be fired on security grounds and charged with violating the CFAA too, it doesn't matter what the message was" don't really hold water. There's also an argument that she used some sort of "emergency" deployment mechanism, but that doesn't really hold water either. Honestly it's not that unusual to see people deploy some package when they need it rather than wait for a scheduled job to deploy it. I think the grey area she was operating in boils down to: She had a platform to distribute certain types of messages internally and she put a message in there that probably wasn't the normal type of message distributed. If I were her manager I probably would have taken some action but it wouldn't have been firing.
- jefftk 6y ago
  > There's also an argument that she used some sort of "emergency" deployment mechanism, but that doesn't really hold water either. Honestly it's not that unusual to see people deploy some package when they need it rather than wait for a scheduled job to deploy it. I disagree. The emergency process was highly unusual, in that it had never been done before for this extension, and was very rarely done in general. Triggering a deploy is normal, triggering a deploy that goes immediately to 100% is not. > essentially it was her job to work on and deploy this extension The extension wasn't something she had previously worked on. > I believe that had the message been an April fools day joke she wouldn't have been fired. I agree, and don't think she should have been fired for this either. (Disclosure: I work for Google, speaking only for myself)
  - nashashmi 6y ago
    You should read about the conspiracy to kill ie6. The magical access to add stuff and just have fun was what made google a fun place to work at. In this case adding stuff for your own corporate employees didn’t hurt the company’s customers and users. It shouldn’t have resulted in a termination. Had the person put a hate message they would have been terminated or penalized for hate but not for adding insecure code.
zeckalpha 6y ago
How was it an unrelated extension?

JeremyBanks 6y ago

If she had injected a BitCoin miner, for personal profit, that would have been an entirely different situation, wouldn't it?

Pfhreak 6y ago
Not sure why you are being downvoted. You've (correctly) pointed out that the parent comment has constructed a strawman to punch at, rather than the actual events. Arguments of the form, "Person did X. Imagine if they had done Y! (Where Y is some obviously unethical thing.)" are fallacious and they lead the discussion to useless dead ends. The point is that the person did do X, and NOT Y.
- lotsofpulp 6y ago
  vorpalhex is stating action X was wrong in the first place, and describing a situation Y as an example to show why action X is wrong. I have policies at my workplace that disallow something because it's impractical to judge every single situation and then have to deal with the gray area.
  - JeremyBanks 6y ago
    That's a fair perspective, but that's not applicable here. The punishment isn't because of how much she violated the policies, it's to send a message. At Google, someone once disruptively modified the root permissions for the entire company-wide monorepo to show off that the permissions scheme was fallible. They were left off with a verbal warning, even though on paper they massively abused their position, and could have made the point without actually doing it. The engineer in the OP took a much smaller action, that was closer to the scope of her actual duties, but was punished more severely.
    - deleted 6y ago
      [deleted]
    - vorpalhex 6y ago
      > That's a fair perspective, but that's not applicable here. It's exactly applicable. If you violate say, finance reporting laws (KYC) then you've violated finance reporting laws. If you've added unauthorized code to an internal tool, well, you've added unauthorized code to an internal tool. And had it been part of a security disclosure, well, that might be different (did they try other disclosure avenues?), but pushing a political viewpoint isn't. Imagine instead if the employee had added the message "Trump 2020" - how would you feel about that?
      - Jotra7 6y ago
        Saying people have a right to organize is not political speech if you aren't a reactionary.
- buzzerbetrayed 6y ago
  But X is also unethical. Not sure why you're seemingly ignoring that.
  - Pfhreak 6y ago
    I'm not. I'm explicitly saying you should discuss X. Adding Y just muddies the discussion.
manfredo 6y ago
Abusing your position as a developer and turning your software into a political soapbox is not much better. People are trying to spin this as some sort of union busting move. I don't see it, this behavior is unacceptable regardless of what message is being spread. Would it have been fine if she added a message to say "Affirmative Action is racist" when people browsed information about Proposition 16 on the 2020 California ballot? Sure, she definitely has the right to spread that message on her own time. But adding this message is definitely breaching expectations of professionalism, and abusing her developer role to spread a personal political message. And given that Google/Alphabet is widely suspected of political bias, I it's fair to let go of employees who cannot refrain from modify software to advance their political views.
- zobzu 6y ago
  A better way to think of it in my eyes is, employer pays you to write an app that shows cats. You start and you're like, yeah, no fuck that, and you write an app that shows dogs instead. Employer comes back to you and says "we pay you to show cats, since you don't wanna do it we'll find someone else". Sucks but seems logical to me. That's unrelated to the claims of spying and illegal procedures of course, that the new article claims. Very curious to see what they did that was illegal / what kind of spying they would have done. But right now its just claims.

davidcbc 6y ago

My recollection is that the extension was for notifying employees of relevant policies and laws regarding websites they were viewing. So no, it was not an unrelated extension.

giantg2 6y ago
Isn't the extension actually about the laws or policies related to using the site in question? Not necessarily about laws pertaining to things that happen outside of the use of the site, such as unionizing.
- saghm 6y ago
  IIRC, the website the notice was added to was specifically a the site of law firm that Google had contracted with regards to the ongoing concerns of unionization. It seems like there's a fair argument to be made that it was related to the site, although there are arguments against that as well.
  - giantg2 6y ago
    But in that case, the notice would fall out of scope of the plugin - which is to notify Google employees of the relevant laws or company policies about the use of a site. This would be about the generic right to unionize, which wouldn't relate to that site specifically. What actions would a user be taking on that site in that capacity, especially if that firm is representing the opposition?
    - anonymousDan 6y ago
      She was reminding management (who are also employees) that anti-union stuff is illegal?
      - giantg2 6y ago
        Not all anti-union stuff is illegal. Hiring a law firm to consult on employee management and unionization would not be illegal. If anything, they should be learning the correct and legal actions that they can take based on the consultant's recommendations. Not to mention, the comment the plugin displayed wasn't saying anything against illegal actions, but rather stating that concerted activities are protected. I don't see how that has any bearing on the use of a law firm's website.

613style 6y ago

"Injecting code," is not the way I'd describe making changes to a product that it's your job to maintain.

annexrichmond 6y ago
did the change have anything to do with their job? No, so it's basically injecting code.
Rebelgecko 6y ago
(am Googler but obviously not speaking in an official capacity) My understanding from articles I've read is that it wasn't her job to maintain the product. It was her first time interacting with that code base, and she intentionally altered the defaults of the code review tool so that the team responsible for the extension wouldn't be informed of her changes.

anonacct38 6y ago

> Didn't she inject code into an unrelated internal extension? Depending on your definition of code, that's probably not the case. She added an entry to a config file that contained a mapping of urls to messages. Such as: dropbox.com/upload -> Friendly reminder: please don't upload internal documents to dropbox Also, Google generally trusts engineers and it's not that unusual to have an engineer writing and deploying code. So essentially it was her job to work on and deploy this extension. I believe that had the message been an April fools day joke she wouldn't have been fired. So in my opinion arguments that others have made (not you) that: "this was a unauthorized code change therefore obviously she should be fired on security grounds and charged with violating the CFAA too, it doesn't matter what the message was" don't really hold water. There's also an argument that she used some sort of "emergency" deployment mechanism, but that doesn't really hold water either. Honestly it's not that unusual to see people deploy some package when they need it rather than wait for a scheduled job to deploy it. I think the grey area she was operating in boils down to: She had a platform to distribute certain types of messages internally and she put a message in there that probably wasn't the normal type of message distributed. If I were her manager I probably would have taken some action but it wouldn't have been firing.

jefftk 6y ago
> There's also an argument that she used some sort of "emergency" deployment mechanism, but that doesn't really hold water either. Honestly it's not that unusual to see people deploy some package when they need it rather than wait for a scheduled job to deploy it. I disagree. The emergency process was highly unusual, in that it had never been done before for this extension, and was very rarely done in general. Triggering a deploy is normal, triggering a deploy that goes immediately to 100% is not. > essentially it was her job to work on and deploy this extension The extension wasn't something she had previously worked on. > I believe that had the message been an April fools day joke she wouldn't have been fired. I agree, and don't think she should have been fired for this either. (Disclosure: I work for Google, speaking only for myself)
- nashashmi 6y ago
  You should read about the conspiracy to kill ie6. The magical access to add stuff and just have fun was what made google a fun place to work at. In this case adding stuff for your own corporate employees didn’t hurt the company’s customers and users. It shouldn’t have resulted in a termination. Had the person put a hate message they would have been terminated or penalized for hate but not for adding insecure code.

zeckalpha 6y ago

How was it an unrelated extension?