4 ms·

I wonder if you’re capable of seeing that both of these are true: 1. It’s a good test 2. It’s a bad test That’s the thing that gets me. Are people (HN readers

by LeonB 6y ago

I wonder if you’re capable of seeing that both of these are true: 1. It’s a good test 2. It’s a bad test That’s the thing that gets me. Are people (HN readers, other people) generally able to only see one of those points — or do they see both but dismiss one? In your case, @xyzelement, do you see both? I know you see what’s good about the test, but do you also see why it’s a bad test?

xyzelement 6y ago
>> In your case, @xyzelement, do you see both? I know you see what’s good about the test, but do you also see why it’s a bad test? I totally see why some people reacted negatively to it, though I think ideally mature people can see that it is a useful test and is trying to teach them something and thus get over it. My personal value system is that I chose tough love versus coddling because the former breeds stronger and more capable people. It's not for everyone, but for example I want people who run security for my firm to err on the former. It's a tradeoff. I don't want to work at a place that's more vulnerable because it (rightly or wrongly) assumed that employees aren't mature enough to go through a real exercise. That's just my view.
- LeonB 6y ago
  Okay, thanks for the response. It sounds like “maturity” and “coddling” etc have a specific meaning in your value system. If someone else sees the benefit of this test but considers it needlessly harmful/cruel (and disproportionately so for different people) — I wouldn’t guess that “immaturity” is in the top 5 of the reasons why they would think that. So I found that surprising. Cheers.
  - xyzelement 6y ago
    LeonB, I appreciate this discourse and let me explain why I see maturity as a factor here. Let's assume that phishing is a real threat, and testing like this moves the needle on people's vigilance (as it has for me when I failed something like it last year.) Let's also assume that if this was a real phish, there would be really bad emotional and financial consequences. EG: imagine being the one who fell for a real phish and actually caused a huge data leak that ended up in the news and put your company out of business. Regardless of how we feel about it, the above threats are real. So we can either chose to be "nice" but increase people's vulnerability to real painful consequences , or we can chose to be "tough" because we realize that in the long run it creates greater actual security for everyone. To me that's "tough love" - harsher short term decisions to help everyone in the long run. It indeed feels adult and mature to take the tough and unpopular decision that aims to address the real risk, and conversely irresponsible to say "we can't deal with the problem because it'll be unpopular and someone may get upset." There's maturity on the flip side too. When I failed the phishing test, it was a wakeup call. In retrospect I should have caught it but I wasn't careful enough. So I am grateful the company did it because it taught me a valuable lesson that will keep me safer in the future. If my response was instead "those fuckers tricked me" or whatever, it would have been childish, because it ignores that the risk is real and that it's really I who has the power to do better.
koonsolo 6y ago
I notice that people have difficulties explaining both positive and negative, and then explain why they pick one over the other. Here it seems an excellent test, but you will probably upset a large part of your employees. People seem to take sides first, and then try to fully ignore the the positives of the other side, and negatives of preferred side, in a way to convince the other party how wrong they are. One side: it's a terrible test and is inhumane Other side: excellent test and people need to grow up. But of course you will never convince the other party like that.

by LeonB 6y ago

xyzelement 6y ago

>> In your case, @xyzelement, do you see both? I know you see what’s good about the test, but do you also see why it’s a bad test? I totally see why some people reacted negatively to it, though I think ideally mature people can see that it is a useful test and is trying to teach them something and thus get over it. My personal value system is that I chose tough love versus coddling because the former breeds stronger and more capable people. It's not for everyone, but for example I want people who run security for my firm to err on the former. It's a tradeoff. I don't want to work at a place that's more vulnerable because it (rightly or wrongly) assumed that employees aren't mature enough to go through a real exercise. That's just my view.

LeonB 6y ago
Okay, thanks for the response. It sounds like “maturity” and “coddling” etc have a specific meaning in your value system. If someone else sees the benefit of this test but considers it needlessly harmful/cruel (and disproportionately so for different people) — I wouldn’t guess that “immaturity” is in the top 5 of the reasons why they would think that. So I found that surprising. Cheers.
- xyzelement 6y ago
  LeonB, I appreciate this discourse and let me explain why I see maturity as a factor here. Let's assume that phishing is a real threat, and testing like this moves the needle on people's vigilance (as it has for me when I failed something like it last year.) Let's also assume that if this was a real phish, there would be really bad emotional and financial consequences. EG: imagine being the one who fell for a real phish and actually caused a huge data leak that ended up in the news and put your company out of business. Regardless of how we feel about it, the above threats are real. So we can either chose to be "nice" but increase people's vulnerability to real painful consequences , or we can chose to be "tough" because we realize that in the long run it creates greater actual security for everyone. To me that's "tough love" - harsher short term decisions to help everyone in the long run. It indeed feels adult and mature to take the tough and unpopular decision that aims to address the real risk, and conversely irresponsible to say "we can't deal with the problem because it'll be unpopular and someone may get upset." There's maturity on the flip side too. When I failed the phishing test, it was a wakeup call. In retrospect I should have caught it but I wasn't careful enough. So I am grateful the company did it because it taught me a valuable lesson that will keep me safer in the future. If my response was instead "those fuckers tricked me" or whatever, it would have been childish, because it ignores that the risk is real and that it's really I who has the power to do better.

koonsolo 6y ago

I notice that people have difficulties explaining both positive and negative, and then explain why they pick one over the other. Here it seems an excellent test, but you will probably upset a large part of your employees. People seem to take sides first, and then try to fully ignore the the positives of the other side, and negatives of preferred side, in a way to convince the other party how wrong they are. One side: it's a terrible test and is inhumane Other side: excellent test and people need to grow up. But of course you will never convince the other party like that.