11 ms·

I got a new job recently after being at my old place almost 15-years. I've decided I'm doing things differently this time. All my work stuff is on my work equip

I got a new job recently after being at my old place almost 15-years. I've decided I'm doing things differently this time. All my work stuff is on my work equipment, all my personal on my personal, and never the two shall meet. I don't have e-mail or slack on my phone. I don't have personal e-mail on my work computer. It's remarkable to me how much this has improved my life. It took some getting used to, but when I'm working I focus better on work, and when I'm not I unplug. It seems obvious yet somehow leaving work behind at the end of the day escaped me before. Also as someone who used to run an IT department, it's shocking the degree that some people fail to realize their work equipment is well works. Personal e-mail on your work laptop, I get it. Your entire collection of photography celebrating the human form in your folder of the company shared drive, why would anyone think that's a good idea?

LanceH 5y ago
I do this while freelancing/contracting as well. I have a macbook for client work only. While I don't have a one for each potential client, I do use a different user for each client, and all data should remain in user space -- which is easy enough to accomplish since I need to maintain matching versions of databases anyway, there is no need to share a single data store.
- dylan604 5y ago
  The user per client on the computer sounds like a nice idea. I haven't done that, but can easily see the appeal. Nice one
  - touisteur 5y ago
    Would almost be better with in addition a vm per customer or at least some kind of encrypted partition per user/customer. Not sure how easy it is under Linux.
    - kyleee 5y ago
      Just bite the bulllet and move to Qubes
      - petertodd 5y ago
        Another advantage of doing this on separate VMs on Qubes is it makes it easy to comply with end-of-contract requirements to destroy all data. Just delete the VMs, and if needed, old backups.
      - touisteur 5y ago
        Didn't know Qubes had such a feature (encrypted home partition/container). Will have a look, thanks.
    - asymptosis 5y ago
      > Not sure how easy it is under Linux. Not sure how easy it is on other OSes. On Linux, it's easy.
    - vladvasiliu 5y ago
      On the face of it, it looks fairly simple on Linux with the encrypted homes feature. Don't have the need for that, so I've never tested it in practice, though.
  - handrous 5y ago
    It's a great system. The only real pain I've run into with it, on macOS anyway, is that you can't isolate iCloud accounts and still receive texts on your Mac. So unless you have a separate phone for each client, that's not so great. Also, the lack of profiles on iDevices means any client-specific apps (2fa stuff, for instance, or if you like to have Slack on your iDevice, or dev/testing apps, or whatever) ends up in a shared space on there.
    - Buttons840 5y ago
      I created a new iCloud account with my work email.
      - handrous 5y ago
        Right, the trouble's getting text messages and such through to your laptop (text message 2fa is so nice with a synced phone—auto fill!), if you have multiple clients. One work phone + personal phone (or tablets, or whatever) is fine. It's when you have three clients, and maybe they rotate out sometimes, that it gets to be a little annoying. ... unless you can add multiple iCloud accounts to one phone. I guess I've never tried, because I just assumed you couldn't. Though you'd still have the problem of things like dev builds and all that existing in the same space, and email accounts (on the phone) syncing to the same application without much separation, and all that.
        ThePowerOfFuet 5y ago
        Why are you using SMS 2FA anyway?
  - sleepybrett 5y ago
    I once worked with a guy in the early 2000s that did 1 laptop per major client project (this was local workflow type app stuff, so windows desktop clients with maybe some kind of data backend) when he was complete he literally took the laptop and put a label on it and put it on a shelf. He'd been burned once to many times on backwards compatibility and library quirks with windows.
- jokethrowaway 5y ago
  KDE has the concept of activities (think like, virtual desktop on steroids, with custom widgets and look) which I used for some time to split between clients' work. It was a fun gimmicky but I can't say I missed it once I had to start using a Mac.
  - LinAGKar 5y ago
    I've started using that when working from home, putting the work stuff on a separate activity.
- ska 5y ago
  I've done this before with one VM per client. Makes archiving etc. simple also, and means that per-client setup stuff never tramples on each other. Gives an answer for how you firewall sensitive data also, e.g. every document you gave me never existed anywhere except in this (potentially encrypted) VM. Easy to delete cleanly.
  - mark_l_watson 5y ago
    That sounds like a clean way to organize multiple clients. For some types of development, I find working on a remote server using SSH/Mosh/tmux works really well for me. I am retired now but I used to ask clients to rent a reasonably powerful VPS that we both had access to and just worked on that. I think this gave customers good control over their property (i.e., the work I did on their behalf).
- ekzy 5y ago
  I tried to use this approach before, but if I remember correctly Homebrew didn’t like it. I like to manage my software with Homebrew, but multi user simply wasn’t working
  - Nextgrid 5y ago
    You can install Homebrew in a non-default directory like somewhere under your home directory. It requires every package to be rebuilt during install, but it's possible. This means you should even be able to get away without even escalating your privileges to root.
- nine_k 5y ago
  How do you handle brew? It makes all the /usr/local/bin stuff belong to the regular user which installed it. Other users had trouble working with brew-installed stuff, last time I tried a few years ago.
  - vanpythonista 5y ago
    You can install brew in your home directory using the Untar Anywhere approach. I’m particular sceptical of how brew handles permissions, so I always install it to ~/homebrew. One thing to note, if you use this approach Homebrew will not use its precompiled binaries and build everything from source. https://docs.brew.sh/Installation#untar-anywhere https://docs.brew.sh/Installation#untar-anywhere
  - Phurist 5y ago
    Use Nix instead.
- vagrantJin 5y ago
  > While I don't have a one for each potential client... So 6 clients = 6 computers...pardon me Macbooks is your ideal setup? I hope that was a joke. I really hope that was a joke.
- midasz 5y ago
  I do the same on Linux, I install software that I always use (DBeaver, Intellij, Spotify, 1Password, browsers, postman, docker stuff, etc) with my 'personal' user and when I switch clients I just create a new user and copy over my licenses. Then I use firefox for everything client related (their outlook, jira, etc) and just login to my gmail on chrome or brave or something.
kritiko 5y ago
Which computer are you posting this from?
- yumraj 5y ago
  Everyone knows that HN is work.
- datameta 5y ago
  Potentially from the ~6x10cm computer
  - marton78 5y ago
    ... while sitting on porcelain with his trousers down.
- Volundr 5y ago
  Personal. Took a break, got some food, browsed HN, etc.
- Buttons840 5y ago
  Posting from his personal phone while sitting in front of a company computer.
- p1necone 5y ago
  Imo browsing hn every morning is a useful part of my job. I've found out so many useful things before anyone else because of it.
  - geoduck14 5y ago
    HN in the morning. HN after lunch. HN during meetings that are dragging on. HN makes me SO productive.
    - monkeyshelli 5y ago
      I still concider that better alternative than playing Candy Crush
heroHACK17 5y ago
I had a similar experience after switching companies (to remote) last year. Work computer has no personal accounts/services. iPhone (and personal Mac) has no work accounts/services. No Slack, calendars, etc. I made it clear up-front that I am not available before 8AM and after 5PM M-F, but very available during work hours. Best decision I ever made!
yourabstraction 5y ago
I did this exact same thing at my last job, and I agree that it's remarkable how much it made both work and non work life better. Drawing hard lines can oftentimes make compliance much easier. Just the fact that I had decided to not have/do ANY personal stuff on my work computer made it very easy to focus and be extremely productive. I'm in the middle of my career, and it was by far my most productive time as a software engineer. That being said, I didn't work myself to the bone. Instead of taking breaks with reddit, checking personal email, or spending time on social networks, I allowed myself long lunches, long walks, naps in the park or at the beach, and other forms of relaxation during the working day. This easy pace allowed me to perform some of the highest quality and most creative work of my career.
jcun4128 5y ago
For me to have work Teams on my phone, have to install this app that can remotely wipe my phone. Understandable but still.
- zdragnar 5y ago
  When I have worked for similar companies, I simply didn't install any of their software on my phone. If they wanted the ability to wipe it, they would have to give me a phone for it. Sure enough, it never turned out to be that important to anyone.
  - rodgerd 5y ago
    Yeah, I wouldn't trust company MDM on a personal device at all. Best case is that someone with an itchy trigger finger wipes your phone. Worst case you've got someone deciding to poke around your personal device for shits and giggles.
    - zdragnar 5y ago
      Ironically, a week before I left one of these companies, they remotely wiped my work laptop. Someone got the memo wrong, and I spent the better part of my remaining time with them trying to get access to all the various systems so I could complete one bug ticket. I hate to imagine what would have happened if I had given them access to my personal phone.
- Buttons840 5y ago
  Is it an Android? How does that work? Is it a special permission or something? I've allowed Slack on my personal phone. It has no permissions according to the Android OS (beyond permission to use the network, which, of course, can't be denied least Google lose ad revenue). I don't think it can wipe my phone. I hope it can't wipe my phone?
  - jcun4128 5y ago
    I didn't install it. After 5/6 I'm done with work. I don't use work devices for personal use/vice versa.
ip26 5y ago
Calendar is what kills this approach for me. I am not two different people with two different calendars, I am one person with one calendar. Scheduling & making all my appointments is really troublesome with two separate calendars.
- maxerickson 5y ago
  It's a pain, but no way are my appointments any of the company's business, and it's not worth putting work stuff on my calendar. Fortunately my work day ends when I leave work and I can just block off time if I am otherwise out of office for whatever reason.
  - BoorishBears 5y ago
    You can share a calendar as free/busy
    - maxerickson 5y ago
      If you are not the administrator of the system in question, that isn't quite the right description.
      - BoorishBears 5y ago
        ... not the administrator of your personal calendar?
  - deleted 5y ago
    [deleted]
  - killjoywashere 5y ago
    This is one place where you can, maybe, shed a tear for management. Imagine your CEO keeping a separate calendar. Don’t you want them inviting investors over for dinner?
- 3np 5y ago
  This sounds strange, but I assume you must have extremely flexible work hours. So just share the calendar and isolate the rest? No need to throw the baby out with the bath water, do what works for you
talkingquickly 5y ago
Really like this approach but 7KG cabin baggage limits on lots of international flights are what makes it really hard for me. I sometimes struggle to get single laptop + iPad + charger + power bank within the limit, let alone two sets.
- alok-g 5y ago
  I always carry two laptops (personal + work) on all trips, domestic or international. Other than added inconvenience of having to take out and put back stuff during security checks, it has always worked out. Even when I end up exceeding the 7 kg limit, I've never been stopped.
markus_zhang 5y ago
I wish I could do this. Now the two are perfectly mixed on my work laptop.
vmception 5y ago
I’ve known so many people that wanted to get into crypto over the last decade and didn't even own a laptop of their own and were practically married to their employer as if that was normal (in their corporate world that was normal) They had no way of managing private keys, privately or properly at all They did it anyway, in one instance one person turned in their computer for routine IT maintenance and it was wiped! lol! Its pretty obvious that a person like this only had a passing interest in crypto and never made any backup Things are so much easier now with hardware wallets that connect to iphone apps But its shocking how people often have no separation
- ghaff 5y ago
  I don't really. But I use my own computers for most things. If I had to use a work-issued computer for work things, I'd be more careful about commingling. (I do have a work laptop, but I don't use it for very much.) I also generally keep personal and work email separate--to the degree one can really deliniate personal and work.
1vuio0pswjnm7 5y ago
"I don't have e-mail or slack on my phone." Thought maybe I was the only one. Text messaging is enough. Not even using any trendy apps, just a few basic things from F-Droid.
- majewsky 5y ago
  That wasn't OP's point. They meant that they don't have work e-mail or work slack on their private phone, to provide separation between work and private time.
xwolfi 5y ago
What you realize when you do that is how people actually adapt. I dont mind both, I have phases when Ill be fully plugged and answer work email at 1am, which starts to create a super fun action-oriented life where it's a denser and denser tunnel of things to do, fix, answer. But then when you stop (I got a Huawei phone which cant install most of the corporate things for national security reasons), then wow. When I leave I leave, I do dilletante stuff, eat out with my wife and nobody cares. They just call someome else. I get probably less cookie points at annual reviews but a few rushes at the end of the year can usually compensate.
requirementyogi 5y ago
For me, using Facebook cookies in the same browser as work stuff blows my mind. I specifically write in the onboarding of my employees “Create a separate Chrome or FF profile to use your Facebook and other personal browsing”, and only half respect this rule, interns being specifically bad (experience workers do want work/home isolation). They receive quite a scolding when I catch them, but the damage is done: All websites have immediately registered who they are associated with, who their colleagues are, etc. Stringent security rules and obnoxious firewalls exist because people don’t respect cool rules.
- Hnrobert42 5y ago
  Firefox containers are good for this type of separation.
teekert 5y ago
I try to do it. One thing that helps is my Logitech MX keys, it switches to my Phone with the push of a button, so I don't feel the need so much to install Signal and Telegram on my work laptop. (I still do of course, it's just too easy... but I try because I understand the problem.) What is nice about my employer is that they ask you to fully wipe your drives (throw away the encryption key) before handing/sending in stuff. It's as much protection for them as it is for me.

LanceH 5y ago

I do this while freelancing/contracting as well. I have a macbook for client work only. While I don't have a one for each potential client, I do use a different user for each client, and all data should remain in user space -- which is easy enough to accomplish since I need to maintain matching versions of databases anyway, there is no need to share a single data store.

dylan604 5y ago
The user per client on the computer sounds like a nice idea. I haven't done that, but can easily see the appeal. Nice one
- touisteur 5y ago
  Would almost be better with in addition a vm per customer or at least some kind of encrypted partition per user/customer. Not sure how easy it is under Linux.
  - kyleee 5y ago
    Just bite the bulllet and move to Qubes
    - petertodd 5y ago
      Another advantage of doing this on separate VMs on Qubes is it makes it easy to comply with end-of-contract requirements to destroy all data. Just delete the VMs, and if needed, old backups.
    - touisteur 5y ago
      Didn't know Qubes had such a feature (encrypted home partition/container). Will have a look, thanks.
  - asymptosis 5y ago
    > Not sure how easy it is under Linux. Not sure how easy it is on other OSes. On Linux, it's easy.
  - vladvasiliu 5y ago
    On the face of it, it looks fairly simple on Linux with the encrypted homes feature. Don't have the need for that, so I've never tested it in practice, though.
- handrous 5y ago
  It's a great system. The only real pain I've run into with it, on macOS anyway, is that you can't isolate iCloud accounts and still receive texts on your Mac. So unless you have a separate phone for each client, that's not so great. Also, the lack of profiles on iDevices means any client-specific apps (2fa stuff, for instance, or if you like to have Slack on your iDevice, or dev/testing apps, or whatever) ends up in a shared space on there.
  - Buttons840 5y ago
    I created a new iCloud account with my work email.
    - handrous 5y ago
      Right, the trouble's getting text messages and such through to your laptop (text message 2fa is so nice with a synced phone—auto fill!), if you have multiple clients. One work phone + personal phone (or tablets, or whatever) is fine. It's when you have three clients, and maybe they rotate out sometimes, that it gets to be a little annoying. ... unless you can add multiple iCloud accounts to one phone. I guess I've never tried, because I just assumed you couldn't. Though you'd still have the problem of things like dev builds and all that existing in the same space, and email accounts (on the phone) syncing to the same application without much separation, and all that.
      - ThePowerOfFuet 5y ago
        Why are you using SMS 2FA anyway?
- sleepybrett 5y ago
  I once worked with a guy in the early 2000s that did 1 laptop per major client project (this was local workflow type app stuff, so windows desktop clients with maybe some kind of data backend) when he was complete he literally took the laptop and put a label on it and put it on a shelf. He'd been burned once to many times on backwards compatibility and library quirks with windows.
jokethrowaway 5y ago
KDE has the concept of activities (think like, virtual desktop on steroids, with custom widgets and look) which I used for some time to split between clients' work. It was a fun gimmicky but I can't say I missed it once I had to start using a Mac.
- LinAGKar 5y ago
  I've started using that when working from home, putting the work stuff on a separate activity.
ska 5y ago
I've done this before with one VM per client. Makes archiving etc. simple also, and means that per-client setup stuff never tramples on each other. Gives an answer for how you firewall sensitive data also, e.g. every document you gave me never existed anywhere except in this (potentially encrypted) VM. Easy to delete cleanly.
- mark_l_watson 5y ago
  That sounds like a clean way to organize multiple clients. For some types of development, I find working on a remote server using SSH/Mosh/tmux works really well for me. I am retired now but I used to ask clients to rent a reasonably powerful VPS that we both had access to and just worked on that. I think this gave customers good control over their property (i.e., the work I did on their behalf).
ekzy 5y ago
I tried to use this approach before, but if I remember correctly Homebrew didn’t like it. I like to manage my software with Homebrew, but multi user simply wasn’t working
- Nextgrid 5y ago
  You can install Homebrew in a non-default directory like somewhere under your home directory. It requires every package to be rebuilt during install, but it's possible. This means you should even be able to get away without even escalating your privileges to root.
nine_k 5y ago
How do you handle brew? It makes all the /usr/local/bin stuff belong to the regular user which installed it. Other users had trouble working with brew-installed stuff, last time I tried a few years ago.
- vanpythonista 5y ago
  You can install brew in your home directory using the Untar Anywhere approach. I’m particular sceptical of how brew handles permissions, so I always install it to ~/homebrew. One thing to note, if you use this approach Homebrew will not use its precompiled binaries and build everything from source. https://docs.brew.sh/Installation#untar-anywhere https://docs.brew.sh/Installation#untar-anywhere
- Phurist 5y ago
  Use Nix instead.
vagrantJin 5y ago
> While I don't have a one for each potential client... So 6 clients = 6 computers...pardon me Macbooks is your ideal setup? I hope that was a joke. I really hope that was a joke.
midasz 5y ago
I do the same on Linux, I install software that I always use (DBeaver, Intellij, Spotify, 1Password, browsers, postman, docker stuff, etc) with my 'personal' user and when I switch clients I just create a new user and copy over my licenses. Then I use firefox for everything client related (their outlook, jira, etc) and just login to my gmail on chrome or brave or something.

kritiko 5y ago

Which computer are you posting this from?

yumraj 5y ago
Everyone knows that HN is work.
datameta 5y ago
Potentially from the ~6x10cm computer
- marton78 5y ago
  ... while sitting on porcelain with his trousers down.
Volundr 5y ago
Personal. Took a break, got some food, browsed HN, etc.
Buttons840 5y ago
Posting from his personal phone while sitting in front of a company computer.
p1necone 5y ago
Imo browsing hn every morning is a useful part of my job. I've found out so many useful things before anyone else because of it.
- geoduck14 5y ago
  HN in the morning. HN after lunch. HN during meetings that are dragging on. HN makes me SO productive.
  - monkeyshelli 5y ago
    I still concider that better alternative than playing Candy Crush

heroHACK17 5y ago

I had a similar experience after switching companies (to remote) last year. Work computer has no personal accounts/services. iPhone (and personal Mac) has no work accounts/services. No Slack, calendars, etc. I made it clear up-front that I am not available before 8AM and after 5PM M-F, but very available during work hours. Best decision I ever made!

yourabstraction 5y ago

I did this exact same thing at my last job, and I agree that it's remarkable how much it made both work and non work life better. Drawing hard lines can oftentimes make compliance much easier. Just the fact that I had decided to not have/do ANY personal stuff on my work computer made it very easy to focus and be extremely productive. I'm in the middle of my career, and it was by far my most productive time as a software engineer. That being said, I didn't work myself to the bone. Instead of taking breaks with reddit, checking personal email, or spending time on social networks, I allowed myself long lunches, long walks, naps in the park or at the beach, and other forms of relaxation during the working day. This easy pace allowed me to perform some of the highest quality and most creative work of my career.

jcun4128 5y ago

For me to have work Teams on my phone, have to install this app that can remotely wipe my phone. Understandable but still.

zdragnar 5y ago
When I have worked for similar companies, I simply didn't install any of their software on my phone. If they wanted the ability to wipe it, they would have to give me a phone for it. Sure enough, it never turned out to be that important to anyone.
- rodgerd 5y ago
  Yeah, I wouldn't trust company MDM on a personal device at all. Best case is that someone with an itchy trigger finger wipes your phone. Worst case you've got someone deciding to poke around your personal device for shits and giggles.
  - zdragnar 5y ago
    Ironically, a week before I left one of these companies, they remotely wiped my work laptop. Someone got the memo wrong, and I spent the better part of my remaining time with them trying to get access to all the various systems so I could complete one bug ticket. I hate to imagine what would have happened if I had given them access to my personal phone.
Buttons840 5y ago
Is it an Android? How does that work? Is it a special permission or something? I've allowed Slack on my personal phone. It has no permissions according to the Android OS (beyond permission to use the network, which, of course, can't be denied least Google lose ad revenue). I don't think it can wipe my phone. I hope it can't wipe my phone?
- jcun4128 5y ago
  I didn't install it. After 5/6 I'm done with work. I don't use work devices for personal use/vice versa.

ip26 5y ago

Calendar is what kills this approach for me. I am not two different people with two different calendars, I am one person with one calendar. Scheduling & making all my appointments is really troublesome with two separate calendars.

maxerickson 5y ago
It's a pain, but no way are my appointments any of the company's business, and it's not worth putting work stuff on my calendar. Fortunately my work day ends when I leave work and I can just block off time if I am otherwise out of office for whatever reason.
- BoorishBears 5y ago
  You can share a calendar as free/busy
  - maxerickson 5y ago
    If you are not the administrator of the system in question, that isn't quite the right description.
    - BoorishBears 5y ago
      ... not the administrator of your personal calendar?
- deleted 5y ago
  [deleted]
- killjoywashere 5y ago
  This is one place where you can, maybe, shed a tear for management. Imagine your CEO keeping a separate calendar. Don’t you want them inviting investors over for dinner?
3np 5y ago
This sounds strange, but I assume you must have extremely flexible work hours. So just share the calendar and isolate the rest? No need to throw the baby out with the bath water, do what works for you

talkingquickly 5y ago

Really like this approach but 7KG cabin baggage limits on lots of international flights are what makes it really hard for me. I sometimes struggle to get single laptop + iPad + charger + power bank within the limit, let alone two sets.

alok-g 5y ago
I always carry two laptops (personal + work) on all trips, domestic or international. Other than added inconvenience of having to take out and put back stuff during security checks, it has always worked out. Even when I end up exceeding the 7 kg limit, I've never been stopped.

markus_zhang 5y ago

I wish I could do this. Now the two are perfectly mixed on my work laptop.

vmception 5y ago

I’ve known so many people that wanted to get into crypto over the last decade and didn't even own a laptop of their own and were practically married to their employer as if that was normal (in their corporate world that was normal) They had no way of managing private keys, privately or properly at all They did it anyway, in one instance one person turned in their computer for routine IT maintenance and it was wiped! lol! Its pretty obvious that a person like this only had a passing interest in crypto and never made any backup Things are so much easier now with hardware wallets that connect to iphone apps But its shocking how people often have no separation

ghaff 5y ago
I don't really. But I use my own computers for most things. If I had to use a work-issued computer for work things, I'd be more careful about commingling. (I do have a work laptop, but I don't use it for very much.) I also generally keep personal and work email separate--to the degree one can really deliniate personal and work.

1vuio0pswjnm7 5y ago

"I don't have e-mail or slack on my phone." Thought maybe I was the only one. Text messaging is enough. Not even using any trendy apps, just a few basic things from F-Droid.

majewsky 5y ago
That wasn't OP's point. They meant that they don't have work e-mail or work slack on their private phone, to provide separation between work and private time.

xwolfi 5y ago

What you realize when you do that is how people actually adapt. I dont mind both, I have phases when Ill be fully plugged and answer work email at 1am, which starts to create a super fun action-oriented life where it's a denser and denser tunnel of things to do, fix, answer. But then when you stop (I got a Huawei phone which cant install most of the corporate things for national security reasons), then wow. When I leave I leave, I do dilletante stuff, eat out with my wife and nobody cares. They just call someome else. I get probably less cookie points at annual reviews but a few rushes at the end of the year can usually compensate.

requirementyogi 5y ago

For me, using Facebook cookies in the same browser as work stuff blows my mind. I specifically write in the onboarding of my employees “Create a separate Chrome or FF profile to use your Facebook and other personal browsing”, and only half respect this rule, interns being specifically bad (experience workers do want work/home isolation). They receive quite a scolding when I catch them, but the damage is done: All websites have immediately registered who they are associated with, who their colleagues are, etc. Stringent security rules and obnoxious firewalls exist because people don’t respect cool rules.

Hnrobert42 5y ago
Firefox containers are good for this type of separation.

teekert 5y ago

I try to do it. One thing that helps is my Logitech MX keys, it switches to my Phone with the push of a button, so I don't feel the need so much to install Signal and Telegram on my work laptop. (I still do of course, it's just too easy... but I try because I understand the problem.) What is nice about my employer is that they ask you to fully wipe your drives (throw away the encryption key) before handing/sending in stuff. It's as much protection for them as it is for me.