5 ms·

> I can see giving a star performer a chance No. A million times no. You do not use double standards. It kills morale, because it's immoral. Anyway, a top per

> I can see giving a star performer a chance No. A million times no. You do not use double standards. It kills morale, because it's immoral. Anyway, a top performer, should know when to walk away and contact security and legal. If I found this. I would immediately have contacted my manager, and our security team, and see if our security would advise legal. Then we'd immediately contact OtherCo's security team. If you find a security flaw, you have to immediately report. You DO NOT "explore" someone else's machine. It goes sideways too easily, and people always want to get the cops involved. Your number one duty is to protect yourself.

robocat 5y ago
> Your number one duty is to protect yourself. Which may involve not informing your own manager or security team, depending on context? I wonder if he would have been caught if he hadn’t told his own company?
- jonathankoren 5y ago
  Cover up is never the solution.
  - Aeolun 5y ago
    It’s literally the least painful solution for the individual involved. If they guy hadn’t reported it to his company nobody would have know he was the once exploring their API and he’d be home free.
    - jonathankoren 5y ago
      It literally just takes someone to do an log inspection, and then he’s super screwed.
    - borski 5y ago
      Until it is uncovered and the individual is now screwed twice; once for doing it, and once for covering it up, at which point the company can now potentially claim gross negligence if they become liable.
- tsimionescu 5y ago
  If he was doing it from the company network and company devices, almost surely, unless he got extremely lucky and their internal monitoring is pretty bad (unlikely at a bank).
asdfasgasdgasdg 5y ago
I'm not saying I'd give them a chance to hack. I'm saying there's a chance I wouldn't have fired a star performer immediately on hearing they had been hacking. If it was someone I could afford to part with, I would, without a warning. The behavior in this blog post shows extremely poor judgment.
- jonathankoren 5y ago
  But you have to fire them. You especially have to fire the star performer. Saying the rules don't apply to certain individuals will destroy your team. There are plenty of policies that will get you immediately fired at many companies. Inappropriate data access is always one. And let me tell you from experience, EVERYONE is replaceable. Just do what you'd do if he left, or dropped dead. If you can't handle those contingencies, you have something deeply wrong with the organization of your team.
  - aardshark 5y ago
    I'm interested to hear what real-world experiences have lead you to think this way. From what I've seen, exceptions can always be made and people will often put up with it, depending on the circumstances. Look at the number of people in here who don't believe what the OP did should be a crime, and don't consider his actions immoral. You're telling me those people wouldn't accept a little rule-bending if they were on the team? I can't agree.
    - jonathankoren 5y ago
      If your point is that some people will accept some rule breaking, then rule breaking is okay, I simply don’t agree. Of course some people will accept rule breaking. There’s always people that will justify it post hoc. There are also others that won’t. The real problem is you’ve now created a culture of rule breaking. Soon everyone will be violating policies as a matter of due course. This is exactly how you get lawsuits and criminal complaints. If you’re lucky, you just have a toxic culture that hurts recruiting and retention. People here always complain about “politics”, but that’s exactly what this is. If you need examples of where exceptions came back to bite people and companies in the ass, it’s everywhere. Theranos, Uber, Zenefits, Google, the list goes on and on. Even so, I fully expect advocates for capricious enforcement (ie protecting their friends) will further justify it by saying something about how the fines and settlements were “good business decisions” or something, because self justification knows no bottom.

robocat 5y ago

> Your number one duty is to protect yourself. Which may involve not informing your own manager or security team, depending on context? I wonder if he would have been caught if he hadn’t told his own company?

jonathankoren 5y ago
Cover up is never the solution.
- Aeolun 5y ago
  It’s literally the least painful solution for the individual involved. If they guy hadn’t reported it to his company nobody would have know he was the once exploring their API and he’d be home free.
  - jonathankoren 5y ago
    It literally just takes someone to do an log inspection, and then he’s super screwed.
  - borski 5y ago
    Until it is uncovered and the individual is now screwed twice; once for doing it, and once for covering it up, at which point the company can now potentially claim gross negligence if they become liable.
tsimionescu 5y ago
If he was doing it from the company network and company devices, almost surely, unless he got extremely lucky and their internal monitoring is pretty bad (unlikely at a bank).

asdfasgasdgasdg 5y ago

I'm not saying I'd give them a chance to hack. I'm saying there's a chance I wouldn't have fired a star performer immediately on hearing they had been hacking. If it was someone I could afford to part with, I would, without a warning. The behavior in this blog post shows extremely poor judgment.

jonathankoren 5y ago
But you have to fire them. You especially have to fire the star performer. Saying the rules don't apply to certain individuals will destroy your team. There are plenty of policies that will get you immediately fired at many companies. Inappropriate data access is always one. And let me tell you from experience, EVERYONE is replaceable. Just do what you'd do if he left, or dropped dead. If you can't handle those contingencies, you have something deeply wrong with the organization of your team.
- aardshark 5y ago
  I'm interested to hear what real-world experiences have lead you to think this way. From what I've seen, exceptions can always be made and people will often put up with it, depending on the circumstances. Look at the number of people in here who don't believe what the OP did should be a crime, and don't consider his actions immoral. You're telling me those people wouldn't accept a little rule-bending if they were on the team? I can't agree.
  - jonathankoren 5y ago
    If your point is that some people will accept some rule breaking, then rule breaking is okay, I simply don’t agree. Of course some people will accept rule breaking. There’s always people that will justify it post hoc. There are also others that won’t. The real problem is you’ve now created a culture of rule breaking. Soon everyone will be violating policies as a matter of due course. This is exactly how you get lawsuits and criminal complaints. If you’re lucky, you just have a toxic culture that hurts recruiting and retention. People here always complain about “politics”, but that’s exactly what this is. If you need examples of where exceptions came back to bite people and companies in the ass, it’s everywhere. Theranos, Uber, Zenefits, Google, the list goes on and on. Even so, I fully expect advocates for capricious enforcement (ie protecting their friends) will further justify it by saying something about how the fines and settlements were “good business decisions” or something, because self justification knows no bottom.