27 ms·

> If you are affected, you will receive this notification in your personal email, because we made the decision to cut access to Coinbase systems for affected em

> If you are affected, you will receive this notification in your personal email, because we made the decision to cut access to Coinbase systems for affected employees. I realize that removal of access will feel sudden and unexpected, and this is not the experience I wanted for you. Given the number of employees who have access to sensitive customer information, it was unfortunately the only practical choice, to ensure not even a single person made a rash decision that harmed the business or themselves. How typical is this? Is he really talking about the hot wallet and/or cold storage? Those claiming that this is a "crypto" sentiment thing should consider the possibility that the front page of HN will be filled with stories like this from all over the economy within one month.

t_mann 4y ago
In finance it's pretty common practice (and in that sense Coinbase is similar to a broker). I remember stories about how half (?) the people working at UBS London came to work one morning to find that their badges didn't unlock the entrance gates anymore. And lots of stories like that in the years following the 2008 crash.
- rchaud 4y ago
  Wouldn't their Blackberries be remotely deactivated first?
  - CydeWeys 4y ago
    Phones stop working for lots of reasons other than "I've been fired". I'd still show up to work. It'd be pretty bad if your phone indeed had just stopped working, and rather going in to get it fixed, you just assumed you were fired and then stopped going into work, thus actually getting fired for not showing up.
  - jabroni_salad 4y ago
    BES doing something reliably? That was a good laugh, thanks.
  - Qub3d 4y ago
    That is a major plot point in Margin Call, which is a dramatization of the initial housing bubble crash of 08: https://youtu.be/zn2Xf9hAFcE?t=461 https://youtu.be/zn2Xf9hAFcE?t=461
  - t_mann 4y ago
    Most people there would probably come into work between 8 and 9am. Even if the phones were deactivated before then, most might not even have noticed (those that did notice might have had a premonition, but what are you going to do about it on your commute?).
lancesells 4y ago
I think it's typical and I would honestly prefer this if I worked somewhere. Our working relationship is over and you've let me go so let's call it a day.
Maximus9000 4y ago
> we made the decision to cut access to Coinbase systems for affected employees Apparently they used to do this at Microsoft. Microsoft stopped doing it though because people would freak out if the network ever went down - employees would think "oh my god, I'm about to get fired".
- rchaud 4y ago
  Perhaps Coinbase is speedrunning the evolution of modern HR practices, just as the market it serves is speedrunning through the history of financial regulation.
danielcampos93 4y ago
Common practice. In places where I have worked if you told the company you had a competitive offer the standard practice was to take 15 minutes to try to get you a matched offer. If you declined or they couldn’t match it was automatic walk off the premise
gtirloni 4y ago
I've only seen this in American companies. I'm sure other companies in other countries do it but it's pretty standard for Americans.
Hellbanevil 4y ago
Can anyone explain their 6 plus billion dollar yearly operating costs? I hope it's not mainly advertising.
- adventured 4y ago
  Their operating expense over the past year was $4.35 billion. Cost of revenue was $1.3b, leaving the $1.5b operating income. $745m selling & marketing expense over the past year (SG&A was $1.95b overall). $1.67b expense for R&D. $733m for other.
yunohn 4y ago
> Those claiming that this is a "crypto" sentiment thing should consider the possibility that the front page of HN will be filled with stories like this from all over the economy within one month That may very well happen, but Coinbase is directly blaming their layoffs on over-hiring for web3 usecases and ideas that they feel are no longer financially viable.
andrew_ 4y ago
Extremely common in fintech and health care. It's the remote analog to being escorted out by security. I've worked for two health care companies and have had access removed the literal last minute of my last day. One, a large pharma co, used a policy update to remove my ability to log into the company laptop. Not a comment on the practice, only sharing experience.
tomp 4y ago
Par de course in finance (hedge funds etc.). People just "disappear" overnight. Access cut. You've had nothing on your personal computer anyways (all work & data is on company machines, accessed through Remote Desktop).
thaway2839 4y ago
Lol, so 18% of their employees have access to personal data. Ok. I am very comfortable entrusting my data to this company.
dogman144 4y ago
Very, very typical. Insider threat teams are a thing at many tech or otherwise companies. Nothing specific to crypto other than a higher incentive to have an ithreat team. You should be doing nothing and no one on a work computer that is not 100% work related. Blows my mind that people do otherwise.
deadbunny 4y ago
Just the remote working equivalent of being escorted from site by security.
deleted 4y ago
[deleted]
hnbear 4y ago
There's a lot of commentary on this, but people seem to be conflating a couple of points - namely that this cut all access - everything, and emailed to personal email and not just access to "secure" systems. That is pretty unusual, and not something I've seen. Typically access to sensitive systems is cut, but cutting everything and notifying to personal email seems unusual. Sensitive information should always be segregated and subject to tight controls, which is easy to sever, and then leave regular email and video conferencing in place - ie. the bare minimum necessary to communicate over a work device.
- le-mark 4y ago
  > Sensitive information should always be segregated and subject to tight controls, which is easy to sever This, very few people should have access to production data. This is a shocking revelation. I’m reevaluating being a customer of theirs.
  - ihumanable 4y ago
    In this episode of Coinbase they learn that authentication and authorization are two different things :D I was similarly shocked that the only control plane they had to limit access to sensitive information was literally terminating everything. They don't have any kind of access control that would allow them to keep an employee in their system but limit their access. How exactly are they running a "finance company" if they don't have these basic protections. I could see if they were an early stage startup and just haven't gotten around to it, but they are multiple thousands of employees at this point. In every start up I've worked in, implementing access controls ends up being a priority around 100 employees. I've never used Coinbase but this revelation makes me not want to ever use them in the future.
    - Symbiote 4y ago
      Email is often "production data" -- it contains personal data, IP, business relationship information and so on. Sending an email from an @coinbase.com is certainly a production action. It is only fairly recently that locking people out of the office didn't implicitly remove their access to email, memos, letters and so on.
chinathrow 4y ago
> I realize that removal of access will feel sudden and unexpected, and this is not the experience I wanted for you. Then don't fucking give it. Or don't write this sentence.
ingenieros 4y ago
This is the primary reason why Active Directory and Rippling exist.
samstave 4y ago
Cutting off access for any IT / OPs / SRE type role when releasing an employee is mandatory, not just typical.
unholythree 4y ago
Places where employees have physical keys face a similar problem; what to do to keep an employee that was fired or quit from having access to things of value they shouldn't be able to access anymore. This is a big part of why key fobs are so popular since you can have thousands of unique ones to enable or disable. I worked at hotel once where I had keys to everything and I would take them home nightly at the end of my shift. When the hotel changed ownership one of the changes implemented was anyone with hotel keys had to lock them up in one of the front desk safety deposit boxes when their shift ended. At the time I thought this was pointless security theater that wasted 10 minutes of my day. In retrospect, it was probably so we could safely be fired if necessary with our keys still accounted for.
masterof0 4y ago
In my first job, the company laid off 200 people, and they found out when they couldn't use their badge to enter the building. Corporations love to do that type of things.
shrimpx 4y ago
My first thought is that there could easily be a malicious actor within the not yet laid off employees who could now be actually incentivized to do their bad deed seeing clearly that they may get no notice when fired.
nemo44x 4y ago
Pretty standard to not let terminated employees hang around. It feels cold but it’s just the way it has to be. Sone places will even do this when an employee submits a resignation on good terms. Just a way for the company to cover themselves.
- davewritescode 4y ago
  This was a well known thing at a company I worked for that was involved with government work. If you were leaving for another industry the last 2 weeks were for finishing up work and saying goodbye to your coworkers. If you were leaving for a competitor you were walked out within an hour of submitting your resignation and promised your 2 weeks pay. It was so well known that engineers would schedule vacations starting the day after they planned to resign and say their goodbyes to coworkers before telling their bosses.
  - q1w2 4y ago
    I usually terminate access immediately. It's just solid IT security practice. I've seen WAY too many cases of employees email forwarding documents to their personal email the moment they are told they're being let go. Before we started terminating access immediately, I'd estimate that roughly 25% of employees would email themselves at least something.
    - hhmc 4y ago
      What were they emailing themselves, IP?
      - q1w2 4y ago
        All sorts of things. Sometimes it's code or documentation/guides they wrote that they believe they're entitled to... Sometimes it's personal things they kept on their work computer/account.... Sometimes it's contact lists... Sometimes it's strategy docs they authored... Sometimes it's password files (which often mix personal and work creds). Sometimes it's whatever-they-can-think-of that might be of value on the share drive... It's just so incredibly common that I don't understand why any employer doesn't terminate access the instant someone is let go. When people they're in a state of stress just grab whatever they can think of.
dominotw 4y ago
very typical.
avrionov 4y ago
This is very typical. He is talking about cutting now former employees access to email, source code repositories, internal systems. It is done all the time. It looks very harsh.
- heretogetout 4y ago
  And if I were a customer, I'd be concerned if they didn't cut off access immediately.
  - Rebelgecko 4y ago
    IMO it's concerning that they don't have more granular security controls than totally shutting down someone's access (or maybe they do, but they laid off the person who knows how to take access away from production systems without taking away someone's ability to read email)
vlozko 4y ago
I’m would say pretty common? Sometimes it happens to personal accounts if the user has access to sensitive data. For setups that aren’t as sensitive or groups of employees that don’t have access to such data, various systems may be locked down for a period. For example, access to source control or staging/production environments may be generally limited. For unexpected one-off firings, the user is often locked out before they’re aware they’ve been let go.
sen 4y ago
Common in lots of jobs. I’ve seen people get fired from Gov IT and F500 IT teams where they only find out they’re fired when they rock up to work and their pass doesn’t let them in. Security has their stuff in a box to give to them along with a letter explaining everything. To be fair, getting fired from those companies meant you actually did something wrong. There wasn’t these mass culls that crypto/startup type companies are famous for.
samwillis 4y ago
To be honest this is the more concerning thing in that quoted statement: > "Given the number of employees who have access to sensitive customer information" Surly they should have very very few employs that have access to that type of information?
- eganist 4y ago
  > Surly they should have very very few employs that have access to that type of information? It depends on the nature of the information. If we're talking anything that directly affects liquidity, I'd be surprised if that number was large. But if we're talking regulated or contractually protected consumer information (e.g PCI), that number's probably a bit bigger.
- hourago 4y ago
  You are completely right. Sensitive customer information should be only accessible as a per need basis. It's very bad practice, possibly illegal in many countries, to have free access to production customer data. It's also quite dangerous for a big company. Production databases should not be accessible by developers, logs should need enough to debug problems, and should be scrapped after some time. Metrics can be stored as long as needed, as should not contain personal data but just counters, averages, etc.
  - SketchySeaBeast 4y ago
    A responsible company would consider "sensitive customer information" to be pretty much every bit of customer information - names, addresses, phone numbers, bank accounts. Maybe low-level developers won't have access to that but every member of the infrastructure and customer facing teams will in some fashion because it's 100% part of their job and odds are good that's the majority of the people in the company.
- tinco 4y ago
  As a teenager I worked an evening job at one of the largest banks in the world, processing mail-in credit card orders. I would sit at a computer, run an app that could query any bank account number, and I'd get their current balance (along with all other personal info). It was part of a series of checks I had to do to make sure they qualified for the credit card. One kid definitely got fired for querying data on persons they weren't supposed to query for. With work-from-home, I can imagine there's employees with all sorts of access. And with them being a startup, who knows how much controls they've got in place yet.
livinginfear 4y ago
Asking as a layman to macroeconomics, if you think that the current rash of crypto companies collapsing heralds a greater economic catastrophe, do you have any advice on how to best survive another dot-com style crash?
- matwood 4y ago
  Do whatever you have to in order to keep your job. Your investments may go up, down or sideways, prices of things might move around, but it's all secondary to keeping a job.
- wutbrodo 4y ago
  I'm also a layman, though one of my degrees is in economics, which tbh isn't that helpful here beyond understanding the fundamentals. My current working model is that there are multiple simultaneous effects, mostly separable but interrelated. In order of decreasing acuteness: a) asset bubble popping due to imminent rate increases. Crypto the obvious candidate for a correction that IMO was predictable? Future of the industry unpredictable (by me) b) Tech stock correction and hiring freeze, due to skyrocketing value growth and some overextension during the pandemic. This is a good thing, and a healthy pullback on very recent overestimate of value gains. Fundamentals largely unaffected c) More secular pullback of tech value into a lower equilibrium. High-growth stocks do well in historically low-rate environment, that we're potentially exiting d) General recession expected. Marginal tech startups wiped out, bigtech generally still a great place to get paid a ton and buy the market while it's low I'd love to hear if anyone has anyone else has any disagreements with my working model! I'm far from an expert, but using it for my own decision-making. Eg, I just quit my job, but I was planning to go back to bigtech so I'm not especially worried (plus I have tons of savings and frankly don't care about $ that much). OTOH, I'm not taking much time off, because I expect hiring and possibly salaries to start tightening even in bigtech.
- deadbunny 4y ago
  The same as in the good times. 1. Create a budget Know how much you spend per month, and what are essentials (Rent, Food, Transport etc.) and what can go if you really need to (Netflix, eating out, etc.) 2. Have 3-6 months expenses in an emergency fund Usually cash or things not likely to tank during a downturn like stock/crypto. You can find more helpful info here: https://old.reddit.com/r/personalfinance/wiki/commontopics https://old.reddit.com/r/personalfinance/wiki/commontopics
NikolaNovak 4y ago
Unfortunately it's common enough. It's harsh, it's cold, but ultimately for companies it's a real necessity. The explanation is blunt and correct - even a single malicious actor can enact HUGE devastating harm. It doesn't have to be hot wallet / cold storage. Source code, business plans, revenue & profit statements, SSH to servers, physical access to datacentre, client contact lists, etc etc... there's a myriad things that are either valuable to the company or can cause harm to the company. I've been escorted out of the building during a layoff once early in my career. Friendly, smiley, fake. It felt AWFUL. I'm as goody-two-shoes pacifist laid back easy going do-no-harm as it gets... and I definitely had various strong emotions going through my head heart and body at the time. So on both cold & rational, as well as personal & empathetic side, I understand both how the individuals feel as well as why companies need to do it.
- UncleMeat 4y ago
  > Friendly, smiley, fake. My father had to lay off a bunch of people in 2008. I am now a manager. He told me that if I am ever forced to do this to not ever do this crap to my team. Tell them that this is bullshit. Tell them that you are upset. Tell them that you haven't slept. Tell them that the are right to be mad, disappointed, and even to hate you for choosing their head to roll. Anything better than fake smiles and "I'm sure you'll land on your feet." For me, I think I'd just quit if I was told to lay off people on my team. Maybe that's hard to do in the moment, since I'd also not want to lose my job in a major crisis, but it sounds awful.
  - dgfitz 4y ago
    Company I worked at had a layoff in 2012, security manager escorted 200 people out of the building. At the end of the day, he was escorted out of the building. It was quite shitty for that fellow, I felt terrible for him.
    - willcipriano 4y ago
      One place I worked at briefly would call the cops and have them escourt you out if they thought there was any risk of "disruption or back talk" (their words). I decided not to work for assholes who lay off little old ladies and then to add insult to injury, call the cops on them.
Y-bar 4y ago
Never heard this happen (Scandinavia) other than in the cases where an employee clearly breached laws or company policy. Standard procedure here is that you as a salaried employee will be guaranteed 1-2-3 months (depending on your contract) of notice. Edit with example: https://www.arbeidstilsynet.no/en/working-conditions/dismissal-with-notice/ https://www.arbeidstilsynet.no/en/working-conditions/dismiss... > An employee may usually remain in the post as long as negotiations or legal proceedings are in progress, provided the courts have not decided otherwise. > [...] > The employer may summarily dismiss an employee if he or she is guilty of a gross breach of duty or other serious breach of the contract of employment. The employee has no right to remain in his post while the matter is being considered, unless the court has decided otherwise.
- Symbiote 4y ago
  Being paid for 1-3 months is entirely independent of whether they want you in the office or not. In Britain it's called gardening leave, and it's common in finance and other jobs with tight security. You are paid, but you stay and home and do some gardening. (Or, more likely, look for a new job.)
  - Y-bar 4y ago
    I work with online payment processor and early during the covid pandemic we had some layoffs. They were all notices of 1+ month and everyone of them continued to work for the majority of the notice period. Nobody had anything revoked early. I understand it happens, but it seems _way_ too common (reading the comments here) compared to what is actually necessary.
  - samhw 4y ago
    Yeah, I worked at a UK bank and was given gardening leave even when I left to start a (somewhat orthogonal) competitor. Actually, they didn't even insist that I served out my leave before starting work. It's an odd system.
- dundarious 4y ago
  A decent amount of states in the US have “at-will employment” laws, meaning you can be fired for any reason (excluding specific things to do with “protected classes” like race, etc.), at any time, with immediate effect and without any notice. Similarly, this means you can quit your job at any time, with immediate effect and without any notice. If you quit, it’s only if you want to maintain reputation or relationships that you should work a notice period, but given the asymmetry of employer-employee power, that ends up being pretty common. For at-will employment, I don’t think there needs to be any severance package or mandatory weeks of pay, but I think it’s offered in many cases. Having said that, in finance (I used to work at a proprietary trading firm in an at-will state), it’s extremely common for firings to be immediate, e.g., arrive at work, boss calls you to office, get fired, badge taken and you’re walked out and your desk belongings are mailed to you later. More often, you’re walked to your desk to pick up your things instead of having them mailed out, but both happen. But even more often, people are “incentivized” through bad reviews and bad bonuses to quit in advance of a firing. When I quit, they didn’t want me to leave, and I negotiated a couple weeks of notice to hand over my responsibilities and knowledge, and to maintain some relationships. I had a non-compete in my original contract, so I would have to negotiate with the original firm as to whether they would enforce it. If so, I would receive gardening leave pay in order to delay my employment at a competing firm. That could be for as much as 2 years, and they would pay my base salary at the original firm in order for me to not start at the competition. This gardening leave is totally different than a severance package though.
kodah 4y ago
I've worked on security products as a SWE and as a SRE over critical systems, I've never seen this kind of behavior. This says a lot about the relationship Bryan and his team have with the people that work with them, imo. Edit: not sure what's up with the current iteration of the HN crowd, but downvote is not equal to "I disagree".
- eganist 4y ago
  It's as old as time. Or at least as old as the first few times mass layoffs and networked employee devices co-existed. https://www.nytimes.com/2001/03/21/jobs/laid-off-and-locked-out-of-your-pc.html https://www.nytimes.com/2001/03/21/jobs/laid-off-and-locked-...
  - kodah 4y ago
    Some companies do it, sure, but I wouldn't call it normal or acceptable. In fact, it's kind sleezy.
    - eganist 4y ago
      Mass-scale layoffs it's almost guaranteed. When you're talking even a single percentage point of employees departing, it's more normal than you might expect. Some companies even do it after an employee submits notice on their end (paying through the end of the term but disabling access earlier than expected, or even immediately), though this is far less common.
      - kodah 4y ago
        You can keep saying it, but it doesn't make it more true or acceptable. Anyway, the current HN crowd has been disappointing lately, so time to take a break.
        eganist 4y ago
        > You can keep saying it, but it doesn't make it more true or acceptable. We agree on whether it's acceptable, but let's be honest, any roles I've held in the past (and all security jobs around the world, really) exist only because people have a surprising potential to be absolutely crappy.

t_mann 4y ago

In finance it's pretty common practice (and in that sense Coinbase is similar to a broker). I remember stories about how half (?) the people working at UBS London came to work one morning to find that their badges didn't unlock the entrance gates anymore. And lots of stories like that in the years following the 2008 crash.

rchaud 4y ago
Wouldn't their Blackberries be remotely deactivated first?
- CydeWeys 4y ago
  Phones stop working for lots of reasons other than "I've been fired". I'd still show up to work. It'd be pretty bad if your phone indeed had just stopped working, and rather going in to get it fixed, you just assumed you were fired and then stopped going into work, thus actually getting fired for not showing up.
- jabroni_salad 4y ago
  BES doing something reliably? That was a good laugh, thanks.
- Qub3d 4y ago
  That is a major plot point in Margin Call, which is a dramatization of the initial housing bubble crash of 08: https://youtu.be/zn2Xf9hAFcE?t=461 https://youtu.be/zn2Xf9hAFcE?t=461
- t_mann 4y ago
  Most people there would probably come into work between 8 and 9am. Even if the phones were deactivated before then, most might not even have noticed (those that did notice might have had a premonition, but what are you going to do about it on your commute?).

lancesells 4y ago

I think it's typical and I would honestly prefer this if I worked somewhere. Our working relationship is over and you've let me go so let's call it a day.

Maximus9000 4y ago

> we made the decision to cut access to Coinbase systems for affected employees Apparently they used to do this at Microsoft. Microsoft stopped doing it though because people would freak out if the network ever went down - employees would think "oh my god, I'm about to get fired".

rchaud 4y ago
Perhaps Coinbase is speedrunning the evolution of modern HR practices, just as the market it serves is speedrunning through the history of financial regulation.

danielcampos93 4y ago

Common practice. In places where I have worked if you told the company you had a competitive offer the standard practice was to take 15 minutes to try to get you a matched offer. If you declined or they couldn’t match it was automatic walk off the premise

gtirloni 4y ago

I've only seen this in American companies. I'm sure other companies in other countries do it but it's pretty standard for Americans.

Hellbanevil 4y ago

Can anyone explain their 6 plus billion dollar yearly operating costs? I hope it's not mainly advertising.

adventured 4y ago
Their operating expense over the past year was $4.35 billion. Cost of revenue was $1.3b, leaving the $1.5b operating income. $745m selling & marketing expense over the past year (SG&A was $1.95b overall). $1.67b expense for R&D. $733m for other.

yunohn 4y ago

> Those claiming that this is a "crypto" sentiment thing should consider the possibility that the front page of HN will be filled with stories like this from all over the economy within one month That may very well happen, but Coinbase is directly blaming their layoffs on over-hiring for web3 usecases and ideas that they feel are no longer financially viable.

andrew_ 4y ago

Extremely common in fintech and health care. It's the remote analog to being escorted out by security. I've worked for two health care companies and have had access removed the literal last minute of my last day. One, a large pharma co, used a policy update to remove my ability to log into the company laptop. Not a comment on the practice, only sharing experience.

tomp 4y ago

Par de course in finance (hedge funds etc.). People just "disappear" overnight. Access cut. You've had nothing on your personal computer anyways (all work & data is on company machines, accessed through Remote Desktop).

thaway2839 4y ago

Lol, so 18% of their employees have access to personal data. Ok. I am very comfortable entrusting my data to this company.

dogman144 4y ago

Very, very typical. Insider threat teams are a thing at many tech or otherwise companies. Nothing specific to crypto other than a higher incentive to have an ithreat team. You should be doing nothing and no one on a work computer that is not 100% work related. Blows my mind that people do otherwise.

deadbunny 4y ago

Just the remote working equivalent of being escorted from site by security.

deleted 4y ago

[deleted]

hnbear 4y ago

There's a lot of commentary on this, but people seem to be conflating a couple of points - namely that this cut all access - everything, and emailed to personal email and not just access to "secure" systems. That is pretty unusual, and not something I've seen. Typically access to sensitive systems is cut, but cutting everything and notifying to personal email seems unusual. Sensitive information should always be segregated and subject to tight controls, which is easy to sever, and then leave regular email and video conferencing in place - ie. the bare minimum necessary to communicate over a work device.

le-mark 4y ago
> Sensitive information should always be segregated and subject to tight controls, which is easy to sever This, very few people should have access to production data. This is a shocking revelation. I’m reevaluating being a customer of theirs.
- ihumanable 4y ago
  In this episode of Coinbase they learn that authentication and authorization are two different things :D I was similarly shocked that the only control plane they had to limit access to sensitive information was literally terminating everything. They don't have any kind of access control that would allow them to keep an employee in their system but limit their access. How exactly are they running a "finance company" if they don't have these basic protections. I could see if they were an early stage startup and just haven't gotten around to it, but they are multiple thousands of employees at this point. In every start up I've worked in, implementing access controls ends up being a priority around 100 employees. I've never used Coinbase but this revelation makes me not want to ever use them in the future.
  - Symbiote 4y ago
    Email is often "production data" -- it contains personal data, IP, business relationship information and so on. Sending an email from an @coinbase.com is certainly a production action. It is only fairly recently that locking people out of the office didn't implicitly remove their access to email, memos, letters and so on.

chinathrow 4y ago

> I realize that removal of access will feel sudden and unexpected, and this is not the experience I wanted for you. Then don't fucking give it. Or don't write this sentence.

ingenieros 4y ago

This is the primary reason why Active Directory and Rippling exist.

samstave 4y ago

Cutting off access for any IT / OPs / SRE type role when releasing an employee is mandatory, not just typical.

unholythree 4y ago

Places where employees have physical keys face a similar problem; what to do to keep an employee that was fired or quit from having access to things of value they shouldn't be able to access anymore. This is a big part of why key fobs are so popular since you can have thousands of unique ones to enable or disable. I worked at hotel once where I had keys to everything and I would take them home nightly at the end of my shift. When the hotel changed ownership one of the changes implemented was anyone with hotel keys had to lock them up in one of the front desk safety deposit boxes when their shift ended. At the time I thought this was pointless security theater that wasted 10 minutes of my day. In retrospect, it was probably so we could safely be fired if necessary with our keys still accounted for.

masterof0 4y ago

In my first job, the company laid off 200 people, and they found out when they couldn't use their badge to enter the building. Corporations love to do that type of things.

shrimpx 4y ago

My first thought is that there could easily be a malicious actor within the not yet laid off employees who could now be actually incentivized to do their bad deed seeing clearly that they may get no notice when fired.

nemo44x 4y ago

Pretty standard to not let terminated employees hang around. It feels cold but it’s just the way it has to be. Sone places will even do this when an employee submits a resignation on good terms. Just a way for the company to cover themselves.

davewritescode 4y ago
This was a well known thing at a company I worked for that was involved with government work. If you were leaving for another industry the last 2 weeks were for finishing up work and saying goodbye to your coworkers. If you were leaving for a competitor you were walked out within an hour of submitting your resignation and promised your 2 weeks pay. It was so well known that engineers would schedule vacations starting the day after they planned to resign and say their goodbyes to coworkers before telling their bosses.
- q1w2 4y ago
  I usually terminate access immediately. It's just solid IT security practice. I've seen WAY too many cases of employees email forwarding documents to their personal email the moment they are told they're being let go. Before we started terminating access immediately, I'd estimate that roughly 25% of employees would email themselves at least something.
  - hhmc 4y ago
    What were they emailing themselves, IP?
    - q1w2 4y ago
      All sorts of things. Sometimes it's code or documentation/guides they wrote that they believe they're entitled to... Sometimes it's personal things they kept on their work computer/account.... Sometimes it's contact lists... Sometimes it's strategy docs they authored... Sometimes it's password files (which often mix personal and work creds). Sometimes it's whatever-they-can-think-of that might be of value on the share drive... It's just so incredibly common that I don't understand why any employer doesn't terminate access the instant someone is let go. When people they're in a state of stress just grab whatever they can think of.

dominotw 4y ago

very typical.

avrionov 4y ago

This is very typical. He is talking about cutting now former employees access to email, source code repositories, internal systems. It is done all the time. It looks very harsh.

heretogetout 4y ago
And if I were a customer, I'd be concerned if they didn't cut off access immediately.
- Rebelgecko 4y ago
  IMO it's concerning that they don't have more granular security controls than totally shutting down someone's access (or maybe they do, but they laid off the person who knows how to take access away from production systems without taking away someone's ability to read email)

vlozko 4y ago

I’m would say pretty common? Sometimes it happens to personal accounts if the user has access to sensitive data. For setups that aren’t as sensitive or groups of employees that don’t have access to such data, various systems may be locked down for a period. For example, access to source control or staging/production environments may be generally limited. For unexpected one-off firings, the user is often locked out before they’re aware they’ve been let go.

sen 4y ago

Common in lots of jobs. I’ve seen people get fired from Gov IT and F500 IT teams where they only find out they’re fired when they rock up to work and their pass doesn’t let them in. Security has their stuff in a box to give to them along with a letter explaining everything. To be fair, getting fired from those companies meant you actually did something wrong. There wasn’t these mass culls that crypto/startup type companies are famous for.

samwillis 4y ago

To be honest this is the more concerning thing in that quoted statement: > "Given the number of employees who have access to sensitive customer information" Surly they should have very very few employs that have access to that type of information?

eganist 4y ago
> Surly they should have very very few employs that have access to that type of information? It depends on the nature of the information. If we're talking anything that directly affects liquidity, I'd be surprised if that number was large. But if we're talking regulated or contractually protected consumer information (e.g PCI), that number's probably a bit bigger.
hourago 4y ago
You are completely right. Sensitive customer information should be only accessible as a per need basis. It's very bad practice, possibly illegal in many countries, to have free access to production customer data. It's also quite dangerous for a big company. Production databases should not be accessible by developers, logs should need enough to debug problems, and should be scrapped after some time. Metrics can be stored as long as needed, as should not contain personal data but just counters, averages, etc.
- SketchySeaBeast 4y ago
  A responsible company would consider "sensitive customer information" to be pretty much every bit of customer information - names, addresses, phone numbers, bank accounts. Maybe low-level developers won't have access to that but every member of the infrastructure and customer facing teams will in some fashion because it's 100% part of their job and odds are good that's the majority of the people in the company.
tinco 4y ago
As a teenager I worked an evening job at one of the largest banks in the world, processing mail-in credit card orders. I would sit at a computer, run an app that could query any bank account number, and I'd get their current balance (along with all other personal info). It was part of a series of checks I had to do to make sure they qualified for the credit card. One kid definitely got fired for querying data on persons they weren't supposed to query for. With work-from-home, I can imagine there's employees with all sorts of access. And with them being a startup, who knows how much controls they've got in place yet.

livinginfear 4y ago

Asking as a layman to macroeconomics, if you think that the current rash of crypto companies collapsing heralds a greater economic catastrophe, do you have any advice on how to best survive another dot-com style crash?

matwood 4y ago
Do whatever you have to in order to keep your job. Your investments may go up, down or sideways, prices of things might move around, but it's all secondary to keeping a job.
wutbrodo 4y ago
I'm also a layman, though one of my degrees is in economics, which tbh isn't that helpful here beyond understanding the fundamentals. My current working model is that there are multiple simultaneous effects, mostly separable but interrelated. In order of decreasing acuteness: a) asset bubble popping due to imminent rate increases. Crypto the obvious candidate for a correction that IMO was predictable? Future of the industry unpredictable (by me) b) Tech stock correction and hiring freeze, due to skyrocketing value growth and some overextension during the pandemic. This is a good thing, and a healthy pullback on very recent overestimate of value gains. Fundamentals largely unaffected c) More secular pullback of tech value into a lower equilibrium. High-growth stocks do well in historically low-rate environment, that we're potentially exiting d) General recession expected. Marginal tech startups wiped out, bigtech generally still a great place to get paid a ton and buy the market while it's low I'd love to hear if anyone has anyone else has any disagreements with my working model! I'm far from an expert, but using it for my own decision-making. Eg, I just quit my job, but I was planning to go back to bigtech so I'm not especially worried (plus I have tons of savings and frankly don't care about $ that much). OTOH, I'm not taking much time off, because I expect hiring and possibly salaries to start tightening even in bigtech.
deadbunny 4y ago
The same as in the good times. 1. Create a budget Know how much you spend per month, and what are essentials (Rent, Food, Transport etc.) and what can go if you really need to (Netflix, eating out, etc.) 2. Have 3-6 months expenses in an emergency fund Usually cash or things not likely to tank during a downturn like stock/crypto. You can find more helpful info here: https://old.reddit.com/r/personalfinance/wiki/commontopics https://old.reddit.com/r/personalfinance/wiki/commontopics

NikolaNovak 4y ago

Unfortunately it's common enough. It's harsh, it's cold, but ultimately for companies it's a real necessity. The explanation is blunt and correct - even a single malicious actor can enact HUGE devastating harm. It doesn't have to be hot wallet / cold storage. Source code, business plans, revenue & profit statements, SSH to servers, physical access to datacentre, client contact lists, etc etc... there's a myriad things that are either valuable to the company or can cause harm to the company. I've been escorted out of the building during a layoff once early in my career. Friendly, smiley, fake. It felt AWFUL. I'm as goody-two-shoes pacifist laid back easy going do-no-harm as it gets... and I definitely had various strong emotions going through my head heart and body at the time. So on both cold & rational, as well as personal & empathetic side, I understand both how the individuals feel as well as why companies need to do it.

UncleMeat 4y ago
> Friendly, smiley, fake. My father had to lay off a bunch of people in 2008. I am now a manager. He told me that if I am ever forced to do this to not ever do this crap to my team. Tell them that this is bullshit. Tell them that you are upset. Tell them that you haven't slept. Tell them that the are right to be mad, disappointed, and even to hate you for choosing their head to roll. Anything better than fake smiles and "I'm sure you'll land on your feet." For me, I think I'd just quit if I was told to lay off people on my team. Maybe that's hard to do in the moment, since I'd also not want to lose my job in a major crisis, but it sounds awful.
- dgfitz 4y ago
  Company I worked at had a layoff in 2012, security manager escorted 200 people out of the building. At the end of the day, he was escorted out of the building. It was quite shitty for that fellow, I felt terrible for him.
  - willcipriano 4y ago
    One place I worked at briefly would call the cops and have them escourt you out if they thought there was any risk of "disruption or back talk" (their words). I decided not to work for assholes who lay off little old ladies and then to add insult to injury, call the cops on them.

Y-bar 4y ago

Never heard this happen (Scandinavia) other than in the cases where an employee clearly breached laws or company policy. Standard procedure here is that you as a salaried employee will be guaranteed 1-2-3 months (depending on your contract) of notice. Edit with example: https://www.arbeidstilsynet.no/en/working-conditions/dismissal-with-notice/ https://www.arbeidstilsynet.no/en/working-conditions/dismiss... > An employee may usually remain in the post as long as negotiations or legal proceedings are in progress, provided the courts have not decided otherwise. > [...] > The employer may summarily dismiss an employee if he or she is guilty of a gross breach of duty or other serious breach of the contract of employment. The employee has no right to remain in his post while the matter is being considered, unless the court has decided otherwise.

Symbiote 4y ago
Being paid for 1-3 months is entirely independent of whether they want you in the office or not. In Britain it's called gardening leave, and it's common in finance and other jobs with tight security. You are paid, but you stay and home and do some gardening. (Or, more likely, look for a new job.)
- Y-bar 4y ago
  I work with online payment processor and early during the covid pandemic we had some layoffs. They were all notices of 1+ month and everyone of them continued to work for the majority of the notice period. Nobody had anything revoked early. I understand it happens, but it seems _way_ too common (reading the comments here) compared to what is actually necessary.
- samhw 4y ago
  Yeah, I worked at a UK bank and was given gardening leave even when I left to start a (somewhat orthogonal) competitor. Actually, they didn't even insist that I served out my leave before starting work. It's an odd system.
dundarious 4y ago
A decent amount of states in the US have “at-will employment” laws, meaning you can be fired for any reason (excluding specific things to do with “protected classes” like race, etc.), at any time, with immediate effect and without any notice. Similarly, this means you can quit your job at any time, with immediate effect and without any notice. If you quit, it’s only if you want to maintain reputation or relationships that you should work a notice period, but given the asymmetry of employer-employee power, that ends up being pretty common. For at-will employment, I don’t think there needs to be any severance package or mandatory weeks of pay, but I think it’s offered in many cases. Having said that, in finance (I used to work at a proprietary trading firm in an at-will state), it’s extremely common for firings to be immediate, e.g., arrive at work, boss calls you to office, get fired, badge taken and you’re walked out and your desk belongings are mailed to you later. More often, you’re walked to your desk to pick up your things instead of having them mailed out, but both happen. But even more often, people are “incentivized” through bad reviews and bad bonuses to quit in advance of a firing. When I quit, they didn’t want me to leave, and I negotiated a couple weeks of notice to hand over my responsibilities and knowledge, and to maintain some relationships. I had a non-compete in my original contract, so I would have to negotiate with the original firm as to whether they would enforce it. If so, I would receive gardening leave pay in order to delay my employment at a competing firm. That could be for as much as 2 years, and they would pay my base salary at the original firm in order for me to not start at the competition. This gardening leave is totally different than a severance package though.

kodah 4y ago

I've worked on security products as a SWE and as a SRE over critical systems, I've never seen this kind of behavior. This says a lot about the relationship Bryan and his team have with the people that work with them, imo. Edit: not sure what's up with the current iteration of the HN crowd, but downvote is not equal to "I disagree".

eganist 4y ago
It's as old as time. Or at least as old as the first few times mass layoffs and networked employee devices co-existed. https://www.nytimes.com/2001/03/21/jobs/laid-off-and-locked-out-of-your-pc.html https://www.nytimes.com/2001/03/21/jobs/laid-off-and-locked-...
- kodah 4y ago
  Some companies do it, sure, but I wouldn't call it normal or acceptable. In fact, it's kind sleezy.
  - eganist 4y ago
    Mass-scale layoffs it's almost guaranteed. When you're talking even a single percentage point of employees departing, it's more normal than you might expect. Some companies even do it after an employee submits notice on their end (paying through the end of the term but disabling access earlier than expected, or even immediately), though this is far less common.
    - kodah 4y ago
      You can keep saying it, but it doesn't make it more true or acceptable. Anyway, the current HN crowd has been disappointing lately, so time to take a break.
      - eganist 4y ago
        > You can keep saying it, but it doesn't make it more true or acceptable. We agree on whether it's acceptable, but let's be honest, any roles I've held in the past (and all security jobs around the world, really) exist only because people have a surprising potential to be absolutely crappy.