3 ms·

Or you're just not as experienced as you seem to think you are. > half the company had prod access to user accounts That's pretty normal depending on the size

Or you're just not as experienced as you seem to think you are. > half the company had prod access to user accounts That's pretty normal depending on the size of the company. The chances of that being true is pretty high if it's a smallish upstart with <50 employees. > I've never met any of these stereotypes in the real world, although people do disagree on what is enough. I've encountered several - they were all in the same company. It got so bad that multiple people quit and others were going to, until the people in question where "promoted" to a position where they weren't in the decision loop anymore.

MattPalmer1086 4y ago
I've worked in multiple sectors for nearly 2 decades: government, energy, transport, retail, finance and software. So I've got a pretty good read on what is a normal level of access. Very small companies and start ups I'd agree often don't have this kind of separation. But if they grow into one of the worlds biggest brands, I would not expect it to be run like a 50 man startup.
- 411111111111111 4y ago
  Eh, this kind of change usually needs something to go wrong before something is done. Lots of people get outraged when you take privileges from them, even if they probably never should've gotten them to begin with. It's also easy to loose track of your own bias. There is a strong selection bias in employment which makes it look as if all workplaces are similar, simply because a company is more likely to hire you if you've worked in a similarly run one before.
  - j0hnyl 4y ago
    But a lot has gone wrong at Twitter...
    - 411111111111111 4y ago
      Sure, but the argument was > For example, half the company had prod access to user accounts. And there was no way to find out who accessed what. This is not normal, it's a huge red flag. If that statement was qualified to only include fortune 500 companies I would've agreed with it being a red flag
      - pessimizer 4y ago
        Did you think they were referring to a company other than Twitter?
        411111111111111 4y ago
        Yes, the "that's not normal" made it quiet explicitly about the state of the industry in order to single out Twitter to be exceptionally bad in this regard. Which is true in the context of well run companies, but not on the average. The exceptionally bad ones have no authentication on databases readable to dog-and-world. That's the state of our industry where security is at best an afterthought. By that measure, Twitter is basically average. They give it some lip service and do as little as they can get away with.
sriram_malhar 4y ago
> That's pretty normal depending on the size of the company. Perhaps, as you yourself said, "you're just not as experienced as you seem to think you are". I have worked in startups and with large enterprises. There is not a _single_ place where any significant percentage had access to prod accounts. That would be a HUGE nono. I have no doubt it happens, but that's not normal.

MattPalmer1086 4y ago

I've worked in multiple sectors for nearly 2 decades: government, energy, transport, retail, finance and software. So I've got a pretty good read on what is a normal level of access. Very small companies and start ups I'd agree often don't have this kind of separation. But if they grow into one of the worlds biggest brands, I would not expect it to be run like a 50 man startup.

411111111111111 4y ago
Eh, this kind of change usually needs something to go wrong before something is done. Lots of people get outraged when you take privileges from them, even if they probably never should've gotten them to begin with. It's also easy to loose track of your own bias. There is a strong selection bias in employment which makes it look as if all workplaces are similar, simply because a company is more likely to hire you if you've worked in a similarly run one before.
- j0hnyl 4y ago
  But a lot has gone wrong at Twitter...
  - 411111111111111 4y ago
    Sure, but the argument was > For example, half the company had prod access to user accounts. And there was no way to find out who accessed what. This is not normal, it's a huge red flag. If that statement was qualified to only include fortune 500 companies I would've agreed with it being a red flag
    - pessimizer 4y ago
      Did you think they were referring to a company other than Twitter?
      - 411111111111111 4y ago
        Yes, the "that's not normal" made it quiet explicitly about the state of the industry in order to single out Twitter to be exceptionally bad in this regard. Which is true in the context of well run companies, but not on the average. The exceptionally bad ones have no authentication on databases readable to dog-and-world. That's the state of our industry where security is at best an afterthought. By that measure, Twitter is basically average. They give it some lip service and do as little as they can get away with.

sriram_malhar 4y ago

> That's pretty normal depending on the size of the company. Perhaps, as you yourself said, "you're just not as experienced as you seem to think you are". I have worked in startups and with large enterprises. There is not a _single_ place where any significant percentage had access to prod accounts. That would be a HUGE nono. I have no doubt it happens, but that's not normal.