22 ms·

Maybe you should store passwords in plaintext

177 points by qword 4y ago

throwawaysleep 4y ago
I am basically that employee in several ways. I know about wasteful cloud spend that I do nothing about. My last comment on HN actually was asking if anyone could give me a reason to report that cloud waste. The best arguments were for the sake of the environment and to build credibility with co-workers to make it easier to jump ship. Nothing from the company at all. I can't say I deliberately ship bugs, but I don't care that much about eliminating them. If I were not worried about legal issues, I would investigate whether we had a bug bounty program and give them to a friend to collect and split the prize. And yes, I use the same password at my multiple full time jobs. If you knew my email, you could find that password in a password leak on the internet. So my password has already leaked. It is out there, tied to my name. > This group of people seem to have been like that at some point in time, and then turned to “misbehaving” in this manner. I was like that. I like creating stuff. I like building great experiences. But working as a corporate employee is an extra painful way to do it in many cases. I enjoy finding weird bugs and figuring out the fixes. But everything from the Scrum to the layoffs to the executives trying to drag you in for corporate team building events to the non-technicals who don't have a clue what you do makes it not worth it to engage at work. The project you care about will be carelessly tossed away in a reorg. You will be judged based on output report from Jira, which is actually an incentive to ship as many bugs as possible because that increases the number of Scrum points you have done. Is that really what you want for your life? Sounds miserable to me. I want out. And I do all those things to get out as soon as possible. So what is the endgame? Spend time working on cool things myself while doing all I can to minimize time work takes from my life. Cut every corner to save effort, from the passwords to the utter eradication of any speck of initiative. Work multiple full time jobs to accelerate progress to retirement and slash output at those jobs to make way to even more jobs, further accelerating my workforce exit.
- kiratp 4y ago
  For nothing else than the sake of “life is about the journey”, please consider changing your job. It is absolutely possible to align paid employment with fulfillment.
  - pierat 3y ago
    I've heard people bandy that trusim my whole life. And I find that for like 99% of us, it's just false. Or, you do find your 'dream job', and pays $17/hr no benefits, cause it's a non-profit. (Aside: I've never dreamed of work. Not once. I like keeping the surplus of my labor.) What I want to do is to build new stuff, and greenfield. Basically, it'd be a R&D variant, but most of those jobs don't even exist. It's a cost center, and the C levels equate it to corporate gambling. There's working at a national lab, or NASA, or similar. And most of those are clearance jobs that nobody, save a few, will ever see come to light of day. I'll just choose a mundane, paying well job, and on the sly automate. Ideally, I'll get good money and have 10-15h work a week, and regained time. Basically doubles my effective wage.
- gammabetadelta 4y ago
  we all play games if your game let's you do this without guilt then good on you but, maybe there's a better route than escape... turn work into something worth doing
- tsukikage 4y ago
  If your employer doesn't reward its employees for doing things that benefit the bottom line, it's perhaps time to look for another employer.
  - geraldwhen 4y ago
    You’re replying to someone who claims to be working multiple full time roles. What employee rewards effort with multiples of your total comp? None, to my knowledge.
  - Gigachad 4y ago
    Or maybe the company has identified that their bottom line would be improved more by working on other things rather than the relatively small cloud waste.
- DougN7 4y ago
  I’m hanging onto this post for the next time I see people on their high horse about integrity among engineers. The fact is, some people have it and some don’t, regardless of job. This makes me sad. Economically it makes sense, but it’s a sign of the sickness in our modern society. Everyone looking out for themselves first without much thought to the community around them. I say this having been burned by employees like this (that did maybe, maybe, an hour’s worth of remote work per day). Maybe it all boils down to “this is why we can’t have nice things”.
  - deleted 4y ago
    [deleted]
  - gryn 4y ago
    > Everyone looking out for themselves yes, including/especially employers. maybe (or not) these employee started doing this after been burned by their employers before. the very same that talk about the community, greater good, and being in it together but suddenly change speech when they're on the benefiting side. I've been on both side of the equation so I understand. I also have acquaintances that were too, they used to behave the same way as mentioned in the article but once they had their own company started talking the same way you do, suddenly what was acceptable for them to do is unimaginable and unacceptable behavior for other people to do. that society should not have such things. not because they changed their opinions but because their incentives are what changed, so if they go back to their previous position so would their attitude. at the end of the day, the reason people work is not because they want to, it's because they have to in order to get what they want. wanting to have employees that go above and beyond, are the most productive, the most knowledgeable, most skilled, and accept the least pay is what best for you when you're the employer. but when you play in the other camp it's the reverse: the best job is the one that demand the least out of you for the most pay. the payoff functions for the different actors roles are the not same, trying to appeal to a sense of shame, duty or merit is just a way for one actor to hijack another's perception of the game for their own benefit.
    - DougN7 4y ago
      Totally agree with almost everything you say. But there are lines both sides should not cross. For employers it’s exploitation (don’t expect unpaid work) and for employees it’s theft (don’t take pay for no work). If we can’t agree on that then we’re headed for a break down in society.
- eternalban 4y ago
  Work Attitudes and Work Organization in the Soviet Union (date unknown - ? 1985) [re-formatted] "Over the past two decades there is abundant evidence of Soviet concerns with the problems of job dissatisfaction and poor work morale. The evidence appears in a score of sociological studies of work attitudes and in the more "popular" periodical literature on labor problems. The kind of work discontent which is apparent, however, does not appear to be potentially "explosive" in nature. It manifests itself chiefly in - indifferent job performance, - poor work discipline, and - high rates of job instability. Job dissatisfaction is not confined to any one sector of the work force, but the discontent of relatively highly educated young workers in routine, low skilled jobs has been particularly troublesome. Continuing problems of poor work morale and lackadaisical job performance have elicited Soviet interest in Western experiments in work re-organization (work "enrichment"programs, job rotation, autonomous work teams), and initial steps have been taken to introduce a modest Soviet version of the "humanization of work". The urgency of mobilizing disciplined work commitment becomes all the more pressing as the Soviets enter a period of intensifying labor scarcity, in which economic growth becomes increasingly dependent on the growth of labor productivity rather than on additions to the work force" https://www.ucis.pitt.edu/nceeer/0000-625-7-Yanowitch.pdf https://www.ucis.pitt.edu/nceeer/0000-625-7-Yanowitch.pdf - OP > "Now, I would personally feel shame if I did these things". The Ideal Communist Worker Within a communist society, people are expected to act in the interest of the Communist Party and the majority of society. Specifically, the individual is expected to work and act to promote the betterment of the community. Chairman Mao Zedong elaborates, “At no time and in no circumstances should a Communist place his personal interests first; he should subordinate to the interests of the nation and the masses. Hence selfishness, slacking, corruption, seeking the limelight are most contemptible, while ... working with all one’s energy, whole hearted devotion to public duty, and quiet hard work will command respect.” Hence, communists are expected to work diligently and thoughtfully in order to ensure he or she provides the most benefit to society. As a result, any worker in the computer field is expected to manufacture computer products without the wish for acknowledgment or excessive monetary reward. https://cs.stanford.edu/people/eroberts/cs201/projects/communism-computing-china/workethic.html https://cs.stanford.edu/people/eroberts/cs201/projects/commu... But u/throwawaysleep, at least take heart that scrum sessions (so far) do not entail 'self criticism' sessions.
- hsbauauvhabzb 4y ago
  Sure would be funny if you were tossed under the bus for blatantly reducing the security of your org by using a previously compromised password. Bug bounty integrity isn’t the only issue that could land you in legal trouble.
fideloper 4y ago
There’s no black or white here. You’ll be on both sides of this depending on your phase of life and the incentive structure at work.
Nihilartikel 4y ago
Reading things like this reinforces the satisfaction of being independent... When I inevitably notice these issues in the course of work for a client I can bring them up with the one writing the checks.. if they want it fixed, I fix it. If they don't, well there are other clients.
RobotToaster 4y ago
In some ways it seems related to Goodhart's law "When a measure becomes a target, it ceases to be a good measure" https://en.wikipedia.org/wiki/Goodhart%27s_law https://en.wikipedia.org/wiki/Goodhart%27s_law
joseph_grobbles 4y ago
Horribly cynical, and I can't imagine having that viewpoint. It's actually fascinating how the author first justifies that sort of malaise, and then does the "but of course not me" thing. Even if someone were that self-focused, in almost any group or organization, critical security vulnerabilities and significant costs do hurt everyone in the group. You're going to be the ones having the rough time when expenses exceed value, and when major embarrassments happen. There is no insulation from it.
- d23 4y ago
  I'm confused as to how you felt the author is justifying it: > Now, I would personally feel shame if I did these things. They seem more interested in trying to find a solution to it. Or just posing it as a legitimate problem, the solution to which is food for thought.
ALittleLight 4y ago
I disagree with the author that normal people don't think this way. Most people I know won't go out of their way to help their employer. In my experience you can usually find a few people who care about doing things right and they work hard, are passionate, go above and beyond, etc. Almost everyone else is in a different lane. Some are in the far right lane, where they cleverly exploiting things (as a few people mentioned in the article) but most are somewhere in between. I don't think there is really anything you could do about it. Mostly people don't want to work. They do work for money. They won't do more work than they need to because they don't want to do that. These people also don't want to expend more energy than they have to. They won't do something hard that solves the problem if doing something easy won't get them in too much trouble.
- SoftTalker 4y ago
  I can't remember the comedian but there was a joke I heard that really hit this home: People don't get paid because they like their work. They get paid because they don't like their work.
shric 4y ago
“You don’t get rewarded for being extra. You don’t get any money when you save costs. You’re going to get a raise below inflation. You’re stupid for caring the way that you do. The business’ downside risk is not yours, and it’s profits are not yours either.” Except when you're granted RSUs or participate in some private company's profit sharing scheme. So if that's important to you, find such a place. The smaller the company, the more impact you can have on their profits.
- SoftTalker 4y ago
  Typically those equity schemes will amount to nothing for most employees at small companies. They're a little better than buying a lottery ticket every week.
- flangola7 4y ago
  The business downsides are your problem though. Nobody gets a raise if the company makes great profits, but if it is making weak profits you're going to get a pay cut or be laid off. Maybe there was a time when this was not the case, but it was not during my lifetime.
- evilspammer 4y ago
  The smaller companies are probably not IPOed so the stock has no actual value
- pierat 4y ago
  > You don’t get rewarded for being extra. 100% true. Our salary, barring real (not manufactured) fires, should be for 40h/week. Any more is free work not compensated for. > You don’t get any money when you save costs. There is no equity for doing significant tasks. The common area here is automation. I automate, but don't share. I would never get compensated appropriately, so I save my time in lieu of money. > You’re going to get a raise below inflation. Yep, 3%. Job hoppers get 30% or more. My last hop was 115%. Loyalty is NOT rewarded. > You’re stupid for caring the way that you do. That's a subjective assessment. But yeah, caring too much leads to extreme burnout. And our only real change is to find yet another slaver, oh I mean capitalist to work for. > The business’ downside risk is not yours, and it’s profits are not yours either. Exactly. Start providing real equity, and a seat at the board of directors as an 'emoloyee's director'. Aside that, we're just resources to be strip-mined at 'human resources'. At least we can choose our slaver as a guise of an "interview". And RSU's are a game, that we lose. The companies made this, and they do NOT want to pay. So they gamify it to make the appearance of mounds of money. Here's your pennies.
SoftTalker 4y ago
My eyes really opened to this during the pandemic and its aftermath. Working from home I did almost nothing productive. Got paid the same. Returning to the office, I noticed half the people still seemed to be working from home most days, so I started doing that too. And did almost nothing productive. Nobody apparently noticed or cared. Got paid the same. Got the same raise (yes, below inflation). So now I have given myself a >4x raise by working about 10 hours a week of real work (and that's a high estimate). I work on whatever tasks are currently on the radar, do the least amount necessary, and ignore everything else. I get paid the same.
- nobrains 4y ago
  This just means that your line manager, whose role it is to ensure all resources under them are working at efficient capacity, is not doing his/her job. And in turn neither is his manager.
  - geraldwhen 4y ago
    The goal of a manager or worker isn’t to be efficient, it’s to produce value. I suspect the diminishing returns of effort at most companies is astonishingly high. I would much rather a developer work 10 hours and accomplish what needs to get done than work 40 and negatively impact the business.
    - paulcole 4y ago
      > I would much rather a developer work 10 hours and accomplish what needs to get done than work 40 and negatively impact the business. It feels like there is a third option here that I can’t quite put my finger on.
      - em-bee 4y ago
        i see two additional options. one is, find something else to do that actually benefits the company. that only works if the climate in the company supports that. the other is to reduce the size of the team because apparently so many people are not needed to get all the work done.
andrewmcwatters 4y ago
I agree with Nihilartikel’s comment. It’s nice when you’re the one doing business development. But as a manager at any organization, the correct answer is to fire people like this because they become insidious and take over your business. Have a moral backbone. Is it fair? No. Lots of corporate decision making will never ever be fair. Deal with it, or work with these people. Find ways to financially incentivize morally correct behavior and exceptional engineering. The latter is important because good people leave and they’re literally worth more than your other employees. Oh and by the way, they’re disgusting to work with, and regardless of your moral compass they will make you a worse engineer. I worked with these types of people at my last job. One guy didn’t know how to fork a repo and maintain an internal copy of a project with clean portable diffs. The other was afraid of regular expressions and didn’t understand libc versioning. Losers behave like losers.
- andrewmcwatters 4y ago
  As an addendum, you don’t need to kill yourself over your job. Just do what’s asked of you. But you don’t need to be a parasite either. It’s disgusting and you WILL be remembered for it years later.
  - throwawaysleep 4y ago
    I won’t be at my employer years later, so why does it matter? Max of 4 years to cash out the stock.
    - gammabetadelta 4y ago
      one has to have honor for themselves you may win the FIRE game but you've cost yourself the chance to be something you respect
      - skeaker 4y ago
        This line of thought shows a fundamental difference in perception. To a lot of people, working a 9 to 5 will never make you respectable no matter what it is you're actually doing. These people work to live, whereas your stance is that of someone who lives to work. I don't care how the company remembers me after I've retired and never have to give them so much as a spare thought. I have a whole life ahead of me that I intend to live without having their massive black hole of time waste looming over me.
buran77 4y ago
#3 (mediocre work after an effective pay cut) doesn't sound at all unreasonable. In effect those people are getting a pay cut and decided that investing effort to be "top-notch" is not justified. They're doing a mediocre job - by definition middle, not low quality. The author tries to paint this in a very bad light but I think this is a mentality of "it's bad because someone else does it". For some of those people the issue is not financial but one of respect. A little spit in their eye is still spit in their eye. What's a reasonable amount to cut from an agreed payment while still expecting top notch quality? How much does the author like to give up in such conditions?
- RobotToaster 4y ago
  Exactly, if you give someone a cut in pay, why shouldn't they give you a cut in effort?
ajhurliman 4y ago
I can’t speak for others, but for myself it’s next to impossible to live a good life while working a job where I sink into a “plaintext passwords” type of mindset. That being said, I don’t really envy that mindset, I suspect there’s something fundamentally broken about a mind that’s resigned to treating a supposedly symbiotic relationship as adversarial, even though it may be a warranted reaction given how so many companies treat their employees.
- j_crick 4y ago
  You’d be surprised at the amount of people in, say, Europe, who don’t identify with their daytime jobs in the ways some Americans do. The mindset I’m talking about is something along the line of that there’s actual life outside work, and your job is used to pay for it, and that’s about it. In some societies it can be even perceived as rude and selfish if you’re trying to push and be competitive.
  - toonalfrink 4y ago
    European here. I'm honestly shocked to find out that there's anything else than the "work for money so you can live" mindset. Unless you have equity or it's a charity, of course.
    - unmole 3y ago
      You're shocked to find out that pride in craftsmanship exists?
kapp_in_life 4y ago
The incentive to not act like the slackers is how it impacts your "network". It's pretty insufferable to work with these people, when the success of your project depends on them or their team for whatever reason. If our team is hiring and I see a former coworker got laid off who was a slacker I won't put in a referral for them. I guess it won't impact them much, because tech is still growing and demand exceeds supply, but at least it will keep my work slightly more enjoyable. A job well done is it's own reward.
- selcuka 4y ago
  From the article: > [they] say their new goal is to be “perfectly mediocre.” Note that mediocre is not the same as slacker. It is impossible to distinguish a genuinely mediocre developer from an intentionally mediocre one, so no, it won't impact their network unless they are really careless and tell everyone that they can in fact perform better. Do you stop talking to a colleague because they have never found a security vulnerability and fixed it?
  - kapp_in_life 4y ago
    The 4 case examples in the article are absolutely slackers. Not mentioning a 6 figure cloud inefficiency, or knowingly shipping bugs, or leaving 100's of diffs for compiler warnings and not publishing them. You're right about not being able to tell a genuinely mediocre developer from an intentionally mediocre one... unless they tell on themselves like the above did. >Do you stop talking to a colleague because they have never found a security vulnerability and fixed it? This feels like a reach? Obviously not, I'm perfectly cordial to everyone I work with. If they find a security vulnerability, and don't fix or even bother reporting it then I'll obviously think less of them and probably not give them a referral. But I'd never hold it against someone for not identifying one or accidentally shipping one.
    - selcuka 4y ago
      > This feels like a reach? Obviously not, I'm perfectly cordial to everyone I work with. Sorry if you were offended, but I didn't mean that you do. Nobody does. That was a rhetorical question to emphasise my point.
majormajor 4y ago
The movie Office Space is about this exact problem. Why go above and beyond the bare minimum when management doesn't care? (And then is so oblivious that they fire some of the hardest workers?) I'm personally the sort who gets frustrated when there isn't enough to do or when it's clear other people on the team aren't carrying their weight, but I can't say I blame the "why try harder than I have to" crowd, but I try to avoid companies with that culture. I've seen some companies avoid it by trying to punish and fire people to ensure a 'minimum quality bar'. That works better than letting obvious negligence slide, probably, but still isn't particularly motivating to go above and beyond. The "pay well but make it understood that you're paying for quality" method is way better as long as you still keep a close eye on that quality and it doesn't just turn into "pay well and screw around" (it's not hard to find stories of this in FAANGs in the past decade).
furyofantares 4y ago
Good security practices are in this unfortunate category where: 1) The actual risk calculation is somewhat nuanced, but advocates are very clearly on the right side when you do it. 2) The advocates drastically oversell it as a coping mechanism for it being hard to convey nuanced issues, and even come to believe their overselling. 3) Some who go along at first gradually gain some intuition that they've been lied to, and wrongly conclude or begin to behave as if the advocates are on the wrong side. In the case of storing passwords in plaintext, it causes a low probability increase in chance of a some very bad outcomes. It can be correct that it's well worth mitigating, while also being a hard calculation to reason about and find salient. If we compensate by treating it as if it's a high probability event in order to get everyone t comply, and begin to believe it ourselves, people may eventually notice that not everyone is compliant, but they never see anything bad happen in their immediate surroundings, become increasingly lax themselves, notice nothing bad is happening still, etc. Seatbelts are maybe a counterexample to my point here, where people have come around despite their personal experience never including an accident. Maybe with the help of laws, or maybe more because it's personal risk to self. Or maybe it's just that enough people know someone who has had a bad car accident even if they haven't themselves.
jerrygenser 4y ago
Sorry this isn't the purpose of the original article, but does anyone want to give a way secrete should be stored? Even if I use secrets manager for example, I need to store the token for fetching it so there is always a secret or token that needs to be stored. I might not store an access token, I might use user auth and get a temporary token for a script that then calls to a secret manager. The access token is cached locally in plain text. Is tbis more secure since it's a token with expiry?
- megous 4y ago
  First, you need to ask yourself what you're trying to protect the secret against. Then you can figure out some reasonable mechanism to do it. There's no single proper way. You can't always go with "maximum" protection for everything, because then you'll be doing multiparty ceremonies all the time and it would be mighty impractical https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/ https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/
- scott00 4y ago
  Your guess is correct, the expiration is what adds the security. The main security need this is addressing is terminating access to ex-employees/contractors given a requirement for shared credentials. If the shared credentials are not short term, you have to rotate credentials every time the team changes. If you don't have a system to do it automatically it's pretty easy to forget to do it or do it incompletely. So better just to do it very frequently and automatically so you don't even need to bother with a revocation process. You might be thinking that you don't have any shared credentials, but effectively any credential that a server has access to is shared, because there's almost certainly at least two people with access to any given server.
- hsbauauvhabzb 4y ago
  I’m personally not a huge fan of expiry - if your key is compromised within its lifetime, it can be compromised again, attack complexity increases but is not mitigated and requires a bunch more effort (refreshing, graceful fail logic, etc). Windows implements DPAPI, which is used to encrypt stored secrets on disk keyed with the users password sha1’d (and previous sha1 keys encrypted with the newest password). That way a file system compromise isnt a password compromise, at least directly. More hardcore is hardware based modules, TPM and yubikeys are in this space, they use pub/private keys so the secret is no longer pre shared. Other hardware security modules also exist which are more full fledged. The former ultimately guarantee authentication but not session security, the latter can potentially do both afaik.
ripplefringe 4y ago
Something that I feel like I disagree with here is that it doesn't take into account all the intangibles that you get from working hard. Personally I work hard and I feel like I get: * Appreciation from my manager and team, who I respect and love working with. * New knowledge that I can use later, and possibly build trust with others. * Influence that I can use later * The good feeling knowing I solved a problem for my business and hopefully letting them spend that money or effort elsewhere. * Some sense of job security This is probably a very Pollyanna view of the world, and maybe it's all because I have a good team and manager. But nevertheless, I feel like I hit the lottery as a programmer. It's enjoyable, the work changes day-to-day and it pays well.
cardanome 4y ago
It really depends where you work, you role and what the incentives are. You are young and working in a small startup with revenue share? Yeah, go wild and try to leave your mark! Just avoid getting burned out! Boring corporate job and have family to feed? Don't rock the boat. Though generally, don't. Best case you will make other people richer. Worst case is it backfires and you get more work assigned. If you want to advance your career, work on your social skills. If people like you they will automatically rate your job performance highly. Conversely your programming skills are pretty worthless if nobody wants to work with you. Might be cynical but that is how it works.
HL33tibCe7 4y ago
I can’t even imagine how crushingly depressing it must be to spend 50% of your waking hours working with this kind of attitude
emptysea 4y ago
The quote at the end of the article really sums up my feelings: > “I think the real answer, the real answer […] this is going to sound weird or bad – is to cajole or trick your employees into thinking that what they’re doing is important.” Basically I like to fix things at work because I get some sense of satisfaction by doing things the "right way". Of course this feeling can be worn down, other coworkers not caring, management not caring, etc. And then you end up in a "work to the contract" mentality, which is what the "store your passwords in plaintext" people seem to be doing
- piaste 4y ago
  It could be improved into "make sure your employees enjoy their work". Working at the same companies, the quality of my code varied wildly based on how enjoyable that particular project was. Not just the task itself, but also whether the deadlines were reasonable, the stakeholders were nice to talk to (or the PM kept them away from me if they weren't), etc. Of course, sometimes you will have some flat-out unpleasant work that needs to be done anyway. In that case, boosting the employee's ego is the only away they are going to get any satisfaction out of putting effort into the task. But it should be a last resort, not the default.
d23 4y ago
Great article. Sums up what I've observed over my entire career. Incentives are orthogonal at best to what is actually good for the company, and at times, doing things that actively harm the company can be the way up the ladder. We're worse than bad at measuring and rewarding good performance.
- electromech 4y ago
  Right! Other commenters here seem to have interpreted the article backwards. How I read it: caring and working hard can get you punished; taking the safe and easy path can get you rewarded. Sadly, that lines up with my experience. Although I still love the work (the real work) I hate The Game® more and more every year.
JoshuaEN 4y ago
"Not being rewarded with money seems to be the common theme here, but financial incentives are tricky to get correct" Giving pay raises which exceed inflation for someone who meets expectations (in anonymous peer reviews) is tricky? Ensuring expectation meeting employees pay stays in line with market rates--when the company knows the market rate because they are hiring new employees--is tricky? Even if one argues it is not possible to accurately measure performance (or to get honest reviews from peers), punishing everyone because some employees may be underperforming is clearly not the solution (it will only serve to demotivate or drive away previously motivated and happy employees). And to be clear, reasonable pay raises is not a solution to all of the problems the article is talking about, but it's a simple place to start.
pjscott 4y ago
In healthier workplace cultures, this kind of don't-give-a-shit behavior is socially stigmatized, while behaving like someone who wants to do things right is socially rewarded. It's easy to forget, but not all incentives are measured in dollars. I'm not trying to go full Confucius here, but people who do better work than they have to shouldn't be made to feel like chumps by the people around them. They should get respect, so they feel good for doing good things.
xiaodai 4y ago
I am a chump. I've SEEN passwords in plaintext and I even tried to remove it by figuring out how to remove it from git histories. Heck, for one of those where it was not possible to get rid of plaintext due to the architecture, I even wrote some code to compare hashes instead of password so at least the attacker would need a rainbow table to crack it. Didn't bother salting it, since there's only one user effectively. But meh. Life of a chump, ain't getting no promotion and got the lowest possible bonus last year. It's better to be a chump cos I can feel better about myself
- LargeTomato 4y ago
  I cost my company over a million dollars because I was lazy and spiteful. I made an L+1 hop to a competitor and now I make more money for less hours and I'm learning a ton.
- orwin 4y ago
  The best way is to change the password in the environments, and let it in the commit history. It's both the easiest and the correct way. And if you can't, your company have to change its architecture.
LargeTomato 4y ago
I've done the AWS thing. We spent over $1 million on AWS and I couldn't be bothered to care. We were in eternal crunch mode, 10-14 hour days for 6 months. If I spoke up about AWS waste I'd get ripped apart by upper management. Eventually it became apparent what was going on. I was pushed out and went to a competitor who paid me more and had better hours. I gave that competitor a lot of information about the previous company and transfered a lot of my knowledge. I delivered quite a bit of value rather quickly because of that and was recognized and rewarded for it. We work in an enormous industry. It doesn't seem like there are any consequences.
RangerScience 4y ago
> Is there some way to correct this? How do you reward good behaviour here, and discourage “misbehavior” like this? …Yes? As the employer, find ways to be as generous and rewarding as possible. In immortal other words, “Fuck uou pay me.” Every example provided was “I went above and beyond and was not rewarded for it.” The fix is rewarding people for it.
- NoZebra120vClip 4y ago
  Yeah but as the Dilbert comic at the end demonstrates, offering rewards for good behavior leads to perverse incentives. So wcyd?
  - RangerScience 3y ago
    https://strongfemaleprotagonist.com/issue-6/page-125-2/ https://strongfemaleprotagonist.com/issue-6/page-125-2/ > "The lie of the slope is the implication that we have ever been or could ever be on level ground." https://en.wikipedia.org/wiki/God_Emperor_of_Dune https://en.wikipedia.org/wiki/God_Emperor_of_Dune > What do [thinking] machines really do? They increase the number of things we can do without thinking. Things we do without thinking-there's the real danger. Your workplace has an incentive structure (probably a complex one, made up of monetary, social, etc factors). That structure is akin to a machine. That machine should aide you - as an IC, it should aide you in doing quality work in alignment with business needs; as a manager, in motivating and coordinating your ICs. It shouldn't do it _instead_ of you. The idea that you can't add rewards for good behavior _because_ it will result in perverse incentives is, IMHO, akin to thinking you can't add code to the product because it'll result in bugs. So what can you do? Engage with your people, be generous with them; be generous with rewards and praise and all the good things when they do well; be generous with forgiveness, coaching, and teaching when they do poorly, and be generous with your time and involvement. Do your own thinking - don't have the machine-that-is-the-corporation do it for you, because it's full of bugs and always has been. Be engaged so that you can adjust as things play out.
deleted 4y ago
[deleted]
Runepika 4y ago
[dead]
justsomehnguy 4y ago
>> "They pretend to pay and we pretend to work" I have a monitoring instance which monitors a couple of URLs of some client. Every now and then something is wrong somewhere and it's spams the messenger with 'not available'. In a minute it spams again, now with 'Resolved' status. I can just turn the trigger time to two minutes or change it to trigger only after a two/three consecutive failed checks... But should I? Not only it wouldn't change how much I receive for this service (a pint of Guinness/mo, really), but it also would make it look like the monitoring isn't monitoring. I don't want to make proofs what it's actually working. Bonus point: if I receive the alerts I know what the monitoring works. And to the TFA: I made a proper VPN network for a client a decade ago: a VPN concentrator, dual path through two ISPs to the main office with the on-premise services, 15+ branches in the city, a couple of remote ones. Except I didn't buy Cisco gear, but some, ugh, not quite enterprise gear running FOSS solutions. Did I got anything from it? OFC no.
out-of-ideas 4y ago
There are people like this everywhere; the lack of overall caring has been happening, i'd argue, for quite some time. From physical construction to tech jobs; people want to get the job done (and cut whatever corners as they can), to get paid and move onto the next job. Can we really be surprised? Take a good look at any part of any construction that goes on, from the concrete to the finishing paint jobs and I'm confident the more you look the more you will realize folks either do not pay attention to detail, or they simply do not care. It goes deep into all corporations, especially when buisness-is-booming; gotta move onto the next client to get more cash! The same can be said for what items we consumers get as well; Apple selling laptops where the cords turn yellow, plastic freys and expose wires after 8 months of use; Samsung has similar issues, and the list goes on. Now take a look at the products spammed at us via Amazon; searching is abysmal (search for an audio cable, get results for usb cables instead). Want to check the quality of an item? Better order it and return it later when you figure out it is trash. Long dead are the (deparement?)stores/(big?)corporations/people that had at least some caring about others. What was once normal is shifting, and it has been for years. I am curious if the dude writing the article did raise up said concerns of fellow employees to their (respective?) boss(es); essentially if management does not prioritize caring is said issues, why would the lowers care about it?
kuahyeow 4y ago
Maybe there's engineers / developers working like this. Most likely it's a reflection of company culture. But there are real-world repercussions of just plain bad working practices * https://www.abc.net.au/news/2023-03-27/whats-happening-with-the-latitude-financial-cyber-attack/102151164 https://www.abc.net.au/news/2023-03-27/whats-happening-with-... It's not as bad as a bridge falling down, but this is why there's professional bodies and code of ethics in certain professions.
blacksoil 4y ago
I think personally it's important for people to realize that people are creature of habit. A person who has the disicipline of going extra miles and strive for excellency in their work, regardless of compensation, is likely to carry his habit across different jobs or even when he decides to do his own startup or anything non-work related. I think this is such a good habit to have will prove beneficial sooner or later. A lot of people think they will just work hard and do their best whem they need to, and take it easy for now at a corporate job. Personally I don't think work-ethics can be switched that easily, it has to be built.
- MattPalmer1086 4y ago
  I remember a story I was told at school that made an impression on me. A stone carver was making gargoyles for a cathedral. His apprentice noticed him carefully carving the back of them. The apprentice asked why he was doing that, since no-one would ever see the back or know. "I will know", replied the carver. Now, that is not an argument for doing unnecessary work. I saw it as an argument for taking pride in the work you did, even if you would be the only person who knows.
throwaway752809 4y ago
I worked for a startup from 2015 to 2022. From 2015 to 2020, it was great. I (and most other employees) was working hard, and was consistently rewarded for my efforts. In 2021, the company benefited from a huge boost due to the pandemic. Hiring went through the roof and the company became very performance focused. Unfortunately "performance" now meant "meeting your OKRs" and nothing else. The company culture went through the drain. Most of the new hires were from FAANG and knew very well how to play the game. Whereas before, if you asked someone for help, they would help you, now the answer became "file a run ticket". After all, why would you spend time helping anyone? That's time not spent on your own OKRs, and that's literally the only thing that matters. Nevertheless, I kept working hard. I was involved in multiple company initiatives, mentored new hires, still helped people when they asked for help, etc. After a year, when performance review time came, I got a "meets expectations". I was livid, and asked my manager how that could be possible. He basically told me that he had no visibility into all the non-team initiatives I was involved in, and that it was my own fault for not making myself more visible and drafting my OKRs in a way that would have allowed him to justify why I deserved more than "meets expectations". I refused to play the game and told my manager I was sure I could get "meets expectations" by doing a lot less. I basically slammed the door on all the side initiatives I was involved in and stopped doing anything besides "core work". I went from working 50+ hours a week to working 25-30 hours. I did not enjoy it -- I was actively miserable, and started taking steps to move on. It took me nearly a year to leave the company (I was on a visa that did not allow me to switch jobs so had to obtain an H-1B, which took time). Another perf review came by, and lo and behold, I got "meets expectations" again. I am so much happier in my new job, but I'm still salty about the previous company. What used to be a great company culture became a toxic, political, gamed environment. (Oh, and of course they had a huge layoff round a few months ago. But hey, at least leadership "took responsibility" for overhiring.)
atlantic 4y ago
> Another person simply doesn’t care about shipping code with bugs, and maybe even tries to. They get to shirk actual development duties by fixing their own broken code instead, and the fixes are celebrated. In one of the companies where I work, there is a chronic lack of hours for a few freelancers who were taken on with promises of full-time work. They compensate by shipping code with bugs, generating a bunch of bug reports down the line. This compensates for the missing hours. And as performance is evaluated in terms of the number of tickets closed, it also improves their standing in the workplace.
taylodl 4y ago
Yes, bad management exists. That's the #1 reason people cite for leaving companies. The problem is when you allow bad management to not care for your craft. If you find yourself copping the attitude of screw it, I get paid the same - then it's time for you to move on. Over time that attitude will rot you from the inside out.
bigattichouse 4y ago
Ownership. This is literally why the employees should own the company, or at least get significant ownership in terms of stock. In every one of these cases, especially the AWS waste case, an employee with ownership in the company could see a direct monetary benefit from fixing the problem, especially at a small company.
sallygretel 3y ago
[dead]
npteljes 3y ago
The way I go about it is that when I find it, I raise it politely, I offer to drive the fix, and then I add it to my resume, and then I tour with it, being "The Guy Who Fixes Things". That way I do get something, even if I'm completely detached from the original thing.
aredox 3y ago
"cajole or trick your employees into thinking that what they’re doing is important" Relevant Subnormality Comix: https://viruscomix.com/page477.html https://viruscomix.com/page477.html

177 points by qword 4y ago

I am basically that employee in several ways. I know about wasteful cloud spend that I do nothing about. My last comment on HN actually was asking if anyone could give me a reason to report that cloud waste. The best arguments were for the sake of the environment and to build credibility with co-workers to make it easier to jump ship. Nothing from the company at all. I can't say I deliberately ship bugs, but I don't care that much about eliminating them. If I were not worried about legal issues, I would investigate whether we had a bug bounty program and give them to a friend to collect and split the prize. And yes, I use the same password at my multiple full time jobs. If you knew my email, you could find that password in a password leak on the internet. So my password has already leaked. It is out there, tied to my name. > This group of people seem to have been like that at some point in time, and then turned to “misbehaving” in this manner. I was like that. I like creating stuff. I like building great experiences. But working as a corporate employee is an extra painful way to do it in many cases. I enjoy finding weird bugs and figuring out the fixes. But everything from the Scrum to the layoffs to the executives trying to drag you in for corporate team building events to the non-technicals who don't have a clue what you do makes it not worth it to engage at work. The project you care about will be carelessly tossed away in a reorg. You will be judged based on output report from Jira, which is actually an incentive to ship as many bugs as possible because that increases the number of Scrum points you have done. Is that really what you want for your life? Sounds miserable to me. I want out. And I do all those things to get out as soon as possible. So what is the endgame? Spend time working on cool things myself while doing all I can to minimize time work takes from my life. Cut every corner to save effort, from the passwords to the utter eradication of any speck of initiative. Work multiple full time jobs to accelerate progress to retirement and slash output at those jobs to make way to even more jobs, further accelerating my workforce exit.

kiratp 4y ago
For nothing else than the sake of “life is about the journey”, please consider changing your job. It is absolutely possible to align paid employment with fulfillment.
- pierat 3y ago
  I've heard people bandy that trusim my whole life. And I find that for like 99% of us, it's just false. Or, you do find your 'dream job', and pays $17/hr no benefits, cause it's a non-profit. (Aside: I've never dreamed of work. Not once. I like keeping the surplus of my labor.) What I want to do is to build new stuff, and greenfield. Basically, it'd be a R&D variant, but most of those jobs don't even exist. It's a cost center, and the C levels equate it to corporate gambling. There's working at a national lab, or NASA, or similar. And most of those are clearance jobs that nobody, save a few, will ever see come to light of day. I'll just choose a mundane, paying well job, and on the sly automate. Ideally, I'll get good money and have 10-15h work a week, and regained time. Basically doubles my effective wage.
gammabetadelta 4y ago
we all play games if your game let's you do this without guilt then good on you but, maybe there's a better route than escape... turn work into something worth doing
tsukikage 4y ago
If your employer doesn't reward its employees for doing things that benefit the bottom line, it's perhaps time to look for another employer.
- geraldwhen 4y ago
  You’re replying to someone who claims to be working multiple full time roles. What employee rewards effort with multiples of your total comp? None, to my knowledge.
- Gigachad 4y ago
  Or maybe the company has identified that their bottom line would be improved more by working on other things rather than the relatively small cloud waste.
DougN7 4y ago
I’m hanging onto this post for the next time I see people on their high horse about integrity among engineers. The fact is, some people have it and some don’t, regardless of job. This makes me sad. Economically it makes sense, but it’s a sign of the sickness in our modern society. Everyone looking out for themselves first without much thought to the community around them. I say this having been burned by employees like this (that did maybe, maybe, an hour’s worth of remote work per day). Maybe it all boils down to “this is why we can’t have nice things”.
- deleted 4y ago
  [deleted]
- gryn 4y ago
  > Everyone looking out for themselves yes, including/especially employers. maybe (or not) these employee started doing this after been burned by their employers before. the very same that talk about the community, greater good, and being in it together but suddenly change speech when they're on the benefiting side. I've been on both side of the equation so I understand. I also have acquaintances that were too, they used to behave the same way as mentioned in the article but once they had their own company started talking the same way you do, suddenly what was acceptable for them to do is unimaginable and unacceptable behavior for other people to do. that society should not have such things. not because they changed their opinions but because their incentives are what changed, so if they go back to their previous position so would their attitude. at the end of the day, the reason people work is not because they want to, it's because they have to in order to get what they want. wanting to have employees that go above and beyond, are the most productive, the most knowledgeable, most skilled, and accept the least pay is what best for you when you're the employer. but when you play in the other camp it's the reverse: the best job is the one that demand the least out of you for the most pay. the payoff functions for the different actors roles are the not same, trying to appeal to a sense of shame, duty or merit is just a way for one actor to hijack another's perception of the game for their own benefit.
  - DougN7 4y ago
    Totally agree with almost everything you say. But there are lines both sides should not cross. For employers it’s exploitation (don’t expect unpaid work) and for employees it’s theft (don’t take pay for no work). If we can’t agree on that then we’re headed for a break down in society.
eternalban 4y ago
Work Attitudes and Work Organization in the Soviet Union (date unknown - ? 1985) [re-formatted] "Over the past two decades there is abundant evidence of Soviet concerns with the problems of job dissatisfaction and poor work morale. The evidence appears in a score of sociological studies of work attitudes and in the more "popular" periodical literature on labor problems. The kind of work discontent which is apparent, however, does not appear to be potentially "explosive" in nature. It manifests itself chiefly in - indifferent job performance, - poor work discipline, and - high rates of job instability. Job dissatisfaction is not confined to any one sector of the work force, but the discontent of relatively highly educated young workers in routine, low skilled jobs has been particularly troublesome. Continuing problems of poor work morale and lackadaisical job performance have elicited Soviet interest in Western experiments in work re-organization (work "enrichment"programs, job rotation, autonomous work teams), and initial steps have been taken to introduce a modest Soviet version of the "humanization of work". The urgency of mobilizing disciplined work commitment becomes all the more pressing as the Soviets enter a period of intensifying labor scarcity, in which economic growth becomes increasingly dependent on the growth of labor productivity rather than on additions to the work force" https://www.ucis.pitt.edu/nceeer/0000-625-7-Yanowitch.pdf https://www.ucis.pitt.edu/nceeer/0000-625-7-Yanowitch.pdf - OP > "Now, I would personally feel shame if I did these things". The Ideal Communist Worker Within a communist society, people are expected to act in the interest of the Communist Party and the majority of society. Specifically, the individual is expected to work and act to promote the betterment of the community. Chairman Mao Zedong elaborates, “At no time and in no circumstances should a Communist place his personal interests first; he should subordinate to the interests of the nation and the masses. Hence selfishness, slacking, corruption, seeking the limelight are most contemptible, while ... working with all one’s energy, whole hearted devotion to public duty, and quiet hard work will command respect.” Hence, communists are expected to work diligently and thoughtfully in order to ensure he or she provides the most benefit to society. As a result, any worker in the computer field is expected to manufacture computer products without the wish for acknowledgment or excessive monetary reward. https://cs.stanford.edu/people/eroberts/cs201/projects/communism-computing-china/workethic.html https://cs.stanford.edu/people/eroberts/cs201/projects/commu... But u/throwawaysleep, at least take heart that scrum sessions (so far) do not entail 'self criticism' sessions.
hsbauauvhabzb 4y ago
Sure would be funny if you were tossed under the bus for blatantly reducing the security of your org by using a previously compromised password. Bug bounty integrity isn’t the only issue that could land you in legal trouble.

fideloper 4y ago

There’s no black or white here. You’ll be on both sides of this depending on your phase of life and the incentive structure at work.

Nihilartikel 4y ago

Reading things like this reinforces the satisfaction of being independent... When I inevitably notice these issues in the course of work for a client I can bring them up with the one writing the checks.. if they want it fixed, I fix it. If they don't, well there are other clients.

RobotToaster 4y ago

In some ways it seems related to Goodhart's law "When a measure becomes a target, it ceases to be a good measure" https://en.wikipedia.org/wiki/Goodhart%27s_law https://en.wikipedia.org/wiki/Goodhart%27s_law

joseph_grobbles 4y ago

Horribly cynical, and I can't imagine having that viewpoint. It's actually fascinating how the author first justifies that sort of malaise, and then does the "but of course not me" thing. Even if someone were that self-focused, in almost any group or organization, critical security vulnerabilities and significant costs do hurt everyone in the group. You're going to be the ones having the rough time when expenses exceed value, and when major embarrassments happen. There is no insulation from it.

d23 4y ago
I'm confused as to how you felt the author is justifying it: > Now, I would personally feel shame if I did these things. They seem more interested in trying to find a solution to it. Or just posing it as a legitimate problem, the solution to which is food for thought.

ALittleLight 4y ago

I disagree with the author that normal people don't think this way. Most people I know won't go out of their way to help their employer. In my experience you can usually find a few people who care about doing things right and they work hard, are passionate, go above and beyond, etc. Almost everyone else is in a different lane. Some are in the far right lane, where they cleverly exploiting things (as a few people mentioned in the article) but most are somewhere in between. I don't think there is really anything you could do about it. Mostly people don't want to work. They do work for money. They won't do more work than they need to because they don't want to do that. These people also don't want to expend more energy than they have to. They won't do something hard that solves the problem if doing something easy won't get them in too much trouble.

SoftTalker 4y ago
I can't remember the comedian but there was a joke I heard that really hit this home: People don't get paid because they like their work. They get paid because they don't like their work.

shric 4y ago

“You don’t get rewarded for being extra. You don’t get any money when you save costs. You’re going to get a raise below inflation. You’re stupid for caring the way that you do. The business’ downside risk is not yours, and it’s profits are not yours either.” Except when you're granted RSUs or participate in some private company's profit sharing scheme. So if that's important to you, find such a place. The smaller the company, the more impact you can have on their profits.

SoftTalker 4y ago
Typically those equity schemes will amount to nothing for most employees at small companies. They're a little better than buying a lottery ticket every week.
flangola7 4y ago
The business downsides are your problem though. Nobody gets a raise if the company makes great profits, but if it is making weak profits you're going to get a pay cut or be laid off. Maybe there was a time when this was not the case, but it was not during my lifetime.
evilspammer 4y ago
The smaller companies are probably not IPOed so the stock has no actual value
pierat 4y ago
> You don’t get rewarded for being extra. 100% true. Our salary, barring real (not manufactured) fires, should be for 40h/week. Any more is free work not compensated for. > You don’t get any money when you save costs. There is no equity for doing significant tasks. The common area here is automation. I automate, but don't share. I would never get compensated appropriately, so I save my time in lieu of money. > You’re going to get a raise below inflation. Yep, 3%. Job hoppers get 30% or more. My last hop was 115%. Loyalty is NOT rewarded. > You’re stupid for caring the way that you do. That's a subjective assessment. But yeah, caring too much leads to extreme burnout. And our only real change is to find yet another slaver, oh I mean capitalist to work for. > The business’ downside risk is not yours, and it’s profits are not yours either. Exactly. Start providing real equity, and a seat at the board of directors as an 'emoloyee's director'. Aside that, we're just resources to be strip-mined at 'human resources'. At least we can choose our slaver as a guise of an "interview". And RSU's are a game, that we lose. The companies made this, and they do NOT want to pay. So they gamify it to make the appearance of mounds of money. Here's your pennies.

SoftTalker 4y ago

My eyes really opened to this during the pandemic and its aftermath. Working from home I did almost nothing productive. Got paid the same. Returning to the office, I noticed half the people still seemed to be working from home most days, so I started doing that too. And did almost nothing productive. Nobody apparently noticed or cared. Got paid the same. Got the same raise (yes, below inflation). So now I have given myself a >4x raise by working about 10 hours a week of real work (and that's a high estimate). I work on whatever tasks are currently on the radar, do the least amount necessary, and ignore everything else. I get paid the same.

nobrains 4y ago
This just means that your line manager, whose role it is to ensure all resources under them are working at efficient capacity, is not doing his/her job. And in turn neither is his manager.
- geraldwhen 4y ago
  The goal of a manager or worker isn’t to be efficient, it’s to produce value. I suspect the diminishing returns of effort at most companies is astonishingly high. I would much rather a developer work 10 hours and accomplish what needs to get done than work 40 and negatively impact the business.
  - paulcole 4y ago
    > I would much rather a developer work 10 hours and accomplish what needs to get done than work 40 and negatively impact the business. It feels like there is a third option here that I can’t quite put my finger on.
    - em-bee 4y ago
      i see two additional options. one is, find something else to do that actually benefits the company. that only works if the climate in the company supports that. the other is to reduce the size of the team because apparently so many people are not needed to get all the work done.

andrewmcwatters 4y ago

I agree with Nihilartikel’s comment. It’s nice when you’re the one doing business development. But as a manager at any organization, the correct answer is to fire people like this because they become insidious and take over your business. Have a moral backbone. Is it fair? No. Lots of corporate decision making will never ever be fair. Deal with it, or work with these people. Find ways to financially incentivize morally correct behavior and exceptional engineering. The latter is important because good people leave and they’re literally worth more than your other employees. Oh and by the way, they’re disgusting to work with, and regardless of your moral compass they will make you a worse engineer. I worked with these types of people at my last job. One guy didn’t know how to fork a repo and maintain an internal copy of a project with clean portable diffs. The other was afraid of regular expressions and didn’t understand libc versioning. Losers behave like losers.

andrewmcwatters 4y ago
As an addendum, you don’t need to kill yourself over your job. Just do what’s asked of you. But you don’t need to be a parasite either. It’s disgusting and you WILL be remembered for it years later.
- throwawaysleep 4y ago
  I won’t be at my employer years later, so why does it matter? Max of 4 years to cash out the stock.
  - gammabetadelta 4y ago
    one has to have honor for themselves you may win the FIRE game but you've cost yourself the chance to be something you respect
    - skeaker 4y ago
      This line of thought shows a fundamental difference in perception. To a lot of people, working a 9 to 5 will never make you respectable no matter what it is you're actually doing. These people work to live, whereas your stance is that of someone who lives to work. I don't care how the company remembers me after I've retired and never have to give them so much as a spare thought. I have a whole life ahead of me that I intend to live without having their massive black hole of time waste looming over me.

buran77 4y ago

#3 (mediocre work after an effective pay cut) doesn't sound at all unreasonable. In effect those people are getting a pay cut and decided that investing effort to be "top-notch" is not justified. They're doing a mediocre job - by definition middle, not low quality. The author tries to paint this in a very bad light but I think this is a mentality of "it's bad because someone else does it". For some of those people the issue is not financial but one of respect. A little spit in their eye is still spit in their eye. What's a reasonable amount to cut from an agreed payment while still expecting top notch quality? How much does the author like to give up in such conditions?

RobotToaster 4y ago
Exactly, if you give someone a cut in pay, why shouldn't they give you a cut in effort?

ajhurliman 4y ago

I can’t speak for others, but for myself it’s next to impossible to live a good life while working a job where I sink into a “plaintext passwords” type of mindset. That being said, I don’t really envy that mindset, I suspect there’s something fundamentally broken about a mind that’s resigned to treating a supposedly symbiotic relationship as adversarial, even though it may be a warranted reaction given how so many companies treat their employees.

j_crick 4y ago
You’d be surprised at the amount of people in, say, Europe, who don’t identify with their daytime jobs in the ways some Americans do. The mindset I’m talking about is something along the line of that there’s actual life outside work, and your job is used to pay for it, and that’s about it. In some societies it can be even perceived as rude and selfish if you’re trying to push and be competitive.
- toonalfrink 4y ago
  European here. I'm honestly shocked to find out that there's anything else than the "work for money so you can live" mindset. Unless you have equity or it's a charity, of course.
  - unmole 3y ago
    You're shocked to find out that pride in craftsmanship exists?

kapp_in_life 4y ago

The incentive to not act like the slackers is how it impacts your "network". It's pretty insufferable to work with these people, when the success of your project depends on them or their team for whatever reason. If our team is hiring and I see a former coworker got laid off who was a slacker I won't put in a referral for them. I guess it won't impact them much, because tech is still growing and demand exceeds supply, but at least it will keep my work slightly more enjoyable. A job well done is it's own reward.

selcuka 4y ago
From the article: > [they] say their new goal is to be “perfectly mediocre.” Note that mediocre is not the same as slacker. It is impossible to distinguish a genuinely mediocre developer from an intentionally mediocre one, so no, it won't impact their network unless they are really careless and tell everyone that they can in fact perform better. Do you stop talking to a colleague because they have never found a security vulnerability and fixed it?
- kapp_in_life 4y ago
  The 4 case examples in the article are absolutely slackers. Not mentioning a 6 figure cloud inefficiency, or knowingly shipping bugs, or leaving 100's of diffs for compiler warnings and not publishing them. You're right about not being able to tell a genuinely mediocre developer from an intentionally mediocre one... unless they tell on themselves like the above did. >Do you stop talking to a colleague because they have never found a security vulnerability and fixed it? This feels like a reach? Obviously not, I'm perfectly cordial to everyone I work with. If they find a security vulnerability, and don't fix or even bother reporting it then I'll obviously think less of them and probably not give them a referral. But I'd never hold it against someone for not identifying one or accidentally shipping one.
  - selcuka 4y ago
    > This feels like a reach? Obviously not, I'm perfectly cordial to everyone I work with. Sorry if you were offended, but I didn't mean that you do. Nobody does. That was a rhetorical question to emphasise my point.

majormajor 4y ago

The movie Office Space is about this exact problem. Why go above and beyond the bare minimum when management doesn't care? (And then is so oblivious that they fire some of the hardest workers?) I'm personally the sort who gets frustrated when there isn't enough to do or when it's clear other people on the team aren't carrying their weight, but I can't say I blame the "why try harder than I have to" crowd, but I try to avoid companies with that culture. I've seen some companies avoid it by trying to punish and fire people to ensure a 'minimum quality bar'. That works better than letting obvious negligence slide, probably, but still isn't particularly motivating to go above and beyond. The "pay well but make it understood that you're paying for quality" method is way better as long as you still keep a close eye on that quality and it doesn't just turn into "pay well and screw around" (it's not hard to find stories of this in FAANGs in the past decade).

furyofantares 4y ago

Good security practices are in this unfortunate category where: 1) The actual risk calculation is somewhat nuanced, but advocates are very clearly on the right side when you do it. 2) The advocates drastically oversell it as a coping mechanism for it being hard to convey nuanced issues, and even come to believe their overselling. 3) Some who go along at first gradually gain some intuition that they've been lied to, and wrongly conclude or begin to behave as if the advocates are on the wrong side. In the case of storing passwords in plaintext, it causes a low probability increase in chance of a some very bad outcomes. It can be correct that it's well worth mitigating, while also being a hard calculation to reason about and find salient. If we compensate by treating it as if it's a high probability event in order to get everyone t comply, and begin to believe it ourselves, people may eventually notice that not everyone is compliant, but they never see anything bad happen in their immediate surroundings, become increasingly lax themselves, notice nothing bad is happening still, etc. Seatbelts are maybe a counterexample to my point here, where people have come around despite their personal experience never including an accident. Maybe with the help of laws, or maybe more because it's personal risk to self. Or maybe it's just that enough people know someone who has had a bad car accident even if they haven't themselves.

jerrygenser 4y ago

Sorry this isn't the purpose of the original article, but does anyone want to give a way secrete should be stored? Even if I use secrets manager for example, I need to store the token for fetching it so there is always a secret or token that needs to be stored. I might not store an access token, I might use user auth and get a temporary token for a script that then calls to a secret manager. The access token is cached locally in plain text. Is tbis more secure since it's a token with expiry?

megous 4y ago
First, you need to ask yourself what you're trying to protect the secret against. Then you can figure out some reasonable mechanism to do it. There's no single proper way. You can't always go with "maximum" protection for everything, because then you'll be doing multiparty ceremonies all the time and it would be mighty impractical https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/ https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/
scott00 4y ago
Your guess is correct, the expiration is what adds the security. The main security need this is addressing is terminating access to ex-employees/contractors given a requirement for shared credentials. If the shared credentials are not short term, you have to rotate credentials every time the team changes. If you don't have a system to do it automatically it's pretty easy to forget to do it or do it incompletely. So better just to do it very frequently and automatically so you don't even need to bother with a revocation process. You might be thinking that you don't have any shared credentials, but effectively any credential that a server has access to is shared, because there's almost certainly at least two people with access to any given server.
hsbauauvhabzb 4y ago
I’m personally not a huge fan of expiry - if your key is compromised within its lifetime, it can be compromised again, attack complexity increases but is not mitigated and requires a bunch more effort (refreshing, graceful fail logic, etc). Windows implements DPAPI, which is used to encrypt stored secrets on disk keyed with the users password sha1’d (and previous sha1 keys encrypted with the newest password). That way a file system compromise isnt a password compromise, at least directly. More hardcore is hardware based modules, TPM and yubikeys are in this space, they use pub/private keys so the secret is no longer pre shared. Other hardware security modules also exist which are more full fledged. The former ultimately guarantee authentication but not session security, the latter can potentially do both afaik.

ripplefringe 4y ago

Something that I feel like I disagree with here is that it doesn't take into account all the intangibles that you get from working hard. Personally I work hard and I feel like I get: * Appreciation from my manager and team, who I respect and love working with. * New knowledge that I can use later, and possibly build trust with others. * Influence that I can use later * The good feeling knowing I solved a problem for my business and hopefully letting them spend that money or effort elsewhere. * Some sense of job security This is probably a very Pollyanna view of the world, and maybe it's all because I have a good team and manager. But nevertheless, I feel like I hit the lottery as a programmer. It's enjoyable, the work changes day-to-day and it pays well.

cardanome 4y ago

It really depends where you work, you role and what the incentives are. You are young and working in a small startup with revenue share? Yeah, go wild and try to leave your mark! Just avoid getting burned out! Boring corporate job and have family to feed? Don't rock the boat. Though generally, don't. Best case you will make other people richer. Worst case is it backfires and you get more work assigned. If you want to advance your career, work on your social skills. If people like you they will automatically rate your job performance highly. Conversely your programming skills are pretty worthless if nobody wants to work with you. Might be cynical but that is how it works.

HL33tibCe7 4y ago

I can’t even imagine how crushingly depressing it must be to spend 50% of your waking hours working with this kind of attitude

emptysea 4y ago

The quote at the end of the article really sums up my feelings: > “I think the real answer, the real answer […] this is going to sound weird or bad – is to cajole or trick your employees into thinking that what they’re doing is important.” Basically I like to fix things at work because I get some sense of satisfaction by doing things the "right way". Of course this feeling can be worn down, other coworkers not caring, management not caring, etc. And then you end up in a "work to the contract" mentality, which is what the "store your passwords in plaintext" people seem to be doing

piaste 4y ago
It could be improved into "make sure your employees enjoy their work". Working at the same companies, the quality of my code varied wildly based on how enjoyable that particular project was. Not just the task itself, but also whether the deadlines were reasonable, the stakeholders were nice to talk to (or the PM kept them away from me if they weren't), etc. Of course, sometimes you will have some flat-out unpleasant work that needs to be done anyway. In that case, boosting the employee's ego is the only away they are going to get any satisfaction out of putting effort into the task. But it should be a last resort, not the default.

d23 4y ago

Great article. Sums up what I've observed over my entire career. Incentives are orthogonal at best to what is actually good for the company, and at times, doing things that actively harm the company can be the way up the ladder. We're worse than bad at measuring and rewarding good performance.

electromech 4y ago
Right! Other commenters here seem to have interpreted the article backwards. How I read it: caring and working hard can get you punished; taking the safe and easy path can get you rewarded. Sadly, that lines up with my experience. Although I still love the work (the real work) I hate The Game® more and more every year.

JoshuaEN 4y ago

"Not being rewarded with money seems to be the common theme here, but financial incentives are tricky to get correct" Giving pay raises which exceed inflation for someone who meets expectations (in anonymous peer reviews) is tricky? Ensuring expectation meeting employees pay stays in line with market rates--when the company knows the market rate because they are hiring new employees--is tricky? Even if one argues it is not possible to accurately measure performance (or to get honest reviews from peers), punishing everyone because some employees may be underperforming is clearly not the solution (it will only serve to demotivate or drive away previously motivated and happy employees). And to be clear, reasonable pay raises is not a solution to all of the problems the article is talking about, but it's a simple place to start.

pjscott 4y ago

In healthier workplace cultures, this kind of don't-give-a-shit behavior is socially stigmatized, while behaving like someone who wants to do things right is socially rewarded. It's easy to forget, but not all incentives are measured in dollars. I'm not trying to go full Confucius here, but people who do better work than they have to shouldn't be made to feel like chumps by the people around them. They should get respect, so they feel good for doing good things.

xiaodai 4y ago

I am a chump. I've SEEN passwords in plaintext and I even tried to remove it by figuring out how to remove it from git histories. Heck, for one of those where it was not possible to get rid of plaintext due to the architecture, I even wrote some code to compare hashes instead of password so at least the attacker would need a rainbow table to crack it. Didn't bother salting it, since there's only one user effectively. But meh. Life of a chump, ain't getting no promotion and got the lowest possible bonus last year. It's better to be a chump cos I can feel better about myself

LargeTomato 4y ago
I cost my company over a million dollars because I was lazy and spiteful. I made an L+1 hop to a competitor and now I make more money for less hours and I'm learning a ton.
orwin 4y ago
The best way is to change the password in the environments, and let it in the commit history. It's both the easiest and the correct way. And if you can't, your company have to change its architecture.

LargeTomato 4y ago

I've done the AWS thing. We spent over $1 million on AWS and I couldn't be bothered to care. We were in eternal crunch mode, 10-14 hour days for 6 months. If I spoke up about AWS waste I'd get ripped apart by upper management. Eventually it became apparent what was going on. I was pushed out and went to a competitor who paid me more and had better hours. I gave that competitor a lot of information about the previous company and transfered a lot of my knowledge. I delivered quite a bit of value rather quickly because of that and was recognized and rewarded for it. We work in an enormous industry. It doesn't seem like there are any consequences.

RangerScience 4y ago

> Is there some way to correct this? How do you reward good behaviour here, and discourage “misbehavior” like this? …Yes? As the employer, find ways to be as generous and rewarding as possible. In immortal other words, “Fuck uou pay me.” Every example provided was “I went above and beyond and was not rewarded for it.” The fix is rewarding people for it.

NoZebra120vClip 4y ago
Yeah but as the Dilbert comic at the end demonstrates, offering rewards for good behavior leads to perverse incentives. So wcyd?
- RangerScience 3y ago
  https://strongfemaleprotagonist.com/issue-6/page-125-2/ https://strongfemaleprotagonist.com/issue-6/page-125-2/ > "The lie of the slope is the implication that we have ever been or could ever be on level ground." https://en.wikipedia.org/wiki/God_Emperor_of_Dune https://en.wikipedia.org/wiki/God_Emperor_of_Dune > What do [thinking] machines really do? They increase the number of things we can do without thinking. Things we do without thinking-there's the real danger. Your workplace has an incentive structure (probably a complex one, made up of monetary, social, etc factors). That structure is akin to a machine. That machine should aide you - as an IC, it should aide you in doing quality work in alignment with business needs; as a manager, in motivating and coordinating your ICs. It shouldn't do it _instead_ of you. The idea that you can't add rewards for good behavior _because_ it will result in perverse incentives is, IMHO, akin to thinking you can't add code to the product because it'll result in bugs. So what can you do? Engage with your people, be generous with them; be generous with rewards and praise and all the good things when they do well; be generous with forgiveness, coaching, and teaching when they do poorly, and be generous with your time and involvement. Do your own thinking - don't have the machine-that-is-the-corporation do it for you, because it's full of bugs and always has been. Be engaged so that you can adjust as things play out.

deleted 4y ago

[deleted]

Runepika 4y ago

[dead]

justsomehnguy 4y ago

>> "They pretend to pay and we pretend to work" I have a monitoring instance which monitors a couple of URLs of some client. Every now and then something is wrong somewhere and it's spams the messenger with 'not available'. In a minute it spams again, now with 'Resolved' status. I can just turn the trigger time to two minutes or change it to trigger only after a two/three consecutive failed checks... But should I? Not only it wouldn't change how much I receive for this service (a pint of Guinness/mo, really), but it also would make it look like the monitoring isn't monitoring. I don't want to make proofs what it's actually working. Bonus point: if I receive the alerts I know what the monitoring works. And to the TFA: I made a proper VPN network for a client a decade ago: a VPN concentrator, dual path through two ISPs to the main office with the on-premise services, 15+ branches in the city, a couple of remote ones. Except I didn't buy Cisco gear, but some, ugh, not quite enterprise gear running FOSS solutions. Did I got anything from it? OFC no.

out-of-ideas 4y ago

There are people like this everywhere; the lack of overall caring has been happening, i'd argue, for quite some time. From physical construction to tech jobs; people want to get the job done (and cut whatever corners as they can), to get paid and move onto the next job. Can we really be surprised? Take a good look at any part of any construction that goes on, from the concrete to the finishing paint jobs and I'm confident the more you look the more you will realize folks either do not pay attention to detail, or they simply do not care. It goes deep into all corporations, especially when buisness-is-booming; gotta move onto the next client to get more cash! The same can be said for what items we consumers get as well; Apple selling laptops where the cords turn yellow, plastic freys and expose wires after 8 months of use; Samsung has similar issues, and the list goes on. Now take a look at the products spammed at us via Amazon; searching is abysmal (search for an audio cable, get results for usb cables instead). Want to check the quality of an item? Better order it and return it later when you figure out it is trash. Long dead are the (deparement?)stores/(big?)corporations/people that had at least some caring about others. What was once normal is shifting, and it has been for years. I am curious if the dude writing the article did raise up said concerns of fellow employees to their (respective?) boss(es); essentially if management does not prioritize caring is said issues, why would the lowers care about it?

kuahyeow 4y ago

Maybe there's engineers / developers working like this. Most likely it's a reflection of company culture. But there are real-world repercussions of just plain bad working practices * https://www.abc.net.au/news/2023-03-27/whats-happening-with-the-latitude-financial-cyber-attack/102151164 https://www.abc.net.au/news/2023-03-27/whats-happening-with-... It's not as bad as a bridge falling down, but this is why there's professional bodies and code of ethics in certain professions.

blacksoil 4y ago

I think personally it's important for people to realize that people are creature of habit. A person who has the disicipline of going extra miles and strive for excellency in their work, regardless of compensation, is likely to carry his habit across different jobs or even when he decides to do his own startup or anything non-work related. I think this is such a good habit to have will prove beneficial sooner or later. A lot of people think they will just work hard and do their best whem they need to, and take it easy for now at a corporate job. Personally I don't think work-ethics can be switched that easily, it has to be built.

MattPalmer1086 4y ago
I remember a story I was told at school that made an impression on me. A stone carver was making gargoyles for a cathedral. His apprentice noticed him carefully carving the back of them. The apprentice asked why he was doing that, since no-one would ever see the back or know. "I will know", replied the carver. Now, that is not an argument for doing unnecessary work. I saw it as an argument for taking pride in the work you did, even if you would be the only person who knows.

throwaway752809 4y ago

I worked for a startup from 2015 to 2022. From 2015 to 2020, it was great. I (and most other employees) was working hard, and was consistently rewarded for my efforts. In 2021, the company benefited from a huge boost due to the pandemic. Hiring went through the roof and the company became very performance focused. Unfortunately "performance" now meant "meeting your OKRs" and nothing else. The company culture went through the drain. Most of the new hires were from FAANG and knew very well how to play the game. Whereas before, if you asked someone for help, they would help you, now the answer became "file a run ticket". After all, why would you spend time helping anyone? That's time not spent on your own OKRs, and that's literally the only thing that matters. Nevertheless, I kept working hard. I was involved in multiple company initiatives, mentored new hires, still helped people when they asked for help, etc. After a year, when performance review time came, I got a "meets expectations". I was livid, and asked my manager how that could be possible. He basically told me that he had no visibility into all the non-team initiatives I was involved in, and that it was my own fault for not making myself more visible and drafting my OKRs in a way that would have allowed him to justify why I deserved more than "meets expectations". I refused to play the game and told my manager I was sure I could get "meets expectations" by doing a lot less. I basically slammed the door on all the side initiatives I was involved in and stopped doing anything besides "core work". I went from working 50+ hours a week to working 25-30 hours. I did not enjoy it -- I was actively miserable, and started taking steps to move on. It took me nearly a year to leave the company (I was on a visa that did not allow me to switch jobs so had to obtain an H-1B, which took time). Another perf review came by, and lo and behold, I got "meets expectations" again. I am so much happier in my new job, but I'm still salty about the previous company. What used to be a great company culture became a toxic, political, gamed environment. (Oh, and of course they had a huge layoff round a few months ago. But hey, at least leadership "took responsibility" for overhiring.)

atlantic 4y ago

> Another person simply doesn’t care about shipping code with bugs, and maybe even tries to. They get to shirk actual development duties by fixing their own broken code instead, and the fixes are celebrated. In one of the companies where I work, there is a chronic lack of hours for a few freelancers who were taken on with promises of full-time work. They compensate by shipping code with bugs, generating a bunch of bug reports down the line. This compensates for the missing hours. And as performance is evaluated in terms of the number of tickets closed, it also improves their standing in the workplace.

taylodl 4y ago

Yes, bad management exists. That's the #1 reason people cite for leaving companies. The problem is when you allow bad management to not care for your craft. If you find yourself copping the attitude of screw it, I get paid the same - then it's time for you to move on. Over time that attitude will rot you from the inside out.

bigattichouse 4y ago

Ownership. This is literally why the employees should own the company, or at least get significant ownership in terms of stock. In every one of these cases, especially the AWS waste case, an employee with ownership in the company could see a direct monetary benefit from fixing the problem, especially at a small company.

sallygretel 3y ago

[dead]

npteljes 3y ago

The way I go about it is that when I find it, I raise it politely, I offer to drive the fix, and then I add it to my resume, and then I tour with it, being "The Guy Who Fixes Things". That way I do get something, even if I'm completely detached from the original thing.

aredox 3y ago

"cajole or trick your employees into thinking that what they’re doing is important" Relevant Subnormality Comix: https://viruscomix.com/page477.html https://viruscomix.com/page477.html