3 ms·
The following case is interesting because it might fall in the space between what various folks on this thread consider acceptable. An engineer on my team once
by zestyping 3y ago
The following case is interesting because it might fall in the space between what various folks on this thread consider acceptable.
An engineer on my team once merged a change that created a security vulnerability, without review. We didn't have any real users on prod yet, and the potential impact was small. But I was still angry because I had given explicit instructions (speaking as the tech lead and the one with the most security experience) that all changes had to go through code review for security issues.
I responded with an email message that was visible to the whole team (about 5 people). I knew it would sting, but I also wanted everyone to know that this was an important line not to cross, because at some point in the near future we did hope to have real users. I wrote, approximately, "You merged this change without review, and that's not okay. I explicitly told you not to do that. As a result, we now have a security vulnerability. Don't ever do that again."
I am paraphrasing from memory, but the tone was not too far off from this: stern, direct criticism without personal attack. At the time, I held myself to a simple standard of communication: stating facts and criticising actions (even bluntly) was acceptable; any criticism of personal attributes was unacceptable. The engineer in question was very hurt and angry with me, and our working relationship was difficult for many weeks after that.
Was I the asshole here? What's your standard of communication, and what would you do, from the point of view of the tech lead or as the engineer?
- vasco 3y agoI think writing "you merged" rather than,"we don't do this" would be a bit better. Also not acknowledging that there were no users yet, so impact wasn't there actually, but it would be if it happened later, was also important to acknowledge as the lead. In general I'd write a similar thing, just speaking of the team, and not overplaying the impact. If you had no users it was no problem, that's the truth. But it would be a problem in the future so you want the team to know and practice safety. People tend to be upset if you hype it more than it is, even an little, and it comes across as you just wanting to be right for rights sake. And generally we/team/process focused language is better than "you fucked up". Why did you even have merges enabled without reviews? It's more your process failure than that guy. That being said I work in full remote with many different cultures so I have an "international average". If this was a fully Russian team or some such even what you wrote was too soft in my experience and you actually need to be very clear or they think it's nothing.
- msm_ 3y agoI don't think you was the asshole, but I think (i.e. in my cultural circle) that's too public. I would send this message only to the person responsible, and if necessary sent a much softer message to the team like "I noticed that recently we had some merges without a proper review. Please avoid this in the future, code review is a strict requirement in our team".