4 ms·

How do you even find the right people? I have no idea how I’d do that at my company.

dylan604 3y ago
Send it to the CTO, the receptionist, or even HR. hell, CC them all with a note saying that it is unknown where to send it to so hoping someone will know where to forward it. It also sounds like your company needs better internal communication about communications within the company.
- dmazzoni 3y ago
  I worked at Google for many years. Google is so huge that it's extremely common to know you have an important bug for another team, but not to be able to route it to them because you can't find their team name. Most teams have "code names" that have nothing to do with the public name of the project. For example, the parental controls team might be named "pigglewiggle-team" and the Android contacts team might be named "katniss-team" and their bug components might have similarly obscure code names. If you don't work with those teams frequently it can be really daunting to find. Even when the bug components have hints that get you close to the right place, it's not unusual to learn that most of the engineers are busy working on the new version of the app that isn't released yet, and the old version of the app (the one with the bug) has been destaffed and bugs are supposed to be routed to some other random team that's literally never touched the code.
  - irrational 3y ago
    So, it isn’t just my company that does all of the above. I guess that’s good to know. At least we aren’t the only dysfunctional ones.
    - dylan604 3y ago
      I think any company that has more than 1 employee leans towards dysfunctional
      - int_19h 3y ago
        Any large bureaucracy seems to do that. Either you have a relatively flat org chart, but then teams have limited visibility past their "neighbors". Or you have a deeply nested hierarchy, where there's a clear path to route requests to any given place, but it takes ages because of all the red tape involved in escalating it sufficiently to route it properly (and then people try to avoid that hassle).
  - astrange 3y ago
    I think it's safe to say their competitor does not have this issue.
  - Aeolun 3y ago
    This giving codenames to projects thing seemed so endearing when I was working in a team and company of 10, but now that I’m working in a team of 100, and an org of 2000, it’s so extremely aggravating.
- irrational 3y ago
  My company has 80,000+ people. I doubt those people have any clue either.
  - dylan604 3y ago
    Regardless of the number of employees, if the CTO can't figure out where it needs to go, then WTF does that CTO have a job?
    - throwaway11460 3y ago
      Try contacting the CTO in a company of 100k+ people. Your email probably goes to their junk folder. I worked in a similarly sized company and I didn't even know the name of the CTO, nor if there even was one.
ang_cire 3y ago
It's a vulnerability. Report it to infosec. Even if they likely don't fix vulns themselves, they are the ones tracking SLAs for remediation and coordinating tickets, etc. If your infosec team does not have a contact email (or preferably, several, e.g. "incident@", "security@", etc), slack/teams/webex channel, or escalation process for reporting security issues, that is decently well-known to employees, they are not doing their jobs well. Quarterly infosec bulletins? Infosec day? "Cool incidents" annual recaps? I cannot imagine working on an infosec team that doesn't make itself very visible, and very *available*, to other groups, and always position themselves as the 'catch-all' place for any security issues (which these bugs clearly are).

Send it to the CTO, the receptionist, or even HR. hell, CC them all with a note saying that it is unknown where to send it to so hoping someone will know where to forward it. It also sounds like your company needs better internal communication about communications within the company.

dmazzoni 3y ago
I worked at Google for many years. Google is so huge that it's extremely common to know you have an important bug for another team, but not to be able to route it to them because you can't find their team name. Most teams have "code names" that have nothing to do with the public name of the project. For example, the parental controls team might be named "pigglewiggle-team" and the Android contacts team might be named "katniss-team" and their bug components might have similarly obscure code names. If you don't work with those teams frequently it can be really daunting to find. Even when the bug components have hints that get you close to the right place, it's not unusual to learn that most of the engineers are busy working on the new version of the app that isn't released yet, and the old version of the app (the one with the bug) has been destaffed and bugs are supposed to be routed to some other random team that's literally never touched the code.
- irrational 3y ago
  So, it isn’t just my company that does all of the above. I guess that’s good to know. At least we aren’t the only dysfunctional ones.
  - dylan604 3y ago
    I think any company that has more than 1 employee leans towards dysfunctional
    - int_19h 3y ago
      Any large bureaucracy seems to do that. Either you have a relatively flat org chart, but then teams have limited visibility past their "neighbors". Or you have a deeply nested hierarchy, where there's a clear path to route requests to any given place, but it takes ages because of all the red tape involved in escalating it sufficiently to route it properly (and then people try to avoid that hassle).
- astrange 3y ago
  I think it's safe to say their competitor does not have this issue.
- Aeolun 3y ago
  This giving codenames to projects thing seemed so endearing when I was working in a team and company of 10, but now that I’m working in a team of 100, and an org of 2000, it’s so extremely aggravating.
irrational 3y ago
My company has 80,000+ people. I doubt those people have any clue either.
- dylan604 3y ago
  Regardless of the number of employees, if the CTO can't figure out where it needs to go, then WTF does that CTO have a job?
  - throwaway11460 3y ago
    Try contacting the CTO in a company of 100k+ people. Your email probably goes to their junk folder. I worked in a similarly sized company and I didn't even know the name of the CTO, nor if there even was one.

ang_cire 3y ago

It's a vulnerability. Report it to infosec. Even if they likely don't fix vulns themselves, they are the ones tracking SLAs for remediation and coordinating tickets, etc. If your infosec team does not have a contact email (or preferably, several, e.g. "incident@", "security@", etc), slack/teams/webex channel, or escalation process for reporting security issues, that is decently well-known to employees, they are not doing their jobs well. Quarterly infosec bulletins? Infosec day? "Cool incidents" annual recaps? I cannot imagine working on an infosec team that doesn't make itself very visible, and very *available*, to other groups, and always position themselves as the 'catch-all' place for any security issues (which these bugs clearly are).