4 ms·

I worked at a large web dev company and for years they had this attitude. Then one designer put in his two weeks and spent the majority of the time downloading

I worked at a large web dev company and for years they had this attitude. Then one designer put in his two weeks and spent the majority of the time downloading all the site files for all of the sites the company had built over the two years he was there. We're talking hundreds of static sites where he took the all the design docs and static HTML/CSS/JS files one would need to recreate them somewhere else. Instead of going after the guy legally, they passed and then instituted the same policy. You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out. The one designer totally ruined the company from ever letting someone stay for their two weeks.

kristopolous 3y ago
Anyone could have done that at any time. The two weeks isn't magic. It could have been unannounced and they just stop showing up. You either trust your people or you don't. If you don't, get rid of them and lock them out. If you do and you still have to let them go then don't worry about it. People are far too inhuman in professional relationships and I strongly dislike that tendency. You likely spend as much time with your colleagues as your spouse, make it a real connection.
- supriyo-biswas 3y ago
  But once they receive the bad news, their motivation for revenge increases, which is why similar policies exist in many workplaces. Trust isn’t a univariate, piecewise defined function like you suggest.
  - kristopolous 3y ago
    Right, if you're being a dick then sure. I'm advocating for not being one in the first place. That's the challenge. If you can't meet that use keycards instead of keys, voip instead of real phones, lock file cabinets, I mean go all the way. Corporate America loves pretending. Pretending you're part of the family and then treating you like you're trying to rob the place at the drop of a hat. That's the messed up thing. Be consistent and don't be fake. People can deal with you for being overly formal and paranoid but probably not for being a phony backstabber, that's how you grow haters. The hardest thing for a brand to shake off is a bad reputation, whether they justly deserved it or not. You don't want haters in the Internet age.
  - Aeolun 3y ago
    I think people in general are a lot better about being fired if it doesn’t happen at the drop of a hat. Unfortunately in the US it seems like you can go from gainfully employed to jobless in the space of an unfortunate 10 minutes. That’d piss me off too.
- ketzo 3y ago
  I think it’s a scale thing, honestly. Yes, most reasonable adults remain reasonable even after fired But once you hire a thousand, ten thousand, a hundred thousand people… statistically there are gonna be some wackos you didn’t filter out! It’s tough. I agree that treating each other like humans is the best policy.
  - kristopolous 3y ago
    Of course it increases. That's why you have permissions and guard rails on the employees in the first place. Those should be sufficient. Also if you want to work with the people you like again but need to actually downsize because of external pressure, good luck trying to get them to come work for you at your next venture after some fucked up bridge burning ceremony.
    - bombcar 3y ago
      You also have the situation where the boss usually KNOWS who might do things that he shouldn’t - but you can’t have policies that only apply to some, so they get applied to all (there are still unofficial ways around this, of course, like letting someone know unofficially before they’re officially laid off).
rightbyte 3y ago
> You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out. The only thing that that accomplishes is that people don't put any notice.
rob74 3y ago
...so now people who want to do that just copy everything before sending the email?
TeMPOraL 3y ago
> The one designer totally ruined the company from ever letting someone stay for their two weeks. No, it's the over-reaction by whoever instituted that policy that ruined the company. They should've cut their losses and ignore the outlier, perhaps make it tad more difficult to copy off data en masse without being noticed, and/or do many other things addressing this risk without ruining the workplace for everyone else. This is the organizational equivalent of autoimmune disease. Works at every scale. On national/international scale, this is what terrorist organizations are exploiting - do an X amount of damage that may even be counterproductive to their goal, and watch the victim do 1000X damage to itself by overreaction.
darkwater 3y ago
> You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out. This will work for the first 5-10-20 people, then word of mouth goes out about this policy and your evil designer is downloading everything the day before sending their resignation mail.
- fullspectrumdev 3y ago
  Or “your sales guy is making a little backup of the leads from the CRM before handing in notice”. Though with sales orgs I think this is almost an expected practice - sales people are often hired on the tactit, never officially acknowledged basis that they will bring their leads list.
  - notbeuller 3y ago
    Years ago I got a job through a recruiter, left company A for B. She called me after a few months and asked me for the Compsny A internal directory - which I declined to provide and she got kind of nasty about it. Maybe ten years later I was at company C and my manager mentioned hiring a recruiter - same person. I mentioned our previous interaction (not out of spite, just a naive narrative) and they stopped working with her immediately. My point being - your behavior has a long tail, so don’t be trying to take advantage.
    - bombcar 3y ago
      People asking for company directories amuses me so much, especially when most company email patterns are completely guessable.
      - htrp 3y ago
        it's more the name and the org chart? maybe the phone number too
serial_dev 3y ago
> We're talking hundreds of static sites where he took the all the design docs and static HTML/CSS/JS files one would need to recreate them somewhere else. You make it sound like he poached your clients or extorted your company. As they didn't go after him legally, I assume that didn't happen. I assume all the files are on a thumb drive in his drawer, unopened, just in case he wants to remember how "that cool animation" was implemented. And when that moment comes, he will not find the thumb drive, anyway. And all that security charade will accomplish is that people who care enough about their work, will make a copy the day before they quit. Congratulations, your policy achieved nothing, except get rid of their two weeks notice and everyone feel a bit worse working for you.
- drewcoo 3y ago
  Designers also need to show portfolios. Hard when your work is all behind some corporate firewall.
- away271828 3y ago
  I don't know the details but so long as its not some top secret IP, taking copies of various work you've personally done seems pretty reasonable. Good idea to do it periodically as you go along though.
- Macha 3y ago
  One thing I noticed is we got in the last few years a lot stories of the form "Adobe donates Photoshop 1.0 source code to Computer History Museum, saved because early programmer kept it on a floppy disc in his house". Or games especially we get a lot of this. It feels like if an employee did this with modern projects, they would at the very least be summarily fired, if not have legal action taken against them.
  - nilamo 3y ago
    These days, we use centralized source control, instead of emailing zip files and patches back and forth. Having all the source on a random piece of media was a lot more normal back then.
fullspectrumdev 3y ago
So what stops people making their “backup of files” before hitting send on the email?
wil421 3y ago
Get a DLP system in place for god sakes. I’ve even seen off shore people work from VMs only where they can’t download or store any file locally, much less dump everything to a USB stick.
- emj 3y ago
  Top search result is from Gartner: alarm bells ringing. Data loss prevention seems to be enterprise speak for doing as much intrusive monitoring you can do, in as neutral speak as possible. 1984 is so appealing for so many people, it seems like it is just a book about the tendencies that power can take when it is not guided by sane principles. I have always been employed in a high trust capacity since I was a young adult, there is not a technically feasible system in the world that could prevent me from wrecking havoc in a company. Social ones though, they are extremely effective.
  - dsr_ 3y ago
    Every so often a client asks if we are using a DLP, and if not, why not. All the DLPs rely on, effectively, regular expression searches of traffic. This is fine if what you need to protect are SSNs, phone numbers, credit card numbers... but if your data is not easily recognized that way, they don't work. If you ask the DLP vendors about their threat model -- and the salespeople generally don't know what a threat model is -- it's always a set of stories about a salesperson who clicks the download-as-CSV button on a CRM system, a DB reporting specialist who generates a report full of raw passwords and credit card numbers, and an off-shore programmer who sends AWS credentials via email. Hopefully you can spot the non-DLP prevention mechanisms for all of these...
    - oblio 3y ago
      > Hopefully you can spot the non-DLP prevention mechanisms for all of these... What is it?
  - wil421 3y ago
    What does any of this have to do with theft? In most lawful places, if you dump source code and documents to take with you it’s not going to end well. https://www.cnbc.com/amp/2020/08/04/anthony-levandowski-gets-18-months-in-prison-for-stealing-google-self-driving-car-files.html https://www.cnbc.com/amp/2020/08/04/anthony-levandowski-gets...
weregiraffe 3y ago
But what would prevent someone from "downloading files" BEFORE they send the notice?
ajb 3y ago
In the UK, and most European countries, locking someone out during their notice period is really rare. Big companies exist and are not destroyed by disgruntled employees. If someone is fired for cause then they go immediately, but if they are given notice then they are usually trusted with access, and it rarely goes wrong. Stealing IP is rare because it's hard to benefit from it. If stolen IP is offered to another company, usually they report it to the owner to cover their backs legally. Funders are not going to want to invest in a company that is based on stolen IP, where their investment can become worthless overnight. So I think these stories about how 'we have to treat employees like they are potential criminals' (not accusing parent of that, but you hear them) are bugos. Treating people like human beings is both right and economically efficient.

kristopolous 3y ago

Anyone could have done that at any time. The two weeks isn't magic. It could have been unannounced and they just stop showing up. You either trust your people or you don't. If you don't, get rid of them and lock them out. If you do and you still have to let them go then don't worry about it. People are far too inhuman in professional relationships and I strongly dislike that tendency. You likely spend as much time with your colleagues as your spouse, make it a real connection.

supriyo-biswas 3y ago
But once they receive the bad news, their motivation for revenge increases, which is why similar policies exist in many workplaces. Trust isn’t a univariate, piecewise defined function like you suggest.
- kristopolous 3y ago
  Right, if you're being a dick then sure. I'm advocating for not being one in the first place. That's the challenge. If you can't meet that use keycards instead of keys, voip instead of real phones, lock file cabinets, I mean go all the way. Corporate America loves pretending. Pretending you're part of the family and then treating you like you're trying to rob the place at the drop of a hat. That's the messed up thing. Be consistent and don't be fake. People can deal with you for being overly formal and paranoid but probably not for being a phony backstabber, that's how you grow haters. The hardest thing for a brand to shake off is a bad reputation, whether they justly deserved it or not. You don't want haters in the Internet age.
- Aeolun 3y ago
  I think people in general are a lot better about being fired if it doesn’t happen at the drop of a hat. Unfortunately in the US it seems like you can go from gainfully employed to jobless in the space of an unfortunate 10 minutes. That’d piss me off too.
ketzo 3y ago
I think it’s a scale thing, honestly. Yes, most reasonable adults remain reasonable even after fired But once you hire a thousand, ten thousand, a hundred thousand people… statistically there are gonna be some wackos you didn’t filter out! It’s tough. I agree that treating each other like humans is the best policy.
- kristopolous 3y ago
  Of course it increases. That's why you have permissions and guard rails on the employees in the first place. Those should be sufficient. Also if you want to work with the people you like again but need to actually downsize because of external pressure, good luck trying to get them to come work for you at your next venture after some fucked up bridge burning ceremony.
  - bombcar 3y ago
    You also have the situation where the boss usually KNOWS who might do things that he shouldn’t - but you can’t have policies that only apply to some, so they get applied to all (there are still unofficial ways around this, of course, like letting someone know unofficially before they’re officially laid off).

rightbyte 3y ago

> You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out. The only thing that that accomplishes is that people don't put any notice.

rob74 3y ago

...so now people who want to do that just copy everything before sending the email?

TeMPOraL 3y ago

> The one designer totally ruined the company from ever letting someone stay for their two weeks. No, it's the over-reaction by whoever instituted that policy that ruined the company. They should've cut their losses and ignore the outlier, perhaps make it tad more difficult to copy off data en masse without being noticed, and/or do many other things addressing this risk without ruining the workplace for everyone else. This is the organizational equivalent of autoimmune disease. Works at every scale. On national/international scale, this is what terrorist organizations are exploiting - do an X amount of damage that may even be counterproductive to their goal, and watch the victim do 1000X damage to itself by overreaction.

darkwater 3y ago

> You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out. This will work for the first 5-10-20 people, then word of mouth goes out about this policy and your evil designer is downloading everything the day before sending their resignation mail.

fullspectrumdev 3y ago
Or “your sales guy is making a little backup of the leads from the CRM before handing in notice”. Though with sales orgs I think this is almost an expected practice - sales people are often hired on the tactit, never officially acknowledged basis that they will bring their leads list.
- notbeuller 3y ago
  Years ago I got a job through a recruiter, left company A for B. She called me after a few months and asked me for the Compsny A internal directory - which I declined to provide and she got kind of nasty about it. Maybe ten years later I was at company C and my manager mentioned hiring a recruiter - same person. I mentioned our previous interaction (not out of spite, just a naive narrative) and they stopped working with her immediately. My point being - your behavior has a long tail, so don’t be trying to take advantage.
  - bombcar 3y ago
    People asking for company directories amuses me so much, especially when most company email patterns are completely guessable.
    - htrp 3y ago
      it's more the name and the org chart? maybe the phone number too

serial_dev 3y ago

> We're talking hundreds of static sites where he took the all the design docs and static HTML/CSS/JS files one would need to recreate them somewhere else. You make it sound like he poached your clients or extorted your company. As they didn't go after him legally, I assume that didn't happen. I assume all the files are on a thumb drive in his drawer, unopened, just in case he wants to remember how "that cool animation" was implemented. And when that moment comes, he will not find the thumb drive, anyway. And all that security charade will accomplish is that people who care enough about their work, will make a copy the day before they quit. Congratulations, your policy achieved nothing, except get rid of their two weeks notice and everyone feel a bit worse working for you.

drewcoo 3y ago
Designers also need to show portfolios. Hard when your work is all behind some corporate firewall.
away271828 3y ago
I don't know the details but so long as its not some top secret IP, taking copies of various work you've personally done seems pretty reasonable. Good idea to do it periodically as you go along though.
Macha 3y ago
One thing I noticed is we got in the last few years a lot stories of the form "Adobe donates Photoshop 1.0 source code to Computer History Museum, saved because early programmer kept it on a floppy disc in his house". Or games especially we get a lot of this. It feels like if an employee did this with modern projects, they would at the very least be summarily fired, if not have legal action taken against them.
- nilamo 3y ago
  These days, we use centralized source control, instead of emailing zip files and patches back and forth. Having all the source on a random piece of media was a lot more normal back then.

fullspectrumdev 3y ago

So what stops people making their “backup of files” before hitting send on the email?

wil421 3y ago

Get a DLP system in place for god sakes. I’ve even seen off shore people work from VMs only where they can’t download or store any file locally, much less dump everything to a USB stick.

emj 3y ago
Top search result is from Gartner: alarm bells ringing. Data loss prevention seems to be enterprise speak for doing as much intrusive monitoring you can do, in as neutral speak as possible. 1984 is so appealing for so many people, it seems like it is just a book about the tendencies that power can take when it is not guided by sane principles. I have always been employed in a high trust capacity since I was a young adult, there is not a technically feasible system in the world that could prevent me from wrecking havoc in a company. Social ones though, they are extremely effective.
- dsr_ 3y ago
  Every so often a client asks if we are using a DLP, and if not, why not. All the DLPs rely on, effectively, regular expression searches of traffic. This is fine if what you need to protect are SSNs, phone numbers, credit card numbers... but if your data is not easily recognized that way, they don't work. If you ask the DLP vendors about their threat model -- and the salespeople generally don't know what a threat model is -- it's always a set of stories about a salesperson who clicks the download-as-CSV button on a CRM system, a DB reporting specialist who generates a report full of raw passwords and credit card numbers, and an off-shore programmer who sends AWS credentials via email. Hopefully you can spot the non-DLP prevention mechanisms for all of these...
  - oblio 3y ago
    > Hopefully you can spot the non-DLP prevention mechanisms for all of these... What is it?
- wil421 3y ago
  What does any of this have to do with theft? In most lawful places, if you dump source code and documents to take with you it’s not going to end well. https://www.cnbc.com/amp/2020/08/04/anthony-levandowski-gets-18-months-in-prison-for-stealing-google-self-driving-car-files.html https://www.cnbc.com/amp/2020/08/04/anthony-levandowski-gets...

weregiraffe 3y ago

But what would prevent someone from "downloading files" BEFORE they send the notice?

ajb 3y ago

In the UK, and most European countries, locking someone out during their notice period is really rare. Big companies exist and are not destroyed by disgruntled employees. If someone is fired for cause then they go immediately, but if they are given notice then they are usually trusted with access, and it rarely goes wrong. Stealing IP is rare because it's hard to benefit from it. If stolen IP is offered to another company, usually they report it to the owner to cover their backs legally. Funders are not going to want to invest in a company that is based on stolen IP, where their investment can become worthless overnight. So I think these stories about how 'we have to treat employees like they are potential criminals' (not accusing parent of that, but you hear them) are bugos. Treating people like human beings is both right and economically efficient.