3 ms·

Delete the backdoor code, with a commit message saying you have removed a security vulnerability. Watch them try to defend leaving the backdoor in the system (f

Delete the backdoor code, with a commit message saying you have removed a security vulnerability. Watch them try to defend leaving the backdoor in the system (favorite excuse I've heard is 'we need it for troubleshooting!') - they can rollback the commit if they really want the backdoor in. Send out resume.

eli 14y ago
That seems kinda passive aggressive. Either complain through the proper channels... Or don't. But being sneaky doesn't help your cause.
- wpietri 14y ago
  That's not being sneaky at all; it's in the commit logs and he can announce it. It's just shifting the burden of action back to the people who want the vulnerability. In theory, the same. Practically, very different.
  - eli 14y ago
    It's obviously not just a regular commit and everyone involved would know that. The commit log is not a proper place for a thinly veiled ethics complaint. If you think something is wrong, have the courage to say so directly, don't hide behind a commit message.
    - Mz 14y ago
      Since they claim they won't use it and he says it was probably a mistake, this sounds to me like exactly the correct response: Let them save face and "agree" with the change if they are so inclined. A high handed accusation of an ethics issue does not look supportable at this time. And it is likely the worst thing he could do.
    - wpietri 14y ago
      As both employee and employer, it's my view that all employees should what they see as the right thing by default. Personally, I think the poster should make the change and then announce it. I'm not saying he should be cowardly. If anything, I think the cowardly choice is to futz around trying to get consensus an elusive around doing the responsible thing.