Hacker News Reader

Comment by evrydayhustling | Hacker News Reader

For anyone else who didn't get that far the first time:

> Spiers' pop-up message was inserted into a tool that notifies employees of privacy and security concerns about using non-Google tools and services, like warning employees not to upload proprietary information to Dropbox, Spiers said. The tool is managed by the platform security team, for which Spiers worked for almost two years as a security engineer.

So, seems like the bulletin was pretty far outside the intended function and should have required more than a code review. I wonder what will happen to the people who accepted the patch?

View on HN

Exactly what does union activism have to do with security and privacy of potentially dangerous websites?

I’m surprised how many people are jumping through hoops to defend this sort of thing.

That extension is not limited to privacy and security concerns. One of the sites the extension warns about is Dropbox, and few people would seriously describe Dropbox as inherently insecure or as violating privacy. What is true is that some interactions with Dropbox may be in breach of other existing policies that Googlers must follow, such as wrt. proprietary information and the like. Googlers are also required not to violate labor law.

Dropbox has total access to your unencrypted files. That 100% fits the criteria. Especially in regards to file-access between potentially competing megacorps.

Again with the jumping through hoops...

> Dropbox has total access to your unencrypted files.

The application maybe, depending on how you set it up. Not the website itself.

And I’m sure the law firms homepage wasn’t turning people who visit it into antiunion drones either. What’s your point?

If the message was "I baked cookies, come by my office if you'd like to try some" do you think this person would similarly be fired? A person that was recently promoted, was designated as a high performer, (and I have nothing to back this up but seemed strategically recruited since they did not fit the google mould as a high school drop out?)

I think a reasonable reaction would be to remove the message from the extension, put in place a better review process, better training and possibly some minor negative comments at review time.

>If the message was "I baked cookies, come by my office if you'd like to try some" do you think this person would similarly be fired?

Yes I do. 100%.

>put in place a better review process,

This is your solution? The process was intentionally lax so that you wouldn't have too much red-tape when soliciting contributions. The assumption was that this wouldn't be abused by your Security engineers(!!). Your solution to this is to make the process more onerous because one individual couldn't behave like an adult? How about you keep the process as is and you fire the individual who couldn't differentiate activism from security work.

> If the message was "I baked cookies, come by my office if you'd like to try some" do you think this person would similarly be fired?

No, but I think they'd similarly be fired if they had written an anti-union popup. (Indeed, if someone wrote an anti-union popup and weren't fired for it, I expect that would itself have made the news as a "Google hates unions" story.)

> "If the message was "I baked cookies, come by my office if you'd like to try some" do you think this person would similarly be fired? "

Yes, immediately and for cause. Internal business apps at large companies are not your personal playground.

Reply on news.ycombinator.com