Hacker News Reader

Comment by buf | Hacker News Reader

I've never been put in the situation where an engineer shared something alarming from a proprietary code base, but hypothetically if someone brought with them the code for how to hack superuser privs for an old company, that would be an ethics violation and I would pass.

View on HN

Well it does not matter if it's alarming or not. They are in violation of their signed NDAs with their previous employer.

Also, if they don't work there anymore, they should've deleted all the code (if they had it) and surrendered/cleared up all the laptops.

But I like your idea, anyway I give big kudos to candidates with their own pet projects.

Almost every employer will violate their employee's rights without a second thought in ways they consider "unimportant but necessary to the business" ... as long as that continues it should be a 2-way street.

The point is not necessarily whether it's morally wrong to violate a contractual agreement when the other party is likely to do so.

It's that the interview process proposed by the G[...]P may force the candidate to do things that may be illegal to pass the interview. The candidate is of course responsible for their own choices, but the point is that as an interviewer, if you force your candidates to do this, you might short list those who have a tendency to violate contract terms.

This might work out for some, but I'd say it's a fair point to bring up.

> you might short list those who have a tendency to violate contract terms.

An asshole filter https://siderea.dreamwidth.org/1209794.html (maybe you've read already?)

I'm familiar with the general concept but never read that specific article. Fun reading though, thanks!

Mmm, no?

I'm an employer right now in my small company. Don't see any reason to screw up my employees, on the contrary, I see it's much better to work in a friendly environment. There's no such "unimportant but necessary to the business" things.

"Almost every employer will violate their employee's rights without a second thought"

What's your source?

"unimportant but necessary to the business"

What examples?

How are they sharing their code? At my company things are locked down so tightly that I can’t move code off of company computers. I would have to look at the code on one computer and type it into a computer of my own. Unless people are doing interviews on their company computer or the company is careless with their code, I’m not sure how someone would even share their work code.

Not sure how locked your computer is but everywhere I've ever worked, it's been trivial. Email the source file, zip it and upload somewhere, pastebin temporary, airdrop it, usb sticks.

My client is in the financial industry and have to use their equipment as a remote contractor.

The win10 laptop is locked down tight, including removable drives disabled, DNS forced through corporate servers, SSH blocked outside network, etc. I wouldn't be surprised if all activity was somehow centrally logged for compliance too.

I had to request permission to whitelist my VPN account to access Github.com. Even with VPN disabled the laptop still uses corporate DNS.

The security policy is designed to prevent theft.

Of course there _are_ ways to circumvent these protections but you'd be in a world of legal trouble if caught.

Working in the financial industry as well, not as a contractor but within the organisation itself.

To add to the above (everything is quite the same in my case): pasting medium chunks of data to external websites is restricted on the system level, same for uploading documents/images; emails to non-corporate addresses are scanned.

You would do that? Now I'm beginning to consider if I should be asking candidates to bring some intellectual property owned by their current/previous employer as a filter.

I am not saying I would do that (I wouldn't). I am just not sure how a computer can be locked down so tightly that it is impossible to send text from it to another computer.

Posted a comment in the above tread. To add to that everything one sends to print is being monitored. That leaves a room for leakage but it also makes the leakage tracing relatively easy, unless you have stolen other employee's ID (which is required to print), but do we really want to go that far for a job interview?

There are, of course, ways, but some organisations make the overhead way too big to bother.

I personally know of a case where the 'core team' of a major payments processing system was running development being completely isolated from the internet due to security reasons. Need to check stackoverflow - sure - have a walk to the cabin where you have a dedicated machine connected to web for that. Oops, and no copy-paste, sorry.

I could just print out and bring a patent.

All of those things you mentioned? Blocked. As an example, if I even plug any sort of device like a usb stick or an external drive to my machine, the computer locks up and security is on the phone with my manager within seconds.

Interesting, seems like my companies have been pretty relaxed then.

Reply on news.ycombinator.com