Hacker News Reader

I have had several conversations where I explained that the consequence of a policy decision would be negative, and then the policy was rolled out anyway.

For example, I explained that if it takes a foot-high pile of paperwork to obtain an internal use SSL certificate, then the highly predictable outcome of that policy is not "greater security", but unencrypted HTTP everywhere.

The inevitable response to such feedback is that "people ought to do the right thing", which is laughable on its face. Nobody, and I mean nobody in their right mind will subject themselves to months of paperwork, procedure, and pleading for something that they consider to be optional.

"But, but, the right thing is for them to jump through those hoops anyway!" is the typical response to such logic.

This kind of argument is just futile. Someone up high has decided that they know better, that human nature will bend to their will, and will forge ahead despite being told they are wrong.

I've worked at companies that had inane policies with perverse incentives. And, it was pretty funny in a "A Confederacy of Dunces" sort of way.

Compare that to other companies that practically gave out no-limit credit cards and full access: imagine which companies attracted the best talent.

But, it amazes me just how long a company can survive being just mediocre and siloed. You often don't see the long-term effects until after those who implemented the policies have left or been promoted. I often look up those companies to see how they're doing. And, they're still chugging along, being barely profitable.

One story that stuck with me - at FB (at least in the past), there was no travel budget, and no list of sanctioned hotel chains. Any employee could travel as often and as expensively as needed with only their immediate manager's sign-off (unless their job requires weekly travel, in which case - no need for any approval). The only control they put in place was that every week, the top 10 bills would be reviewed by Mark, and you didn't want to be on that list if you didn't have a good business reason. Trust encourages people to do the right thing, and people flock to positions where they are trusted with the tools for the success of their mission...

Preaching to the choir here, but I've been doing security for a long time and the only consistent way to make it work reliably is to make it invisible to the users it should apply to. It should add zero friction to what they would be doing anyway and ideally be the easier option. It's not always possible but having that as an end goal makes processes much more successful.

Its usually higher ups trying to get out of responsibilities. Force the lower tier out of using company systems, and the administration is "home free" upon incident responsibility.

> leaders rarely seem to think hard enough about the possible outcomes.

This really annoys me about politics. They seems to reason as: We have problem A, so let's do solution B to solve this. And then the reasoning ends.

What should happen is to evaluate all the consequences of solution B. And sometimes those consequences work in such a way that they make problem A even bigger.

Reasoning about an interconnected system is crucial here. And as developers we are very well aware of systems and the impact changes can have. But it seems a lot of people are not able to reason about systems.

Many humans see themselves as independent absolute monarchs of their world. The reality of "we're all part of an interconnected system" is so incredibly offensive on some super-sensitive egotistical and narcissistic level that they will literally become violent to defend it.

If there's one thing we should be teaching in schools, this is it. You can leave school and have no clue that everything is connected to everything else, and that if you're not focused on that reality your actions can have completely unexpected and counterintuitive (to you...) consequences.

> Extremely well put. Any time a business decides on a metric / decision criteria, they introduce a strong incentive for their employees and managers to act accordingly. For some reason, leaders rarely seem to think hard enough about the possible outcomes.

I’m so tired of this advice. Maybe metrics are bad, but the only thing worse than metrics is no metrics.

Discouraging an action just because it doesn’t work 100% of the time doesn’t seem efficient either.

The argument really should be that certain metrics are bad. Sure, propose a better one, but saying that leaders don’t think hard enough just because a metric turns out to have ill effects seems useless advice. How can you be certain in advance when you have thought hard enough?

A better approach is probably to recognize that metrics are hard. Keep an eye on them, iterate, and be willing to make mistakes as that’s the only way to improve.

A better approach is to avoid min-maxing on metrics. You can be aware of metrics without making them your exclusive focus, bond and duty.

A good rule of thumb is when you find yourself making "obviously bad decisions" because you know as a result the metric will go up, not because a generally favorable outcome for the business is expected to be the result, then you might be a redneck middle manager driving the metrics.

No one should generally exercise tunnel vision and you should not be completely focused on metrics. (Although it might be OK to have one person in the business whose job is to maintain the tunnel vision, if you're telling the whole company to do this then you are likely creating blind spots that will come back to haunt you.)

If you focus on driving up the metrics it can be at the expense of the vision. The business is not the metrics, and the vision is not fully defined by the metrics.

Have some metrics, but don't make it obvious that the org must max this or that metric, or that x level must be reached. If you do that, the genie will find an ironic way for you to reach the targets without satisfying anyone.

Add autonomy and judgement for the managers, along with a battery of metrics that aren't binding.

Everyone will see that it doesn't help to sign up loads of customers while having loads of complaints coming through the helpdesk, or having loads of extra helpdesk staff with no sales. Where the balance goes is judgement.

Success is one of those nebulous things that can't be described sharply, but people often have an idea of how things are going anyway.

>For some reason, leaders rarely seem to think hard enough about the possible outcomes.

I think it's the same issue politicians have. No one of those in power ever thinks of unintended consequences. My guess: it takes a special kind of anal person to actually want to get into power (and thus to eventually get into power) - and they just can't imagine people acting not according to their great master plan.

> So, naturally, even since then there have been zero people fired, even if they are low performers, since managers want to keep their headcount. But talented people obviously still get offers and leave, and when they leave, their headcount disappears.

This sounds like a former professor of mine who would order phones and tables for everyone from the spare money on the end of the fiscal year for "research purposes" since otherwise the department would lose the budget.