Maybe you should store passwords in plaintext

I worked for a startup from 2015 to 2022.

From 2015 to 2020, it was great. I (and most other employees) was working hard, and was consistently rewarded for my efforts.

In 2021, the company benefited from a huge boost due to the pandemic. Hiring went through the roof and the company became very performance focused. Unfortunately "performance" now meant "meeting your OKRs" and nothing else.

The company culture went through the drain. Most of the new hires were from FAANG and knew very well how to play the game. Whereas before, if you asked someone for help, they would help you, now the answer became "file a run ticket". After all, why would you spend time helping anyone? That's time not spent on your own OKRs, and that's literally the only thing that matters.

Nevertheless, I kept working hard. I was involved in multiple company initiatives, mentored new hires, still helped people when they asked for help, etc. After a year, when performance review time came, I got a "meets expectations".

I was livid, and asked my manager how that could be possible. He basically told me that he had no visibility into all the non-team initiatives I was involved in, and that it was my own fault for not making myself more visible and drafting my OKRs in a way that would have allowed him to justify why I deserved more than "meets expectations".

I refused to play the game and told my manager I was sure I could get "meets expectations" by doing a lot less. I basically slammed the door on all the side initiatives I was involved in and stopped doing anything besides "core work". I went from working 50+ hours a week to working 25-30 hours. I did not enjoy it -- I was actively miserable, and started taking steps to move on.

It took me nearly a year to leave the company (I was on a visa that did not allow me to switch jobs so had to obtain an H-1B, which took time). Another perf review came by, and lo and behold, I got "meets expectations" again.

I am so much happier in my new job, but I'm still salty about the previous company. What used to be a great company culture became a toxic, political, gamed environment.

(Oh, and of course they had a huge layoff round a few months ago. But hey, at least leadership "took responsibility" for overhiring.)

I agree with Nihilartikel’s comment. It’s nice when you’re the one doing business development.

But as a manager at any organization, the correct answer is to fire people like this because they become insidious and take over your business.

Have a moral backbone.

Is it fair? No. Lots of corporate decision making will never ever be fair. Deal with it, or work with these people. Find ways to financially incentivize morally correct behavior and exceptional engineering. The latter is important because good people leave and they’re literally worth more than your other employees.

Oh and by the way, they’re disgusting to work with, and regardless of your moral compass they will make you a worse engineer.

I worked with these types of people at my last job.

One guy didn’t know how to fork a repo and maintain an internal copy of a project with clean portable diffs.

The other was afraid of regular expressions and didn’t understand libc versioning.

Losers behave like losers.

My eyes really opened to this during the pandemic and its aftermath.

Working from home I did almost nothing productive. Got paid the same.

Returning to the office, I noticed half the people still seemed to be working from home most days, so I started doing that too. And did almost nothing productive. Nobody apparently noticed or cared. Got paid the same.

Got the same raise (yes, below inflation).

So now I have given myself a >4x raise by working about 10 hours a week of real work (and that's a high estimate). I work on whatever tasks are currently on the radar, do the least amount necessary, and ignore everything else. I get paid the same.

The movie Office Space is about this exact problem. Why go above and beyond the bare minimum when management doesn't care? (And then is so oblivious that they fire some of the hardest workers?)

I'm personally the sort who gets frustrated when there isn't enough to do or when it's clear other people on the team aren't carrying their weight, but I can't say I blame the "why try harder than I have to" crowd, but I try to avoid companies with that culture. I've seen some companies avoid it by trying to punish and fire people to ensure a 'minimum quality bar'. That works better than letting obvious negligence slide, probably, but still isn't particularly motivating to go above and beyond. The "pay well but make it understood that you're paying for quality" method is way better as long as you still keep a close eye on that quality and it doesn't just turn into "pay well and screw around" (it's not hard to find stories of this in FAANGs in the past decade).

I can’t speak for others, but for myself it’s next to impossible to live a good life while working a job where I sink into a “plaintext passwords” type of mindset.

That being said, I don’t really envy that mindset, I suspect there’s something fundamentally broken about a mind that’s resigned to treating a supposedly symbiotic relationship as adversarial, even though it may be a warranted reaction given how so many companies treat their employees.

"Not being rewarded with money seems to be the common theme here, but financial incentives are tricky to get correct"

Giving pay raises which exceed inflation for someone who meets expectations (in anonymous peer reviews) is tricky?

Ensuring expectation meeting employees pay stays in line with market rates--when the company knows the market rate because they are hiring new employees--is tricky?

Even if one argues it is not possible to accurately measure performance (or to get honest reviews from peers), punishing everyone because some employees may be underperforming is clearly not the solution (it will only serve to demotivate or drive away previously motivated and happy employees).

And to be clear, reasonable pay raises is not a solution to all of the problems the article is talking about, but it's a simple place to start.

It really depends where you work, you role and what the incentives are.

You are young and working in a small startup with revenue share? Yeah, go wild and try to leave your mark! Just avoid getting burned out!

Boring corporate job and have family to feed? Don't rock the boat.

Though generally, don't. Best case you will make other people richer. Worst case is it backfires and you get more work assigned.

If you want to advance your career, work on your social skills. If people like you they will automatically rate your job performance highly. Conversely your programming skills are pretty worthless if nobody wants to work with you.

Might be cynical but that is how it works.

In healthier workplace cultures, this kind of don't-give-a-shit behavior is socially stigmatized, while behaving like someone who wants to do things right is socially rewarded. It's easy to forget, but not all incentives are measured in dollars.

I'm not trying to go full Confucius here, but people who do better work than they have to shouldn't be made to feel like chumps by the people around them. They should get respect, so they feel good for doing good things.

The incentive to not act like the slackers is how it impacts your "network". It's pretty insufferable to work with these people, when the success of your project depends on them or their team for whatever reason.

If our team is hiring and I see a former coworker got laid off who was a slacker I won't put in a referral for them. I guess it won't impact them much, because tech is still growing and demand exceeds supply, but at least it will keep my work slightly more enjoyable. A job well done is it's own reward.

I think personally it's important for people to realize that people are creature of habit. A person who has the disicipline of going extra miles and strive for excellency in their work, regardless of compensation, is likely to carry his habit across different jobs or even when he decides to do his own startup or anything non-work related. I think this is such a good habit to have will prove beneficial sooner or later. A lot of people think they will just work hard and do their best whem they need to, and take it easy for now at a corporate job. Personally I don't think work-ethics can be switched that easily, it has to be built.

I've done the AWS thing. We spent over $1 million on AWS and I couldn't be bothered to care. We were in eternal crunch mode, 10-14 hour days for 6 months. If I spoke up about AWS waste I'd get ripped apart by upper management.

Eventually it became apparent what was going on. I was pushed out and went to a competitor who paid me more and had better hours. I gave that competitor a lot of information about the previous company and transfered a lot of my knowledge. I delivered quite a bit of value rather quickly because of that and was recognized and rewarded for it.

We work in an enormous industry. It doesn't seem like there are any consequences.

“You don’t get rewarded for being extra. You don’t get any money when you save costs. You’re going to get a raise below inflation. You’re stupid for caring the way that you do. The business’ downside risk is not yours, and it’s profits are not yours either.”

Except when you're granted RSUs or participate in some private company's profit sharing scheme. So if that's important to you, find such a place. The smaller the company, the more impact you can have on their profits.

#3 (mediocre work after an effective pay cut) doesn't sound at all unreasonable. In effect those people are getting a pay cut and decided that investing effort to be "top-notch" is not justified. They're doing a mediocre job - by definition middle, not low quality. The author tries to paint this in a very bad light but I think this is a mentality of "it's bad because someone else does it".

For some of those people the issue is not financial but one of respect. A little spit in their eye is still spit in their eye.

What's a reasonable amount to cut from an agreed payment while still expecting top notch quality? How much does the author like to give up in such conditions?

I am basically that employee in several ways.

I know about wasteful cloud spend that I do nothing about. My last comment on HN actually was asking if anyone could give me a reason to report that cloud waste. The best arguments were for the sake of the environment and to build credibility with co-workers to make it easier to jump ship. Nothing from the company at all.

I can't say I deliberately ship bugs, but I don't care that much about eliminating them. If I were not worried about legal issues, I would investigate whether we had a bug bounty program and give them to a friend to collect and split the prize.

And yes, I use the same password at my multiple full time jobs. If you knew my email, you could find that password in a password leak on the internet. So my password has already leaked. It is out there, tied to my name.

> This group of people seem to have been like that at some point in time, and then turned to “misbehaving” in this manner.

I was like that. I like creating stuff. I like building great experiences. But working as a corporate employee is an extra painful way to do it in many cases. I enjoy finding weird bugs and figuring out the fixes. But everything from the Scrum to the layoffs to the executives trying to drag you in for corporate team building events to the non-technicals who don't have a clue what you do makes it not worth it to engage at work. The project you care about will be carelessly tossed away in a reorg. You will be judged based on output report from Jira, which is actually an incentive to ship as many bugs as possible because that increases the number of Scrum points you have done.

Is that really what you want for your life? Sounds miserable to me. I want out. And I do all those things to get out as soon as possible.

So what is the endgame? Spend time working on cool things myself while doing all I can to minimize time work takes from my life. Cut every corner to save effort, from the passwords to the utter eradication of any speck of initiative. Work multiple full time jobs to accelerate progress to retirement and slash output at those jobs to make way to even more jobs, further accelerating my workforce exit.

There’s no black or white here.

You’ll be on both sides of this depending on your phase of life and the incentive structure at work.

Reading things like this reinforces the satisfaction of being independent...

When I inevitably notice these issues in the course of work for a client I can bring them up with the one writing the checks.. if they want it fixed, I fix it. If they don't, well there are other clients.

The quote at the end of the article really sums up my feelings:

> “I think the real answer, the real answer […] this is going to sound weird or bad – is to cajole or trick your employees into thinking that what they’re doing is important.”

Basically I like to fix things at work because I get some sense of satisfaction by doing things the "right way".

Of course this feeling can be worn down, other coworkers not caring, management not caring, etc.

And then you end up in a "work to the contract" mentality, which is what the "store your passwords in plaintext" people seem to be doing

In some ways it seems related to Goodhart's law "When a measure becomes a target, it ceases to be a good measure" https://en.wikipedia.org/wiki/Goodhart%27s_law

Something that I feel like I disagree with here is that it doesn't take into account all the intangibles that you get from working hard. Personally I work hard and I feel like I get:

* Appreciation from my manager and team, who I respect and love working with. * New knowledge that I can use later, and possibly build trust with others. * Influence that I can use later * The good feeling knowing I solved a problem for my business and hopefully letting them spend that money or effort elsewhere. * Some sense of job security

This is probably a very Pollyanna view of the world, and maybe it's all because I have a good team and manager. But nevertheless, I feel like I hit the lottery as a programmer. It's enjoyable, the work changes day-to-day and it pays well.

Great article. Sums up what I've observed over my entire career. Incentives are orthogonal at best to what is actually good for the company, and at times, doing things that actively harm the company can be the way up the ladder. We're worse than bad at measuring and rewarding good performance.

I can’t even imagine how crushingly depressing it must be to spend 50% of your waking hours working with this kind of attitude

Good security practices are in this unfortunate category where:

1) The actual risk calculation is somewhat nuanced, but advocates are very clearly on the right side when you do it.

2) The advocates drastically oversell it as a coping mechanism for it being hard to convey nuanced issues, and even come to believe their overselling.

3) Some who go along at first gradually gain some intuition that they've been lied to, and wrongly conclude or begin to behave as if the advocates are on the wrong side.

In the case of storing passwords in plaintext, it causes a low probability increase in chance of a some very bad outcomes.

It can be correct that it's well worth mitigating, while also being a hard calculation to reason about and find salient. If we compensate by treating it as if it's a high probability event in order to get everyone t comply, and begin to believe it ourselves, people may eventually notice that not everyone is compliant, but they never see anything bad happen in their immediate surroundings, become increasingly lax themselves, notice nothing bad is happening still, etc.

Seatbelts are maybe a counterexample to my point here, where people have come around despite their personal experience never including an accident. Maybe with the help of laws, or maybe more because it's personal risk to self. Or maybe it's just that enough people know someone who has had a bad car accident even if they haven't themselves.

There are people like this everywhere; the lack of overall caring has been happening, i'd argue, for quite some time. From physical construction to tech jobs; people want to get the job done (and cut whatever corners as they can), to get paid and move onto the next job. Can we really be surprised?

Take a good look at any part of any construction that goes on, from the concrete to the finishing paint jobs and I'm confident the more you look the more you will realize folks either do not pay attention to detail, or they simply do not care. It goes deep into all corporations, especially when buisness-is-booming; gotta move onto the next client to get more cash!

The same can be said for what items we consumers get as well; Apple selling laptops where the cords turn yellow, plastic freys and expose wires after 8 months of use; Samsung has similar issues, and the list goes on.

Now take a look at the products spammed at us via Amazon; searching is abysmal (search for an audio cable, get results for usb cables instead). Want to check the quality of an item? Better order it and return it later when you figure out it is trash.

Long dead are the (deparement?)stores/(big?)corporations/people that had at least some caring about others. What was once normal is shifting, and it has been for years.

I am curious if the dude writing the article did raise up said concerns of fellow employees to their (respective?) boss(es); essentially if management does not prioritize caring is said issues, why would the lowers care about it?

>> "They pretend to pay and we pretend to work"

I have a monitoring instance which monitors a couple of URLs of some client. Every now and then something is wrong somewhere and it's spams the messenger with 'not available'. In a minute it spams again, now with 'Resolved' status. I can just turn the trigger time to two minutes or change it to trigger only after a two/three consecutive failed checks... But should I?

Not only it wouldn't change how much I receive for this service (a pint of Guinness/mo, really), but it also would make it look like the monitoring isn't monitoring. I don't want to make proofs what it's actually working.

Bonus point: if I receive the alerts I know what the monitoring works.

And to the TFA: I made a proper VPN network for a client a decade ago: a VPN concentrator, dual path through two ISPs to the main office with the on-premise services, 15+ branches in the city, a couple of remote ones. Except I didn't buy Cisco gear, but some, ugh, not quite enterprise gear running FOSS solutions. Did I got anything from it? OFC no.

I disagree with the author that normal people don't think this way. Most people I know won't go out of their way to help their employer. In my experience you can usually find a few people who care about doing things right and they work hard, are passionate, go above and beyond, etc. Almost everyone else is in a different lane. Some are in the far right lane, where they cleverly exploiting things (as a few people mentioned in the article) but most are somewhere in between.

I don't think there is really anything you could do about it. Mostly people don't want to work. They do work for money. They won't do more work than they need to because they don't want to do that. These people also don't want to expend more energy than they have to. They won't do something hard that solves the problem if doing something easy won't get them in too much trouble.

Ownership. This is literally why the employees should own the company, or at least get significant ownership in terms of stock.

In every one of these cases, especially the AWS waste case, an employee with ownership in the company could see a direct monetary benefit from fixing the problem, especially at a small company.

Maybe there's engineers / developers working like this. Most likely it's a reflection of company culture.

But there are real-world repercussions of just plain bad working practices

* https://www.abc.net.au/news/2023-03-27/whats-happening-with-...

It's not as bad as a bridge falling down, but this is why there's professional bodies and code of ethics in certain professions.

Sorry this isn't the purpose of the original article, but does anyone want to give a way secrete should be stored? Even if I use secrets manager for example, I need to store the token for fetching it so there is always a secret or token that needs to be stored.

I might not store an access token, I might use user auth and get a temporary token for a script that then calls to a secret manager. The access token is cached locally in plain text. Is tbis more secure since it's a token with expiry?

"cajole or trick your employees into thinking that what they’re doing is important"

Relevant Subnormality Comix: https://viruscomix.com/page477.html

Yes, bad management exists. That's the #1 reason people cite for leaving companies. The problem is when you allow bad management to not care for your craft. If you find yourself copping the attitude of screw it, I get paid the same - then it's time for you to move on. Over time that attitude will rot you from the inside out.

The way I go about it is that when I find it, I raise it politely, I offer to drive the fix, and then I add it to my resume, and then I tour with it, being "The Guy Who Fixes Things". That way I do get something, even if I'm completely detached from the original thing.

> Is there some way to correct this? How do you reward good behaviour here, and discourage “misbehavior” like this?

…Yes? As the employer, find ways to be as generous and rewarding as possible. In immortal other words, “Fuck uou pay me.”

Every example provided was “I went above and beyond and was not rewarded for it.”

The fix is rewarding people for it.

I am a chump. I've SEEN passwords in plaintext and I even tried to remove it by figuring out how to remove it from git histories.

Heck, for one of those where it was not possible to get rid of plaintext due to the architecture, I even wrote some code to compare hashes instead of password so at least the attacker would need a rainbow table to crack it. Didn't bother salting it, since there's only one user effectively.

But meh.

Life of a chump, ain't getting no promotion and got the lowest possible bonus last year. It's better to be a chump cos I can feel better about myself

> Another person simply doesn’t care about shipping code with bugs, and maybe even tries to. They get to shirk actual development duties by fixing their own broken code instead, and the fixes are celebrated.

In one of the companies where I work, there is a chronic lack of hours for a few freelancers who were taken on with promises of full-time work. They compensate by shipping code with bugs, generating a bunch of bug reports down the line. This compensates for the missing hours. And as performance is evaluated in terms of the number of tickets closed, it also improves their standing in the workplace.

Horribly cynical, and I can't imagine having that viewpoint. It's actually fascinating how the author first justifies that sort of malaise, and then does the "but of course not me" thing.

Even if someone were that self-focused, in almost any group or organization, critical security vulnerabilities and significant costs do hurt everyone in the group. You're going to be the ones having the rough time when expenses exceed value, and when major embarrassments happen. There is no insulation from it.