Hacker News Reader

Comment by solardev | Hacker News Reader

The best office prank I ever pulled was on a fellow dev, probably the smartest guy in the room. He came back from lunch and all of his apps stopped working. He couldn't launch anything. He restarted the computer and still nothing would start. He eventually figured out that launching an app from search works, but nothing would launch from his desktop shortcuts.

That's because while he was having lunch, I took a screenshot of his desktop, set that screenshot as the desktop background, and then hid the dock and deleted all his real icons :) (Well, put them in a folder for easy recovery).

He just kept clicking and clicking on that screenshot for way too long. Best 15 minutes of my life...

View on HN

Never in all my jobs except for one, inappropriate one that I actually quit, would someone even dream of sitting at my unlocked computer without my permission and acknowledgement and do stuff behind my back be it pranks or admin stuff. It's beyond taboo, it's something that might get you punched in the face around here.

Where i am, the offence is leaving your station open for others to mess with.

I work at a SOC2 audited business and had a coworker who would routinely leave his PC unlocked. I would routinely set his desktop background to My Little Pony. He would routinely get grumpy at me and tell me not to touch his computer. I would routinely tell him I can't touch his computer if he locks it.

It was a great way to train someone to follow SOC2 requirements.

I always put salt in my coworkers unattended drinks for the same reasons. It's their fault, really.

Can you please link the relevant security documentation which specifies all drinks should be tamper resistant?

I believe it's a sarcastic comment to make the point that just because something should be secure, doesn't mean you can go in a fiddle with it.

Ianal but I don't think it's a valid defense to walk in to a bank, find an unlocked safe and take all the money to make a 'point'.

Further, you're just normalising messing with other people's accounts which doesn't seem to be a good thing from a security pov.

The reason I asked for the documentation is because even your bank example falls short - my coworkers and I are trained in and expected to follow SOC2 requirements. Taking the job in the first place means explicitly agreeing that you will follow the SOC2 requirements that we adopted because our customers said "we won't host data with you unless you are secure and audited."

I can see an argument that I shouldn't be a "vigilante" about making sure people follow security practices they agreed to when taking the job, but we are all responsible for the security of the business. A repeat offender coworker who doesn't care about the security consequences of leaving their PC unlocked is a security risk which needs addressed. This isn't just a case of messing with a friend.

Further, the PC is company property and subject to acceptable use policies. It's not "my computer" so I have no reasonable expectation that it is a sacred object other people won't mess with. Assuming others won't mess with your things is a terrible reason not to lock your door at night. Getting angry at a burglar for entering because you failed basic security misses the point of your failure.

My repeat offender coworker got over his indignation that I touched his computer and then started doing what he was required to do the entire time and locked his computer every time he got up. I stopped touching his computer. He didn't get written up or fired for repeat security failures, and all was well.

An unattended beverage cannot cause harm to users that placed their trust in you.

I've heard that the culture of some workplaces can even encourage this, as there is training value for developing good habits (though I haven't been at an organization like this myself).

The idea is that users are trained and regularly reminded to always lock their computers when they step away for cybersecurity. So, if they forget, their computer is relatively harmlessly messed with (like with changing the desktop background).

The consequences are then trivial, in contrast to potentially severe if a person left their computer unlocked with unvetted people coming in and out of the office during an event, or if they left their laptop unattended in a public area.

I work at a fairly large firm where we do this. If you leave your computer unlocked it won't be long before "you" announce in the company slack that you'll bring cake on Friday. Or something like that.

Some people still leave their computers unlocked somewhat frequently, but overall I think it works.

Similar here. We are really trained to lock when leaving the machine. One co-worker when pressed into coming with us for lunch did it blindly and after some seconds and finally a glance at the screen wondered why the lock screen did not come up. He accidentally had pressed shift-delete instead. On the folder he had worked on without committing the whole day. m(

I have been locking my computers by habit since I was a child. To this day I will lock before walking away to even use the bathroom in a house alone.

I even noticed this locking behavior a few weeks ago and chuckled at myself. That Windows+L motion as I get up is just so ingrained.

If I'm not actively in front of my PC it is always locked.

The team at my first tech job did this; I left my computer unlocked and stepped away, came back to find "I" had sent a joking message to the team saying that I forgot to lock my computer. It definitely trained that habit into me, I lock my desktop when stepping away even at home.

I think it's probably a good technique, though it needs to be done with a bit of care to not seem too hostile or humiliating. Changing the desktop background seems like a good idea, since it's harmless, obvious to the user, easily fixed, and doesn't impede actual work.

I worked on a team where, if you left your computer unlocked, someone would send an email (from your email) to the rest of the team letting everyone know you were bringing donuts for everyone the next day.

You learn a lesson, and the team gets a treat.

This is exactly what we did and why we did it in the early 2000s. The company (of about 700 people) standard was "baggy pantsing"[0].

Of course there was etiquitte. You only ever emailed smaller groups (your team, your floor, rtc) - never all staff. You always explained to a newbie so they didn't feel too embarassed or singled out - and they always got a heads up during training.

Our small team of 15 got pretty crazy though. Rebinding keys, replacing all the icons with My Little Pony or Hello Kitty custom sets, etc. It became a good competition and a great way to blow off steam in a high output role, and as a byproduct built in good physical security.

0. https://securityintelligence.com/dont-get-pantsed-embrace-a-...

Just for context, we were quite young, and it was quite a small business. It was a mom and pop that started as a mail-order catalog, and we were hired to modernize their web presence.

Now, by "web presence", it's true they had a website. And it was made with HTML. Lots and lots of HTML, in fact, as in thousands upon thousands of hand-edited, non-version-controlled files on disk that they'd manually curated over the years.

We didn't exactly have a cybersecurity team or defined best practices. But we were treated well and worked together well. (Still friends with that dev a decade later!).

It was also a really small town. We all hung out after work, went to the lake, climbing, whatever. Lived a few houses apart from each other (or sometimes in the same house, lol). We trusted each other. Had to. It's the kind of environment where relationships took precedence over rules.

Looking back, it was definitely an uncommonly intimate situation, but it was awesome!

I'm not sure you're a very fun coworker - also, using anger/taboo to cover for lax security seems a teeny bit toxic.

It is extremely unprofessional to leave your computer unlocked at work and I consider it a sign of gross incompetence

You think punching someone in the face is ok, but changing there desktop background is going to far?

> might get you punched in the face around here.

Damn! I'm glad I don't work with people riding on the edge of being violent like that.

It’s fun and game but nowadays if someone didn’t lock their computer when away then we’ll have a security incident to report

It gets better. I think it was actually set to auto lock after a minute or two, but I had practiced the routine on my own computer a few times first and managed to get it down to like ten seconds.

He went to the bathroom right before heading out for lunch. I had my window. I did it quickly, and then joined him for lunch, keeping a straight face the whole time. When we came back I nonchalantly asked about some code for him to review but he was like hold on...

Didn't suspect me until way too late :D

But then after that, every time some random error popped up, he was like... "solardev, what did you do this time!" Fool him once...

If someone on my team leaves their PC unlocked I usually start writing a self-incriminating email to cybersecurity on their PC before locking it.

I've recently been driving a policy at my workplace that if you find a PC unlocked, you send out an email blast promising donuts (also copying in the victim). The victim then has a choice: admit to a security breach and have to sit through a training session, or follow through with donuts. This incentivises reporting, and disincentivises leaving your computer unlocked through social, economic and experiental means

My best prank was loosening the plug for my buddy's keyboard. It was perfect because:

- The guy was always making fun of everybody else

- I did it while talking with him in his desk so the others could see what I was doing

- I just loosened it, not unplugged it, so the keyboard stopped working after a while, when I was already back on my seat

- Everybody was LOL and he had no idea why, just complaining the damn computer hanged

Sounds like harassment.

I used to enjoy having the screensaver show a picture of a BSOD

Infact Sysinternals used to have a screen saver scr file with a selection of BSODs from various operating systems

xscreensaver still has this. I have it on my laptop. Sometimes it triggers when I'm out consulting. Clients think the machine crashed. How could you not notice this is a crash screen from HPUX?

I believe this (or a descendant) still exists in Fedora, and it got my fellow Linux user coworker to double take once :)

At work I tried the XP background that looks like the LCD cracked, and a picture of IE with ALL the spammy toolbars installed (such as Bonzi Buddy)

We did this all the time in high school and it was never not funny.

Windows 98/XP pre-YouTube was a really fun time for “you’ve got tech but you still have to make your own fun.”

Before a certain school presentation I moved all the power point files into the windows startup folder and turned off the machine. The shenanigans that ensued had my friends and I laughing for two hours straight.

> deleted all his real icons

Everything else you've described is amusing but if your recovery had failed, that's close to a fireable offense.

Having icons on the desktop is the real fireable offence.

Having 500 MS Office files on the desktop should be the real fireable offence!

Using the recycle bin as a filing system should be a fireable offence.

I did some contract work at one site where they stored files in C:\Temp.

A lot of programs store files in c:\temp.

Users shouldn't though, I'm talking about Word documents, PowerPoint files, etc.

My goto folder name when I don't know what to name it is temp. I have so many temp folders around. Never seem to get around to renaming them something more meaningful.

I go with fubar, and old_stuff when I need a folder to work in, or dump stuff into to clear the Windows desktop, etc.

Haha. I did the exact same thing to a boss. We all had a good laugh and he stopped leaving his computer unlocked.

At one company we talked about doing the ultimate version of that prank (which ultimately would make it easier to discover)…

1. Unplug the mouse, 2. Cover the mouse sensor with tape, 3. Replace the desktop with a screenshot, 4. Flip the screen 180 degrees, 5. Print out the screen, and tack it in front of the monitor…

A more elaborate version of this prank is to combine it with two more steps: unplug the mouse (or turn off Bluetooth), plus also put tape or a sticky note on the underside of the mouse, covering the sensor. Voila, they will have to troubleshoot the malfunctioning mouse three times in a row.

I am more disappointed that any dev would use desktop shortcuts...

What? Why?

Agreed, what a bizarre thing to say.

Windows key, then start typing what you want.

Of course, on windows, you’ll have to disable bing search for this to be reliable.

I still use desktop icons for some things, but the windows key for launching is just much better/easier.

Windows key + 1/2/3/4/5/6/7/8/9 will also launch / bring to focus the matching icon on your taskbar.

I don’t know the Mac equivalents. I believe Gnome and KDE work similarly to windows.

Windows key + 1/2/3/4/5/6/7/8/9 will also launch / bring to focus the matching icon on your taskbar

Thanks, I didn’t know that!

I never use the desktop, hell for a period of time I used only tiling window managers. I wish windows would have tiling mode.

for windows, keyboard shotcuts, hotkeys, and win + search are far far more effective than a bunch of shortcuts on the desktop,

I can not remember the last time I even looked at the wallpaper of my system.

FancyZones is a good alternative to tiling on windows. It combines best of both worlds, imo, is very easy to configure, and there’s apparently no tool like that for linux.

Also I find clicking on an icon faster than typing, especially when your mind is too busy to recall the exact name but the muscle memory knows where it is, or when the interface of a program assumes using mouse anyway. (Although I have to admit that most of my “desktop icons” are actually start menu tiles.)

So while I understand and agree that different workflows exist and you have yours, I still don’t get why you should be disappointed by someone else using another one or having desktop/icons at all.

Of course it is a nice prank, but best 15 minutes?

The secret to happiness is low expectations :)

Reply on news.ycombinator.com