Hacker News Reader

Comment by at-fates-hands | Hacker News Reader

I worked at a large web dev company and for years they had this attitude.

Then one designer put in his two weeks and spent the majority of the time downloading all the site files for all of the sites the company had built over the two years he was there. We're talking hundreds of static sites where he took the all the design docs and static HTML/CSS/JS files one would need to recreate them somewhere else.

Instead of going after the guy legally, they passed and then instituted the same policy. You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out. The one designer totally ruined the company from ever letting someone stay for their two weeks.

View on HN

Anyone could have done that at any time. The two weeks isn't magic.

It could have been unannounced and they just stop showing up.

You either trust your people or you don't. If you don't, get rid of them and lock them out. If you do and you still have to let them go then don't worry about it.

People are far too inhuman in professional relationships and I strongly dislike that tendency. You likely spend as much time with your colleagues as your spouse, make it a real connection.

But once they receive the bad news, their motivation for revenge increases, which is why similar policies exist in many workplaces. Trust isn’t a univariate, piecewise defined function like you suggest.

Right, if you're being a dick then sure. I'm advocating for not being one in the first place. That's the challenge.

If you can't meet that use keycards instead of keys, voip instead of real phones, lock file cabinets, I mean go all the way.

Corporate America loves pretending. Pretending you're part of the family and then treating you like you're trying to rob the place at the drop of a hat.

That's the messed up thing. Be consistent and don't be fake. People can deal with you for being overly formal and paranoid but probably not for being a phony backstabber, that's how you grow haters.

The hardest thing for a brand to shake off is a bad reputation, whether they justly deserved it or not. You don't want haters in the Internet age.

I think people in general are a lot better about being fired if it doesn’t happen at the drop of a hat. Unfortunately in the US it seems like you can go from gainfully employed to jobless in the space of an unfortunate 10 minutes. That’d piss me off too.

I think it’s a scale thing, honestly.

Yes, most reasonable adults remain reasonable even after fired

But once you hire a thousand, ten thousand, a hundred thousand people… statistically there are gonna be some wackos you didn’t filter out!

It’s tough. I agree that treating each other like humans is the best policy.

Of course it increases. That's why you have permissions and guard rails on the employees in the first place. Those should be sufficient.

Also if you want to work with the people you like again but need to actually downsize because of external pressure, good luck trying to get them to come work for you at your next venture after some fucked up bridge burning ceremony.

You also have the situation where the boss usually KNOWS who might do things that he shouldn’t - but you can’t have policies that only apply to some, so they get applied to all (there are still unofficial ways around this, of course, like letting someone know unofficially before they’re officially laid off).

> We're talking hundreds of static sites where he took the all the design docs and static HTML/CSS/JS files one would need to recreate them somewhere else.

You make it sound like he poached your clients or extorted your company. As they didn't go after him legally, I assume that didn't happen.

I assume all the files are on a thumb drive in his drawer, unopened, just in case he wants to remember how "that cool animation" was implemented. And when that moment comes, he will not find the thumb drive, anyway.

And all that security charade will accomplish is that people who care enough about their work, will make a copy the day before they quit. Congratulations, your policy achieved nothing, except get rid of their two weeks notice and everyone feel a bit worse working for you.

Designers also need to show portfolios. Hard when your work is all behind some corporate firewall.

I don't know the details but so long as its not some top secret IP, taking copies of various work you've personally done seems pretty reasonable. Good idea to do it periodically as you go along though.

One thing I noticed is we got in the last few years a lot stories of the form "Adobe donates Photoshop 1.0 source code to Computer History Museum, saved because early programmer kept it on a floppy disc in his house". Or games especially we get a lot of this.

It feels like if an employee did this with modern projects, they would at the very least be summarily fired, if not have legal action taken against them.

These days, we use centralized source control, instead of emailing zip files and patches back and forth. Having all the source on a random piece of media was a lot more normal back then.

> You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out.

This will work for the first 5-10-20 people, then word of mouth goes out about this policy and your evil designer is downloading everything the day before sending their resignation mail.

Or “your sales guy is making a little backup of the leads from the CRM before handing in notice”.

Though with sales orgs I think this is almost an expected practice - sales people are often hired on the tactit, never officially acknowledged basis that they will bring their leads list.

Years ago I got a job through a recruiter, left company A for B. She called me after a few months and asked me for the Compsny A internal directory - which I declined to provide and she got kind of nasty about it. Maybe ten years later I was at company C and my manager mentioned hiring a recruiter - same person. I mentioned our previous interaction (not out of spite, just a naive narrative) and they stopped working with her immediately. My point being - your behavior has a long tail, so don’t be trying to take advantage.

People asking for company directories amuses me so much, especially when most company email patterns are completely guessable.

it's more the name and the org chart?

maybe the phone number too

> The one designer totally ruined the company from ever letting someone stay for their two weeks.

No, it's the over-reaction by whoever instituted that policy that ruined the company. They should've cut their losses and ignore the outlier, perhaps make it tad more difficult to copy off data en masse without being noticed, and/or do many other things addressing this risk without ruining the workplace for everyone else.

This is the organizational equivalent of autoimmune disease. Works at every scale. On national/international scale, this is what terrorist organizations are exploiting - do an X amount of damage that may even be counterproductive to their goal, and watch the victim do 1000X damage to itself by overreaction.

The only thing that that accomplishes is that people don't put any notice.

In the UK, and most European countries, locking someone out during their notice period is really rare. Big companies exist and are not destroyed by disgruntled employees.

If someone is fired for cause then they go immediately, but if they are given notice then they are usually trusted with access, and it rarely goes wrong.

Stealing IP is rare because it's hard to benefit from it. If stolen IP is offered to another company, usually they report it to the owner to cover their backs legally. Funders are not going to want to invest in a company that is based on stolen IP, where their investment can become worthless overnight.

So I think these stories about how 'we have to treat employees like they are potential criminals' (not accusing parent of that, but you hear them) are bugos. Treating people like human beings is both right and economically efficient.

Get a DLP system in place for god sakes. I’ve even seen off shore people work from VMs only where they can’t download or store any file locally, much less dump everything to a USB stick.

Top search result is from Gartner: alarm bells ringing. Data loss prevention seems to be enterprise speak for doing as much intrusive monitoring you can do, in as neutral speak as possible.

1984 is so appealing for so many people, it seems like it is just a book about the tendencies that power can take when it is not guided by sane principles. I have always been employed in a high trust capacity since I was a young adult, there is not a technically feasible system in the world that could prevent me from wrecking havoc in a company. Social ones though, they are extremely effective.

Every so often a client asks if we are using a DLP, and if not, why not.

All the DLPs rely on, effectively, regular expression searches of traffic.

This is fine if what you need to protect are SSNs, phone numbers, credit card numbers... but if your data is not easily recognized that way, they don't work.

If you ask the DLP vendors about their threat model -- and the salespeople generally don't know what a threat model is -- it's always a set of stories about a salesperson who clicks the download-as-CSV button on a CRM system, a DB reporting specialist who generates a report full of raw passwords and credit card numbers, and an off-shore programmer who sends AWS credentials via email.

Hopefully you can spot the non-DLP prevention mechanisms for all of these...

> Hopefully you can spot the non-DLP prevention mechanisms for all of these...

What is it?

What does any of this have to do with theft? In most lawful places, if you dump source code and documents to take with you it’s not going to end well.

https://www.cnbc.com/amp/2020/08/04/anthony-levandowski-gets...

> I’ve even seen off shore people work from VMs only where they can’t download or store any file locally, much less dump everything to a USB stick.

Sure, they can't do any of that, and development becomes miserable. You don't have to go full VM and remote desktop to prevent those things.

If you really want protection you don't want a DLP, you want a (limited) air-gap.

Basically the machine is not allowed to access the internet and USB drives do not work. Only specific locked down applications like the email app, web browser, and so forth have internet access. Downloads are allowed but uploads are not.

A permissions interface is available for say legitimate transfers of data to a flash drive or a web upload, in that case the user will have to add a valid reason and the specific files into the form. Once that's checked and approved by a higher-up the files are temporarily placed in a special folder that permits transfer out. The same thing goes for external emails that aren't on a whitelist, they'll need approval before they get sent.

If you're running a VM you're storing the whole state of the VM on the host machine, there's nothing technically stopping you from copying all the data, and worse, there's no way to even know that it happened.

What VMs are helpful for is cross-contamination and spyware attacks from other clients a contractor is working for.

But what would prevent someone from "downloading files" BEFORE they send the notice?

So what stops people making their “backup of files” before hitting send on the email?

...so now people who want to do that just copy everything before sending the email?

Reply on news.ycombinator.com