Hacker News Reader

Comment by thinkingtoilet | Hacker News Reader

I had the opposite funny experience. When I worked for Global MegaCorp, they would occasionally send out phishing emails and if you clicked on a link it would be recorded and you would have to do trainings if you got fooled a couple times. Eventually everyone learned to stop clicking on links on emails. That's good. However, they sent out a yearly survey to get feedback from all the employees and no one clicked the link so they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them.

View on HN

The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace.

Handles all the phishing concerns, except that participation was either low or the feedback was negative, which would lead to the leaders issuing subtle threats to the team about how they'd find out the involved folks and fire them. If you tried to uninstall it, it'd be back in a few hours through policy management software (jamf and its ilk). On the internal discussion forums, they'd nuke threads talking about how to disable that software.

So, in the end, people just started giving the best possible feedback regardless of the team or manager performance. I never really needed those threads, all I needed was tcpdump and then blocking its domain in the hosts file :)

That sounds absolutely horrifying

The behavior is Org and department specific. What happens is that those questions are map to a 'Org Health' metric (satisfaction, innovation, etc) and they are Manager aggregated, so your Manager's manager saw those report and your Director saw your skip manager's and so on. I would say my org was very healthy in terms of handling it, no treaths or anything, just asking us what we thought was going wrong, how to improve and coming up every year with a new SOP to do the connection's review.

Again, YMMV.

Somehow this and the parent both represent Amazon. Daily questions and a yearly survey that security had to assure us was legit.

> So, in the end, people just started giving the best possible feedback regardless of the team or manager performance.

That seems to be the best possible strategy for any feedback you have to give as a captive audience?

Reminds me of the feedback German companies are forced to give about their employees. It's like a formal letter of reference, but you can and will be sued if you you anything negative. Consequences are as you would expect.

And because there has been an inflation in how complimentary these letters are, people started suing when their letter wasn't flowery enough, because that somehow could be read as an implicit criticism. (Just like how A is a bad mark, when everyone else gets A+.)

> That seems to be the best possible strategy for any feedback you have to give as a captive audience?

It is, but at that point why even have that bureaucratic process that achieves exactly nothing?

Of course, I understand that being able to pat yourself on the back and concluding with statements like "Leadership is truly connected with its employees, keeping in touch every day through questions about improving the workplace. Our surveys show 99% of our employees are very satisfied with their team, their work, and work-life balance" is "valuable", I guess, I just feel very sad about humanity.

> why even have that bureaucratic process that achieves exactly nothing?

It is a very good question that you should never bring up as captive audience.

If you have a back channel in the audience you should get a large enough group to ask this question in the free form feedback box in the exactly same wording. Should send chills down the lord of HR spine.

Don’t do it with a group which isn’t large enough though, you’ll get you all fired for unionizing^W no reason.

Again, there's no incentive to do this. It's full of downsides, and the only upside is some lolz from trolling.

It all depends on what your utility function is, but for most people I completely agree. For a good example of such activism not blowing up completely in your face would be the OpenAI revolt and sama reinstatement, but that’s obviously survivorship bias.

More like chewed out. I've been chewed out before.

> It is, but at that point why even have that bureaucratic process that achieves exactly nothing?

Well, I was talking about the best strategy from the captive audience's point of view. You are now asking about the strategy for the captor.

Going a bit beyond: getting honest feedback out of subordinates is a hard problem! Both formally and informally. That was always a big concern on my mind as a manager.

> And because there has been an inflation in how complimentary these letters are, people started suing when their letter wasn't flowery enough, because that somehow could be read as an implicit criticism.

You got a source for this folktale?

The reality is that these letters are written in a kind of pseudolegalistic language, where a phrase like “the employee was punctual” means they were usually late. If they were actually punctual, you'd see something more like “the employee consistently demonstrated exceptional punctuality”.

You usually need the reference letter to be reviewed by the works council or by an employment lawyer.

sighs. Seriously?

Good to know though, if true.

German here. Absolutely true, and has been for many years now. Some examples:

- grade D, poor performance: "We were satisfied with his performance" - grade C, meh: "We were entirely satisfied with his performance" - true grade A+: "We were always satisfied to the utmost degree with his performance" plus highly positive and extensive in the rest of the reference letter.

- "was sociable": alcoholic - "was always striving for a good relationship with colleagues": was gossiping instead of working - "sociability was appreciated": had sex with colleague - "was very empathic": had sex with customer

I wonder why there is no LLM that can decode this. Tried many times but it seems the models don’t pick up the nuances.

The perfect test for LLMs!

> - "was very empathic": had sex with customer

This would be very funny to see on an Arbeitszeugnis for a prostitute. Remember prostitution is legal in Germany.

I have no official source but know that this happens a lot. Also the arguments with the employer about the letters afterwards. Some are so fed up and let you write the first or final draft. There is also the hidden code. So instead of writing something negative which is forbidden you just use different words or leave out some intensifications. Like “zur größten Zufriedenheit” vs “zur allergrößten Zufriedenheit”. One means your work was Ok the other it was great. There is also intensification by adding time adjectives like “always” or “often” etc.

This code is known by people in the HR and hiring departments. It’s a very weird praxis. I have to explain this to my non German colleagues because for them even a mark F letter sounds awesome ;)

My question would be: why even bother with any kind of code? What incentive is there for the employer to write anything truthful, to write anything but the blandest most positive things that really don't say anything hidden?

Replaying with a quote from Star Trek IV: The Voyage Home: “Whoever said the human race was logical?”

this is common practice in general no? People ask for references, or try to contact former bosses, when hiring critical profiles. Obviously nobody will say anything bad, so HR is trained, and giving trainings to the hiring managers, how to "grade" the level of positivity.

There's a difference in saying "Yes I confirm person X worked here, he did a good job on all the tasks that we have asked him to do" vs "Yes, he was amazing at his job, he was proactive and really drove innovation, we are sad to see him leave"

> this is common practice in general no?

The German situation is especially unhinged. See https://de.wikipedia.org/wiki/Arbeitszeugnis (ask Google Translate for help, if necessary).

This is a very common practice in Germany. There were a few court cases won by employees whose recommendation letters were not positive enough, so employers now basically just write whatever you ask for.

I have written all my recommendation letters myself. The employers just put their letter head and sign it.

You can check out https://de.wikipedia.org/wiki/Arbeitszeugnis with the help of Google Translate.

> The way they used to handle that at a FAANG I worked for was they had this app installed on each machine issued by IT, that would ask you a question daily about some aspect of your workplace.

I presume you're referring to "Amazon Connections"?

Had to be the most-hated bit of corporate enforcedware around. Every Linux laptop user had a different hack for hobbling or removing it.

It's been years, and I still remember the infamous ticket `CONNECTIONS-3303`. A pox on everyone involved with that clusterfuck.

In New Zealand, there is a long list of companies who need to reach out to a large number of current and former employees, and try to convince them to go to a website and enter sensitive information to receive some money (1). Where I'm working, we found it hard, even for current employees, to convince them that it's not either phishing, or a phishing test.

This is getting off-topic, but I found it interesting so I'll include more details anyway.

In a lot of cases, all the fuss is to return amounts that are tiny, and yet the companies need to keep reaching out and trying to convince people. I got $0.06 (2) from my current employer. Because I've moved countries with them, I ended up falling in the category of needing to provide some bank/tax details. Of course, I wanted to log in with the silliest OS I could think of to test/mess with the tracking dashboard, and so somehow I managed to enter my DOB wrong, which even further increased the back-and-forward and emails involved (I was in the project, so the Payroll peeps involved probably didn't hold it against me).

The re-calculation which led to the payment actually worked out that I had been underpaid in come calculations, but overpaid by far more (although still very, very little) in others. The company believed they couldn't offset, so all the fuss was for a tiny amount, which I felt I really wasn't owed anyway. Also unfortunate, was that if any former employee didn't bother to claim the amount because it's so small it's not worth the fuss, it just leads to more work in follow-ups.

New Zealand Holidays Act is quite an interesting area in general, in a how-can-it-possibly-be-this-hard kind of way. I think it contributes to the reputation of NZ payroll being one of the trickiest in the world.

1) https://thespinoff.co.nz/business/27-06-2019/cheat-sheet-wha...

Or IRD (NZ tax dept.) a few years back sending out a survey on a .co.nz domain. Gave their security team a hard time for that one!

IRD's phone calling campaign about enabling two-factor auth was also not great.

If the amounts are so tiny, couldn't the company just voluntarily overpay everyone by three dollars a year and call it a day?

Only most of the amounts were tiny, so all the effort for the re-calculation was still needed for everyone (basically either building a payroll engine from scratch, or paying someone else to use theirs). You're right, that for most current employees, for the small amounts it actually is much simpler. You can just email and slip it into the regular payroll.

It is the former employees for up to 15 years that make the contacting step difficult. They all need to provide bank/tax details.

There are also some current employees who still have to provide details before they can be paid. The company I work for has a lot of people moving countries, and therefore tax jurisdictions. In addition, some employers decided it was worth asking if employees were prepared to voluntarily allow offsetting between the overpayments and the underpayments, as in some cases those were quite large.

I can understand not wanting to give large amounts of money where it effectively would just balance out, especially after spending staggering amounts on the recalculation itself. There are government departments that have been working on it for years (or perhaps worse, and paying consulting companies to work on it).

Edit: I should have said, I did see companies rounding all amounts up to some small amount, like $1, so your suggestion is good. It just doesn't save effort on recalculation, or much effort in getting people to dig the email out of their trash folder and provide their information to receive their $1.

Thanks for the detailed answer.

> It is the former employees for up to 15 years that make the contacting step difficult. They all need to provide bank/tax details.

Give people 30 dollars extra on their way out, and only contact them when you used up that budget? (Should take care of the majority of cases?)

> Edit: I should have said, I did see companies rounding all amounts up to some small amount, like $1, so your suggestion is good. It just doesn't save effort on recalculation, or much effort in getting people to dig the email out of their trash folder and provide their information to receive their $1.

Oh, my suggestion was to do the calculation, as arduously as you describe, compare with what you already overpaid earlier voluntarily, and if the company is still in the green, then don't bother contacting anyone.

Or is that not possible?

I think when companies found out that they had an issue with their Payroll software calculations, they mostly tried to solve it as quickly as possible, to put a line in the sand - from that point onwards at least, no additional errors were being made. But they still had many years in the past, of issues which needed to be fixed.

I think what you're proposing probably would have worked for reducing the communication issues in the future for any employees who left after that. I didn't hear of anyone who did that, but that definitely doesn't mean it didn't happen. Likely no one thought of it because I would guess most people didn't expect it to take as long as it did to fix. That the people who left while the recalculation was going on would just be a few more compared to everyone who had left in the previous 7 or 10 or 15 years (I think different companies came to different opinions for the time period they needed to retrospectively fix).

It's a shame that the bureaucrats / politicians / voters who are responsible for these hard-to-comply-with rules will never bear the costs.

How hard would it be to print out a letter on company letterhead and circulate it in the office or snailmail it to the employees?

>... they had to send out follow up emails saying the original emails are legit and it's ok to click the links in them.

Sounds like something a phisher would do. Better not click.

I worked somewhere that would send the notice to do mandatory security training from a suspicious email and the message was very short (something like you have been enrolled in training at https://phishing.site.example.com/abdlejrj). In always just reported them as phishing and no one ever followed up.

Every time I reported an email as a suspected phishing attempt at an ISP I worked for, I got an automated reply congratulating me for recognizing the test email. I don't think I ever got a real phishing email at that company. But then I never had to email anyone outside the company.

I’m designing a new phishing campaign that sends a pre-email telling the user they’re getting a legitimate email with <subject> then sending the phishing test email with that subject.

My company does this too by the way. Usually for external things like surveys they send a pre-email.

I had a similar experience. I got pulled up for not completing my anti phishing training. It had been sent from a third party contractor with a random domain, but apparently I was supposed to know that was safe but the other external links were bad.

noted for my phishing business: track first phishing attempt, send follow up email two days later saying the first one was legit.

Note, this only worked because the follow up email came from the head of the division.

That's actually super funny and it is not first time I see quite the same story.

They train people not to click links and then someone in management is fucking stupid enough to pull "just send an email with a link" kind of crap instead of properly planning the communication in advance by telling people that there will be a survey, what will be the company that is sending it, when they should expect it - but that just "too much work".

I would fire that kind of clown ass on the spot for not doing their job.

Doesn't help that most surveys are on external unknown domains, and look very suspicious (tracking codes, etc.). I get such links to surveys & other commercial bullshit from my bank too, like they want to train you to click fishing links…

This is hilarious. I wish I'd thought or doing it to my 85 year old father. Maybe I could have saved him the last 10 years of following spam email links into hellish conspiracy holes and identity scams. It didn't matter how many times I told him never to click on an email.

There should be a white hat phishing service you can hire to target your elders. Then when they give up their social security number, someone shows up at their door with a big cake with all their personal details in frosting.

Reply on news.ycombinator.com