bad416f1f5a2

All those points OP raised as difficult - physical space, staffing, capex, etc. - and your response is “yeah, now do it twice”.

From observation my belief is that in-office work selects for slackers as equally as wfh work does, they just slack differently.

One of our well respected product owners was always so very busy, with back to back meetings when working in office. Then we started WFH and all figured out she was a Costanza - all those meetings were her way of looking important, while everyone routed work around her.

On the other hand, some of our more neurodivergent engineers benefited from the rigidity of sitting at a desk where they are too afraid to pick up their Switch and just game.

Swings and roundabouts.

The size of the monthly pay isn’t what is significant - having any nonzero amount is. The SSDI acceptance rate is lucky to hit 30%, typically takes multiple hearings/appeals to get a payout, and can be denied if the government can demonstrate the potential for you to work outside the field you were employed in. If you receive anything from it, it is prima facie evidence of a serious disability.

So to my point, this isn’t a story about a bad programmer, it’s a story about a person who is truly so disabled that they can’t program.

I would place a much higher significance on the reported mental health issues - it’s hard to get on disability in the US, and if you’re truly on $3k/month because you are unable to work, you have a serious disability.

Otherwise? Totally agree. The worst developers are the ones that make everything they touch that much worse merely by virtue of touching it. I’ll take dead weight, “go write a bunch of printf’s and accomplish nothing” over them any day.

In the US I think there are varied state laws on what's legal and illegal in that area. This is obviously complicated by any employee agreement that you might've signed up for when you joined the company.

I think the basic decision was "a 2021 MacBook is now worth less due to deprecation than the time it'd take HR/legal to figure this all out, so screw it and let's mark it disposed for $0"

The Helpdesk didn't know until after the RIF happened as some of them lost their jobs too. But every fired employee will get some return-labeled boxes shipped over to them, and are asked to pack up their equipment & send them back. Most companies who do these layoffs still count you as an employee for the duration of your severance, and your only real job requirement is to pack up your equipment and drive it to the UPS store.

Towards the end of their severance time, Infosec will run a remote wipe so if their endpoint ever connects to Wifi it'll get nuked. They tend to wait a bit to ensure there's not something on the laptop that needs to be recovered for the company – or the employee says they had some critical personal things on it. Either way the only way they get it back is by sending it back and letting the Helpdesk pull the data.

Worst case, an employee doesn't send stuff back and we write it off. It's really not a big deal. Mandatory FDE + device wipes when a laptop comes online means any data is protected, which is 100% of what we're concerned about. No one cares if an employee gets a "free" MacBook that's a few years old.

When my company did layoffs recently I got to peek behind the curtain a bit. It started with an all-hands video call from the CEO announcing the layoff. HR had loaded emails to send immediately following the call directly to your company email that either said "you are not fired" or "you are".

For those who were fired, infosec ran a script during the CEO call to pull their access packages for production systems, crank the data-loss protection systems on their laptops up to high, boot them from Slack, and prevent them from sending & receiving emails to non-HR folks. After their "fired" email they received an invite to talk with HR to provide updated contact information. Then infosec pushed a new password to their account & force shutdown their workstation.

If it sounds brutal, it was. But the layoffs I was involved at a previous company were handled much differently, more traditionally: CEO announcement at 9am, and then you spent the rest of the day agonizing and waiting if you're going to get a :15 private calendar invite from your manager titled "Employment", or if you'd make it to the end of the day with no news (good news!). I'd almost argue that moving fast was more merciful than this, but that's easy for me because I wasn't fired either time.

There are a few “accepted” ways of asking this.

First, if you are truly the linchpin, you’re likely working over/above your position. So make the case that you are a rank N employee doing N+1 work.

Alternatively, try the market adjustment route: you are doing more than your role, and you’re already being underpaid for that role.

As a manager IDGAF about these typical asks for raises. It’s part of the job. What I do care about is the “pay me +X or I leave” games - those suck to deal with and are often a card you can play once.

But while we are all worried about job security, things are extra tight for employers right now: if I lose one of my employees, it’s very likely that I’d face an uphill fight to hire someone to replace them because my boss / her boss would claim that as a win for their budget. So you do have some room to maneuver here.

> Also, education is a great way to ride out the current crappy job market.

Don’t sleep on this.

In 2008 I had a few friends go back for higher education rather than stay at/take low quality jobs. They graduated with additional debt, but also with credentials that accelerated their job search and earnings during the recovery.

If your personal situation allows it, it’s a good idea to consider.

And if you can't work due to your injury and are one of the many Americans who does not have paid time off, the best case for you is using FMLA to at least retain your job so you can work - but your absence won't be paid. Hopefully your emergency fund is higher than the American median of $2000.

You are worried that an Amazon lawyer is going to contest your evidence in small claims court.

You probably don’t need to be concerned: they’re unlikely to show, so you’ll just get summary judgement.

This format started in 2018 or 2019, I can’t recall which.

The US Army has made six hundred contributions to a list of ethnic slurs:

http://wikiwho.ailef.tech/page/11014515

They appear as “PEO STAMIS” here, which appears to be an IT group?

> From: "Neateye" <NitaiGouranga@aol.com>

> Subject: Gouranga

> Call out Gouranga be happy!!!

> Gouranga Gouranga Gouranga ....

> That which brings the highest happiness!!

It’s been, fuck, two decades and this is still in my mbox. My wife and I still shout Gouranga at each other some days and, hell, who am I to argue that it doesn’t bring the highest happiness!!

Yes and yes: https://www.theregister.com/2018/09/04/wayback_machine_legit...

If I was a betting man: some smaller fish in the Android ecosystem practiced exquisitely terrible key management outside an HSM, got burnt, and will have to slip KPMG or Deloitte an extra big kickback if they ever want to see a clean SOC 2 again.

No hand waving: what “one subtle thing” will this insider do to make this attack possible? I’m guessing FIPS 140-2 has already thought about it.

HSMs are hardened against individual bad actors. Their threat model envisages the presence of nation state actors.

Is it possible that an HSM attack happened here? I wouldn’t bet on it.

Are you familiar with the threat model an HSM is designed to counter?

I don’t know if there’s much to broadly learn here.

I will say that it reflects very positively for Shopify: I can imagine plenty of companies downplaying the issue or trying to duck the payout by saying “not our code!” In that sense, this is one of the few bug bounty posts that leaves a company looking good.

I’m reminded of the moral panic my parents generation had around televisions.

And their parents generation had over serialized plays on the radio.

And several generations removed, the panic over the printing press.

Pro tip: https://www.hopkinsmedicine.org/institutional_review_board/h...

The breach notification to HHS typically comes from the covered entity. They often have the information on exactly what PHI was out there, how many individuals were impacted, and can provide the right info to HHS.

And with my experience in healthcare IT, I can say privacy and compliance officers take reports like this incredibly seriously. Those might not be the right people but getting an email to compliance folks inside the covered entity and saying “here’s a likely breach” will absolutely get the ball rolling.

My favorite example:

https://m.youtube.com/watch?v=K3EpLn77JdQ

In this case, the rules say that if a kickoff is handled first by a player who has established themselves as out of bounds, a penalty is assessed and the ball moved to the 40 yard line. The intent is for a horribly miskicked ball to be penalized.

What you see is a special teams player knowing the rule, carefully and clearly establishing himself as out of bounds, and turning an excellently kicked ball at the one yard line into a ball 39 yards down field.

I’ve seen the commentators confused by this play before!

Or picketed so their speech is drowned out, or even punched in the nose by passers by.

You can argue if this is good or bad, but it’s a fundamental difference between the public square and digital recreations: in the real world, speech can have meaningful consequences. In the Twitter world, you create a new profile.

Would we ever know? A type II error in a criminal trial would be very hard to demonstrate, as the assumption is (should be!) that a defendant is innocent.

He really did a rather remarkable job for someone who had all of 10 seconds to realize that he was being interviewed on live television. I suspect a lot of people wouldn’t have managed to stay as cool as he did. I know I wouldn’t.

Erlang’s formulas are incredibly applicable to things we work on today - and shockingly unknown to many developers.

I’ve used them several times to show that a proposed system is mathematically impossible: “if the backend processes n requests/sec with a max response time of X, and the P95 of the backend is Y, the queue satisfaction is 0%”. People think you’re a wizard while you’re just plugging numbers into a century-old formula.

> If there are 4 new technologies on a project and the team were insistent that they each solved a lot of pain I'd be less averse than I would to 1 new technology that they adopted because it was "cool", "made by google" and "everybody [cool] is using it".

Programmers always insist that the new flavor of X solves a ton of pain. Occasionally they are right, but more often than not programmers adopting four new technologies- if they ship at all - deliver what Rich Hickey called “a knit house” in one of his talks: a system that solves a problem, sometimes in a pretty way, but is never able to be extended or grow. Sometimes the actual software is fine enough, but the choices are so novel that it ends up being maintained by one or two people who get it, and growing the team is a nightmare. Either way, it’s a knit house.

I have yet to work at a place that didn’t have systems running mission-critical shell scripts with little to no SDLC on boxes that got periodic “yum update -y”s. There seems to be a difference in oversight of software we write & “the operating system”.

Should we do better? Absolutely! Will this burn people if vendors don’t take care? Also absolutely!

> Sounds like they’re stealing that salary, not earning it.

On the contrary – if someone has been at a company for 9 months & had terrible early reviews, the company had about ~6 months to deal with them. In my experience, truly bad hires get lukewarm 30 day feedback, negative 3 month feedback, and are on a PIP soon after.

If you're there after 9 months, it suggests you've demonstrated some level of value to your employer.

> Remote work is all the perks I'll ever want or need. Maybe tech companies should hire more suburban moms.

TBH, as a hiring manager outside of a FAANG, "mid-career parents who want to work remotely" is really the sweet spot for me.

I can't offer enough compensation to compete with FAANGs for new graduates of elite universities, so I have to look at lower tier institutions. That's not to say they're bad or anything... I and many of my best employees dropped out of state schools. But generally, the ceiling is lower, and identifying a new graduate's value is really hard.

And because I'm at a tech company which is not in a super exciting tech hub, I have to be exceptionally remote friendly to land good candidates.

But the thing is: there are tons of employees out there who are smart, get things done, and want to clock out for the day with enough time to cook dinner and play with their kids. We've even hired a few ex-Amazon/Googler's who left because the pay was great but they wanted to have a family.

I selfishly find myself hoping that remote work isn't embraced by those places, or else I'll lose my hiring edge.