Things to commit just before leaving your job • Hacker News Board

Re: Things to commit just before leaving your job

#151

Post by onion2k » Wed, Aug 19, 2015, 9:09 PM UTC

billyhoffman wrote: post #142

onion2k wrote: post #113

Earlier quoted context omitted.

The point wasn't to leave people puzzling over it for hours. It was a bit of fun. But ... It'd be quite trivial to hide the string. var msg = ['E','r','r','o','r',':','S','c','r','i','p','t',' ','n','o','t',' ','f','o','u','n','d']; document.write(msg.join(''));

I gave a talk at BlackHat many years ago about JS malware, and proposed obfuscating malicious JS like this: - Treat JS code like 7-bit ASCII - For each character, convert the bits into white space. 1= space, 0 = tab - A = "1000001" = space tab tab tab tab tab space - concat it all together, \n shows you are done So you can represent JS code as just whitespace. Which means this is malicious code: //st4rt //3nd var htm…

I like that a lot. I wonder if it might be possible to use Unicode zero width space and zero width non-joiner characters.. Then there wouldn't even be any white space to see.

Re: Things to commit just before leaving your job

#152

Post by FireBeyond » Wed, Aug 19, 2015, 9:26 PM UTC

15155 wrote: post #149

gknoy wrote: post #130

Earlier quoted context omitted.

The key is "without authorization". You're allowed to fix things and add features, but deliberate sabotage is arguably unauthorized. You might win in court, but as others said elsewhere, court is Too Expensive even if you win. That, and I wouldn't be surprised if they didn't go after you for industrial espionage or something.

Except that you're entirely authorized to access the computer system. Purpose or intent isn't defined in that particular law. Do you have authorized access? Well, as an employee you do. This isn't a criminal matter, it's a civil one, and no company is going to sue a saboteur unless they need an example made; they stand to gain nothing. A company doesn't get to retroactively redefine what "authorized access" is as it…

You have authorized access, but the statute says 'cause unauthorized damage' (which in its most literal reading could be an unintentional bug, too - don't think for a moment I'm supportive of this).

Re: Things to commit just before leaving your job

#153

Post by [deleted] » Wed, Aug 19, 2015, 9:58 PM UTC

run4yourlives2 wrote: post #146

happywolf wrote: post #29

The horror story that I heard was a disgruntled engineer silently replaced the source codes (C++ based) in the project with compiled binary object files and he kept the source codes on his local computer, not checking those in. He did this over an extended period of time to make sure this crept into the backup tapes as well. No one found out because each engineer owned a code module of their own. Then he resigned. Wh…

That's a good way to get your ass sued, or worse. Most employment agreements specifically state the company owns the code, which you have now stolen.

[deleted]

Re: Things to commit just before leaving your job

#154

Post by [deleted] » Wed, Aug 19, 2015, 9:58 PM UTC

run4yourlives2 wrote: post #146

happywolf wrote: post #29

The horror story that I heard was a disgruntled engineer silently replaced the source codes (C++ based) in the project with compiled binary object files and he kept the source codes on his local computer, not checking those in. He did this over an extended period of time to make sure this crept into the backup tapes as well. No one found out because each engineer owned a code module of their own. Then he resigned. Wh…

That's a good way to get your ass sued, or worse. Most employment agreements specifically state the company owns the code, which you have now stolen.

[deleted]

Re: Things to commit just before leaving your job

#155

Post by johan_larson » Wed, Aug 19, 2015, 10:41 PM UTC

late2part wrote: post #150

Cshelton wrote: post #68

Earlier quoted context omitted.

this is why we have code. reviews. haha. Yeah...I'd file a criminal lawsuit on his ass though.

In the US, only the "State" can file a criminal lawsuit. Imagine trying to explain this crime to a county prosecutor!

It's called "private prosecution". And there are still a few parts of the US where it is possible.

https://en.wikipedia.org/wiki/Private_prosecution#United_Sta...

Re: Things to commit just before leaving your job

#156

Post by bdcravens » Wed, Aug 19, 2015, 10:50 PM UTC

klibertp wrote: post #144

brianwawok wrote: post #96

Earlier quoted context omitted.

Is it worth the risk to find out? Court ain't cheap, even if you win. As an employee of a company that provides you a paycheck, you "owe" them your best effort. If you don't want to try, quit - but don't sabotage. That is juvenile and perhaps illegal and certainly unethical.

> you "owe" them your best effort Yeah, and the company "owes" you as high a salary as they can possibly afford...

I'd argue that committing compiled binary instead of source is a minimal effort, something you learn the first 2 weeks on the job.

Re: Things to commit just before leaving your job

#157

Post by happywolf » Thu, Aug 20, 2015, 2:46 AM UTC

shimshim wrote: post #127

happywolf wrote: post #29

The horror story that I heard was a disgruntled engineer silently replaced the source codes (C++ based) in the project with compiled binary object files and he kept the source codes on his local computer, not checking those in. He did this over an extended period of time to make sure this crept into the backup tapes as well. No one found out because each engineer owned a code module of their own. Then he resigned. Wh…

what happened as a result? im curious to know.

The CEO decided to just move on because it was a small company with less than 30 people. Litigation would take too much time and money.

The engineering team took a couple of months to figure out what that module did and rewrote from scratch.

Re: Things to commit just before leaving your job

#158

Post by happywolf » Thu, Aug 20, 2015, 2:53 AM UTC

toothbrush wrote: post #55

happywolf wrote: post #29

The horror story that I heard was a disgruntled engineer silently replaced the source codes (C++ based) in the project with compiled binary object files and he kept the source codes on his local computer, not checking those in. He did this over an extended period of time to make sure this crept into the backup tapes as well. No one found out because each engineer owned a code module of their own. Then he resigned. Wh…

My god, i'm surprised that person didn't land up in court :/

Nope, the CEO decided to move on. Small company.

Re: Things to commit just before leaving your job

#159

Post by happywolf » Thu, Aug 20, 2015, 3:03 AM UTC

moosey wrote: post #116

happywolf wrote: post #29

The horror story that I heard was a disgruntled engineer silently replaced the source codes (C++ based) in the project with compiled binary object files and he kept the source codes on his local computer, not checking those in. He did this over an extended period of time to make sure this crept into the backup tapes as well. No one found out because each engineer owned a code module of their own. Then he resigned. Wh…

Some people who aren't critical to the company just have to go and try to prove the company wrong. This is so childish and stupid it aggravates me. It only proves that the engineer was probably not a valuable asset and he really proved the company point with these actions. Hopefully he was on a performance plan or something similar. At companies where there have been poor code control practices I have maintained git…

The company used svn.

Not sure how viable to check file changes regularly since 1) everybody had their plates full 2) the system was complex with a lot of black magic that 'just worked', thousands of source files, within the mix were compiled binaries (mainly 3rd party hardware drivers) and a lot of libraries (Qt, Boost, etc.)

Re: Things to commit just before leaving your job

#160

Post by toothbrush » Thu, Aug 20, 2015, 9:15 AM UTC

Symbiote wrote: post #76

happywolf wrote: post #29

The horror story that I heard was a disgruntled engineer silently replaced the source codes (C++ based) in the project with compiled binary object files and he kept the source codes on his local computer, not checking those in. He did this over an extended period of time to make sure this crept into the backup tapes as well. No one found out because each engineer owned a code module of their own. Then he resigned. Wh…

A friend of mine did something similar, not that long ago. His employer told him to complete a 1-year masters in computing at his expense, including a course on ethics, or see them in court. He chose the degree course.

That's almost benevolent on the part of the employer -- having more degrees can only be good for the person's employability, and it was most likely an enriching experience to boot. Oh well, i guess some people have larger hearts than i do! :)