Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Most “mandatory requirements” in corporations are imaginary

nibblestew.blogspot.com

Post reply on HN
Print view View original

341–350 of 405 posts

Re: Most “mandatory requirements” in corporations are imaginary

#341

Post by throwaway987978 »

zxcvbn4038 wrote: post #104
nisse72 wrote: post #39

Related, after telling us for years how dangerous it would be if people flew with more than 100 ml of liquid, it's now allowed (i.e. no longer dangerous?) to carry a larger quantity of hand sanitizer because of coronavirus: https://www.tsa.gov/news/press/releases/2020/04/15/tsas-tips...

That is a topic in itself - everything the TSA does is pure security theater. There was never any danger from liquids nor any effort to prevent groups of people from coordinating to bring in a larger quantity. There is no explanation why 8oz of milk is dangerous and 8oz of cheese is not, nor why ice continues to be dangerous even though not a liquid, nor any explanation why the bbq sauce on the pulled pork sandwich I…

TTP is capitalism at its finest. Let's make the normal process so terrible so that we can charge extra for people to be treated normally.

And then you have services like Clear which is basically legalizing corruption. Instead of slipping the agent $20 to go to the front of line, it's legitimized so that you can do it without any stigma.

Re: Most “mandatory requirements” in corporations are imaginary

#342

Post by EVdotIO »

TimTheTinker wrote: post #323
EVdotIO wrote: post #320

Earlier quoted context omitted.

Yes, while WSL2 has some filesystem quirks, it works pretty darn well for what I do (ruby development). I picked up a 5 Y/O 2 CPU E5 v4 Xeon workstation for 300 bucks. I've sunk in an additional 400 for an SSD, RAM and GPU, and when paired with Microsoft Remote Desktop, I've got a solid setup that allows the best of all worlds.

If ruby development is your gig, and especially if Linux is your target runtime environment, I don't understand why you'd choose anything other than Linux, unless the choice was made for you. Speaking as a web dev on a company-issued Mac, running my local dev environment inside a Parallels Linux VM. I asked to switch to Linux but was turned down. (Now if Microsoft released LSW, i.e. an Ubuntu-based distro with Window…

Obviously back in the day windows was an absolute dog for any dev work outside of windows, and a complete no go. I've only started using it for development a few months now, but so far haven't encountered any major issues. Maybe I'll run into some interoperability problems with specific syscalls at the compatibility layer, but so far it largely just works for my needs (VS Code with intellisense and debugging, docker, K8S, Zsh and few other tools). If my tests pass locally, I can safely assume they pass on the CI server, and haven't been proven wrong so far. If I ever need a linux box, there's an old laptop that's just for that. At this point it's turtles all the way down, what's the harm adding another turtle on top.

It's not all roses, there is a noticeable performance hit with the filesystem in both WSL and the windows layer. I wouldn't use it for production, and why would you, but for development, it's fine and largely not a problem. If you had to regularly deal with a large numbers of files, say log parsing or compiling, it's probably not going to work.

Besides recent OS X SSL library issues, I've haven't ever run in problems developing on a Mac and have used one for the better part of 10 years now. Can't say the same with developing on Linux (almost exclusively on the graphics side of things, but that's a problem when it's your primary machine).

Re: Most “mandatory requirements” in corporations are imaginary

#343

Post by hinkley »

compiler-guy wrote: post #315
hinkley wrote: post #265

Earlier quoted context omitted.

I was working in a throughout computing problem domain. About the time I got there, some asshole in HR had everyone’s (current and former employees) tax information on their work laptop and lost it. Tens of thousands of people, because there was no policy against putting such information on portable equipment. And as far as I’m aware there still isn’t. No, within the year (might have been a lawsuit, I can’t recall) n…

Thinking about the policy in terms of punishments and fairness isn’t the right approach. Something happened that cost the company a great deal of resources, so the company is trying to prevent such a thing from happening again. It may be doing a poor job at that, but it isn’t punishing you and it isn’t about fairness. It’s trying to prevent a future mistake. And because the company is a single entity, it is the compa…

"Something must be done. This is something, so we will do it."

Re: Most “mandatory requirements” in corporations are imaginary

#344

Post by pyrale »

grogenaut wrote: post #285
rvense wrote: post #211

Earlier quoted context omitted.

About five years ago, a place I was working at was selecting a new laptop for all employees. Mine was up for replacement, so I was interested in what they were picking. They'd arrived at some god-awful Lenovo gamer model. It fit the performance and price point they'd decided they needed. I said I'd prefer to have something smaller with less Christmas lights. "Policy is everyone has to have the same laptop, and some p…

This is literally my job. Amazon calls it Dive Deep/Earn Trust. I get called in constantly to "Remove Blockers". Part of it is just understanding why the policy exists and then getting a policy modification. While it's definitely an art, it's not as hard as a lot of people think, but you can't be afraid to escalate.

It is also _much_ easier when you're called in for that purpose. Someone who didn't get that mandate on hire will be considered troublesome and overstepping, while someone roped in for that reason will be innovative and an enabler.

Re: Most “mandatory requirements” in corporations are imaginary

#345

Post by the8472 »

thaumasiotes wrote: post #327
the8472 wrote: post #312

Earlier quoted context omitted.

That's possible but it would mean unnecessarily changing security-critical code. I'd again have to make sure to use constant-time comparisons of the different output, migrate the existing data or require users to reset their passwords and so on. All to tick a box. Ultimately we pretty much did that, switched to scrypt which is based on sha2 and pointed to the standard saying it's sha2-based. But that does not change…

> I'd again have to make sure to use constant-time comparisons of the different output Why? What would this mean? You have a flow like this: 1. User sends "password". 2. Time-hard hash processes "password" into some hex value, HASHT. No comparison is done. 3. SHA2 processes HASHT into some other hex value, SHAHASH. You compare SHAHASH to the user's stored hashed password. But even in step 3, you don't need constant-t…

Perhaps I was thinking of verifying API tokens. But see, I made a mistake while reasoning about security code. Don't make me do that more often than necessary, one day it'll go wrong.

Re: Most “mandatory requirements” in corporations are imaginary

#346

Post by prepend »

danaris wrote: post #199
prepend wrote: post #120

Earlier quoted context omitted.

> This is becoming regarded as mentally or physically abusive. An acquaintance of mine working in academia told me that her boss was being bullying and abusive. I was really concerned and asked what was happening. She told me that her boss and department were making her come into the office (pre-covid) at 9am despite that she assured them she could do all her research remotely. When she would not come in or come in l…

Requiring strict adherence to arbitrary bureaucratic norms, and particularly berating someone for daring to question them, is absolutely abusive. An awful lot of corporate culture is abusive, and designed primarily to give managers a warm fuzzy feeling of absolute control over their subordinates. Much of it derives directly from the assembly-line era, and much of the overall philosophy behind it is just thinly-veiled…

I guess they aren’t alone in their opinions then.

Reasonable rules like “be here by 9am” are not emotionally abusive to enforce. Perhaps you feel that way, but I think that’s unreasonable and will result in tons of emotional abuse as you go through the world.

Is a stop light emotionally abusive? Is not paying me $100k emotionally abusive?

I’m glad that we’re not actually under feudalism, but I think employment is not feudalism.

Re: Most “mandatory requirements” in corporations are imaginary

#347

Post by prepend »

grugagag wrote: post #339
JoeAltmaier wrote: post #213

Earlier quoted context omitted.

And there we differ I guess. The job is the job. Wear this; show up then; answer the phone with that phrase - its the job. Do it, and get paid. Not abuse.

Because the boss makes the rules and you should blindly follow them. The other team's boss is relaxed with these rules and the team is productive and happy but, you should still not question your boss, always put the head down and say I am sorry, always stay in late without overtime because the boss hasn't left the office yet and so on. And it doesn't matter that the boss doesn't produce anything and that you drive a…

I don’t think bosses should be followed blindly. But showing up and doing the job as required isn’t blindly following, it’s obeying.

I think the difference in what is reasonable and what is reasonable. If I question a reasonable start time “9am” that makes me someone that few want to work with. Whereas questioning forced, unpaid overtime is an entirely different, and I think reasonable question.

Re: Most “mandatory requirements” in corporations are imaginary

#348

Post by the8472 »

IncRnd wrote: post #302
jt2190 wrote: post #266

Earlier quoted context omitted.

I’d add another that’s nice to have: 3. The outcome we expect. (“What will happen if this is working.”)

How does that differ from choice #1, 'The reasons a policy was put in place. ("Why did we do this?")'? A policy's expected outcome is correlated with why a policy was put in place.

A policy might be put into place because a single event. The expected outcome can drastically differ depending on who writes the policy. E.g. it could be "this type of attack won't succeed again" vs. "even if this or a similar kind of attack succeeds it won't expose our entire data"

Re: Most “mandatory requirements” in corporations are imaginary

#349

Post by IncRnd »

the8472 wrote: post #348
IncRnd wrote: post #302

Earlier quoted context omitted.

How does that differ from choice #1, 'The reasons a policy was put in place. ("Why did we do this?")'? A policy's expected outcome is correlated with why a policy was put in place.

A policy might be put into place because a single event. The expected outcome can drastically differ depending on who writes the policy. E.g. it could be "this type of attack won't succeed again" vs. "even if this or a similar kind of attack succeeds it won't expose our entire data"

That's my exact point. A policy isn't random but created for an effect.

As an examnple: If an HN disclosure leaks passwords and email addresses into the public domain, imposing a policy control is _meant_ to have the effect that such a disclosure would not happen again, or if it does to have a limited scope.

Re: Most “mandatory requirements” in corporations are imaginary

#350

Post by throwaways885 »

andrewflnr wrote: post #307
JoeAltmaier wrote: post #99

Earlier quoted context omitted.

Yes there's a current trend of thinking that work should be as near play as possible. There are entire classes of work, like digging ditches and driving equipment, that can be sweaty and rote. Not designed to be fun, but to get something done. For pay. This is becoming regarded as mentally or physically abusive. It helps to consider the pay as recompense for whatever hardship you endure to deliver value to the employ…

Comparing manual labor, which actually accomplishes things, to wearing formal clothing for the benefit of no one but your boss, accomplishes nothing of value, is not really fair. The latter is usually not abuse, but it is usually stupid. Pay as recompense for suffering is less compelling when you're supposed to be paid for your output, and there's no reason for the suffering at all.

Friendly reminder: You're paid for how easy it is to replace you, not your output.
Post reply on HN