21–30 of 405 posts
Therefore, if you're a job seeker, and especially if you're a woman or a minority, you shouldn't let not having any of these imaginary requirements stop you from applying for whatever job you want, especially if it's a junior role.
Aren't all rules imaginary? > Every time someone in the management chain has axed the proposal with some variation of "this policy can not be changed because this is our policy and thus can not be changed", possibly with a "due to security reasons" thrown in there somewhere. That's circular, no doubt there. We've decided this rule must remain in place, because it's a rule . This decision-making process doesn't make a…
We have some imperfect system. Everybody knows about the problems it has. Somebody writes an article about how stupid and wrong those problems are. How does that help anybody?
The real question is how you fix those problems without introducing others. Passed a certain age and work experience you start to notice that the bureaucracy that stops you from doing quick smart fixes also stops a lot of people from doing serious damage to the company.
And yes, in some cases external factors will force a quick reevaluation of that bureaucracy. And you can say "I told you so all along!". But again, that's zero value to the business. The real value is in the work done to plan and execute a change is a way that assures no collateral damage and also to satisfy humanly needs/desires in the hierarchy.
People want to cover their asses, but guess what, when you put the responsibility of a change on the smart ass that always annoys coworkers with his brilliant ideas they tend to back away from it cause his ass is precious to him too.
TLDR: https://en.wikipedia.org/wiki/Wikipedia:Chesterton%27s_fence
If i pay an external $1000 per day and that price doesn't change when they are in my office or at home, i would put them in my office for obvious security risks. If corona means i can't get my work done, i have a new risk. Security risk for external consultants having full access at their home vs. no one can work -> i might choose the externals giving access. Its not imaginary.
For instance, there's a restriction at my workplace (not a software company, a regular old industry fortune 500) which prevents git installs from pushing to any non corporate GitHub repo from our work machines.
The obvious reason it exists is to prevent people (a lot of who are analysts or data scientists - not professional programmers) from shooting themselves in the foot by pushing code to their personal repos in error.
It's annoying to work around if you need to say push a contribution to an open source project and you could rage at the infosec for enforcing it - but it obviously exists because stupid errors would have happened.
This principle is also called Chesterton's fence
https://en.m.wikipedia.org/wiki/Wikipedia:Chesterton%27s_fen...
Aren't all rules imaginary? > Every time someone in the management chain has axed the proposal with some variation of "this policy can not be changed because this is our policy and thus can not be changed", possibly with a "due to security reasons" thrown in there somewhere. That's circular, no doubt there. We've decided this rule must remain in place, because it's a rule . This decision-making process doesn't make a…
Once you have people in your organization, you can manipulate the internal economy of favors and perks in order to increase your ability to control their behavior.
A Gervais principle man?
I feel that as organization size increases, individual responsibility decreases. At some point there’s a limit where individuals become responsible for nothing and everything is a policy or process. It would be interesting to try to study or quantify this with different orgs and roles.
Funny enough i though so as well but discovered quite quickly that without this stuff, a lot of people are doing shit. Do i think someone needs to tell me not to put every shitty tool on my work laptop which has a corp certificate? Access to vpn and corp network? With access to HyperScalers? No. What do my collegues? Everything. Oh there is a nice new shiny tool and it sends metrics to an external service, lets try t…
Have you verified that every single application installed on your machines sends no telemetry, no crash reporting, and has no random web servers running that run arbitrary code? It's likely that you've missed one application. Now multiply that by 10,000 employees - all it takes is one application per person, and you have a massive amount of data being leaked.
Founders should keep this in mind anytime they are negotiating contract terms with a corporation also. There is no such thing as a "standard" contract and almost all "mandatory" clauses are not actually mandatory. This also applies to real estate transactions and almost any other high stakes negotiating. Standard and mandatory are terms used to trick inexperienced or less powerful people/entities into agreeing to ter…
In the beginning of my adult life, I was under the expression that contracts were static and immutable. As I got more experience, I tried being more demanding (and my skills were also more in demand) when setting up contracts and I have at multiple points managed to change what was supposed to be "mandatory" and "unchangable" many times, from rental contracts to employment contracts and many other things.
"I want to do X" / "I am too lazy to do Y instead" becomes "We can't do Y, it's a mandatory requirement to do X"
Very high on your response agenda should always be to ask for details. Who mandated this and how? If there's a regulation, cite the exact text of the regulation. There's a good chance the person telling you it's mandatory either knows it isn't or has never actually wondered why, and you can divert them from insisting on doing X / not doing Y to an exciting journey through their bureaucracy to find out that indeed there is no such mandate and never has been.
Back when TLS 1.3 was being finalised EDCO and other groups trying to preserve RSA key exchange tried really hard to pretend that what they were doing was mandatory (it isn't and wasn't) and that their use cases were legitimate (most of them don't even appear to have a sound security rationale, let alone a legitimate purpose).
When we get to September and companies that were asleep at the wheel suddenly notice the 398 day rule (Apple unilaterally changed the maximum lifetime of new certificates in the Web PKI to 398 days starting in September) you can guarantee that some of them will insist that having longer-lived certificates is somehow mandatory.
[ Edited: It's the Enterprise Data Center Operators thus EDCO not ECDO ]