Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you should store passwords in plaintext

qword.net

Post reply on HN
Print view View original

41–50 of 147 posts

Re: Maybe you should store passwords in plaintext

#41

Post by selcuka »

kapp_in_life wrote: post #22

The incentive to not act like the slackers is how it impacts your "network". It's pretty insufferable to work with these people, when the success of your project depends on them or their team for whatever reason. If our team is hiring and I see a former coworker got laid off who was a slacker I won't put in a referral for them. I guess it won't impact them much, because tech is still growing and demand exceeds supply…

From the article:

> [they] say their new goal is to be “perfectly mediocre.”

Note that mediocre is not the same as slacker. It is impossible to distinguish a genuinely mediocre developer from an intentionally mediocre one, so no, it won't impact their network unless they are really careless and tell everyone that they can in fact perform better.

Do you stop talking to a colleague because they have never found a security vulnerability and fixed it?

Re: Maybe you should store passwords in plaintext

#42

Post by pierat »

shric wrote: post #11

“You don’t get rewarded for being extra. You don’t get any money when you save costs. You’re going to get a raise below inflation. You’re stupid for caring the way that you do. The business’ downside risk is not yours, and it’s profits are not yours either.” Except when you're granted RSUs or participate in some private company's profit sharing scheme. So if that's important to you, find such a place. The smaller the…

> You don’t get rewarded for being extra.

100% true. Our salary, barring real (not manufactured) fires, should be for 40h/week. Any more is free work not compensated for.

> You don’t get any money when you save costs.

There is no equity for doing significant tasks. The common area here is automation. I automate, but don't share. I would never get compensated appropriately, so I save my time in lieu of money.

> You’re going to get a raise below inflation.

Yep, 3%. Job hoppers get 30% or more. My last hop was 115%. Loyalty is NOT rewarded.

> You’re stupid for caring the way that you do.

That's a subjective assessment. But yeah, caring too much leads to extreme burnout. And our only real change is to find yet another slaver, oh I mean capitalist to work for.

> The business’ downside risk is not yours, and it’s profits are not yours either.

Exactly. Start providing real equity, and a seat at the board of directors as an 'emoloyee's director'.

Aside that, we're just resources to be strip-mined at 'human resources'. At least we can choose our slaver as a guise of an "interview".

And RSU's are a game, that we lose. The companies made this, and they do NOT want to pay. So they gamify it to make the appearance of mounds of money. Here's your pennies.

Re: Maybe you should store passwords in plaintext

#43

Post by emptysea »

The quote at the end of the article really sums up my feelings:

> “I think the real answer, the real answer […] this is going to sound weird or bad – is to cajole or trick your employees into thinking that what they’re doing is important.”

Basically I like to fix things at work because I get some sense of satisfaction by doing things the "right way".

Of course this feeling can be worn down, other coworkers not caring, management not caring, etc.

And then you end up in a "work to the contract" mentality, which is what the "store your passwords in plaintext" people seem to be doing

Re: Maybe you should store passwords in plaintext

#44

Post by smsm42 »

SoftTalker wrote: post #12

My eyes really opened to this during the pandemic and its aftermath. Working from home I did almost nothing productive. Got paid the same. Returning to the office, I noticed half the people still seemed to be working from home most days, so I started doing that too. And did almost nothing productive. Nobody apparently noticed or cared. Got paid the same. Got the same raise (yes, below inflation). So now I have given…

Do you shoplift? Serious question. Shoplifting is rarely caught, and even more rarely prosecuted in many major cities (e.g. SF). While you probably won't be able to steal anything high value, there's a lot of things you'd be able to steal without being caught, and why pay for something if you can have it for free? Most grocery stores are owned by billion-dollar corporations, which don't hesitate to raise prices, engage in tricks like shrinkflation and otherwise make sure they get the best end of the deal. So, if you do not shoplift, why don't you?

Re: Maybe you should store passwords in plaintext

#45

Post by megous »

jerrygenser wrote: post #32

Sorry this isn't the purpose of the original article, but does anyone want to give a way secrete should be stored? Even if I use secrets manager for example, I need to store the token for fetching it so there is always a secret or token that needs to be stored. I might not store an access token, I might use user auth and get a temporary token for a script that then calls to a secret manager. The access token is cache…

First, you need to ask yourself what you're trying to protect the secret against. Then you can figure out some reasonable mechanism to do it.

There's no single proper way. You can't always go with "maximum" protection for everything, because then you'll be doing multiparty ceremonies all the time and it would be mighty impractical https://www.cloudflare.com/dns/dnssec/root-signing-ceremony/

Re: Maybe you should store passwords in plaintext

#46

Post by d23 »

Great article. Sums up what I've observed over my entire career. Incentives are orthogonal at best to what is actually good for the company, and at times, doing things that actively harm the company can be the way up the ladder. We're worse than bad at measuring and rewarding good performance.

Re: Maybe you should store passwords in plaintext

#47

Post by SoftTalker »

TheDong wrote: post #23
SoftTalker wrote: post #12

My eyes really opened to this during the pandemic and its aftermath. Working from home I did almost nothing productive. Got paid the same. Returning to the office, I noticed half the people still seemed to be working from home most days, so I started doing that too. And did almost nothing productive. Nobody apparently noticed or cared. Got paid the same. Got the same raise (yes, below inflation). So now I have given…

I don't think that sort of strategy can work for everyone because there's two possible negative mental outcomes in there too. First, some people will feel that they're "cheating" and don't deserve the paycheck because they're intentionally working less. That feeling can be worse than the benefit of having more time. Second, some people have too much of a sense of personal pride to do that sort of "quiet quitting". Th…

I didn't say I felt good about it. But I don't feel bad about it either. I do what I'm asked to do, just nothing more.

As far as pride goes, what I do I do well, or at least to the best of my ability. I don't sabotage anything. Based on reviews of my work and absent any criticism, my employer seems to feel they are getting what they are paying for.

Re: Maybe you should store passwords in plaintext

#48

Post by orwin »

SoftTalker wrote: post #12

My eyes really opened to this during the pandemic and its aftermath. Working from home I did almost nothing productive. Got paid the same. Returning to the office, I noticed half the people still seemed to be working from home most days, so I started doing that too. And did almost nothing productive. Nobody apparently noticed or cared. Got paid the same. Got the same raise (yes, below inflation). So now I have given…

I'll be honest here and tell that anyway, if outside crunch week i get more than 25-28 hours of productive work, i'm either workin on something highly interesting or lyig (im supposed to work 35hours btw).

I'll be even more honest, looking back at what i've produced as a junior, if i spent my weeks working 10 hours and refining another ten, doing nothing the remaining 15 to 25, i would have produced four time as much, and be a mid-level devops in less than a year.

Re: Maybe you should store passwords in plaintext

#49

Post by JoshuaEN »

"Not being rewarded with money seems to be the common theme here, but financial incentives are tricky to get correct"

Giving pay raises which exceed inflation for someone who meets expectations (in anonymous peer reviews) is tricky?

Ensuring expectation meeting employees pay stays in line with market rates--when the company knows the market rate because they are hiring new employees--is tricky?

Even if one argues it is not possible to accurately measure performance (or to get honest reviews from peers), punishing everyone because some employees may be underperforming is clearly not the solution (it will only serve to demotivate or drive away previously motivated and happy employees).

And to be clear, reasonable pay raises is not a solution to all of the problems the article is talking about, but it's a simple place to start.

Re: Maybe you should store passwords in plaintext

#50

Post by pjscott »

In healthier workplace cultures, this kind of don't-give-a-shit behavior is socially stigmatized, while behaving like someone who wants to do things right is socially rewarded. It's easy to forget, but not all incentives are measured in dollars.

I'm not trying to go full Confucius here, but people who do better work than they have to shouldn't be made to feel like chumps by the people around them. They should get respect, so they feel good for doing good things.

Post reply on HN