So I decided to switch teams, to something that was friendlier for remote, more cloud-based backend stuff. A team that was doing daily standups. And it was sort of better. But acculturating into a new team while remote was painful. And the work unstimulating. And the depression and tedium from being stuck at home and dealing with kids in educational and emotional crisis too much.
So I just quit. Walked away from a 10 year high paying "high status" job. And I'm not the only one, friends of mine did the same thing. I suspect much of the "great resignation" was driven by the frankly irresponsible way that employers just didn't manage remote well.
I wasn't happy with $work before remote, but remote + a job with some bad aspects was like pouring naptha on a fire.
Getting a new (remote) job now after a few months off. I think it will be better.
Cybersecurity policies and work from home has always been extraordinarily strange to me.
Optical character recognition exists. Big Corp, trust me, if I wanted to steal your stuff, I'd have it already.
Stop locking my laptop down, we both know that's mostly a scare tactic.
Since this is Google, I think this just means that they don’t trust employees. And that’s a bad situation.
If you can’t trust employees to not do bad things with the tools required for their jobs, then it’s going to result in unhappy and unproductive people.
It’s like not giving carpenters nail guns because someone killed someone.
Since this is google, the repo is hundreds of terabytes.
Not only that, having lots of copies hanging around on laptops is a big risk, even with encryption. Considering that google's likely threat model involves state actors, not having code on laptops is a reasonable mitigation.
But I suspect the biggest issue is that most of the tooling is design to run on whatever version of linux Google runs, not OSX/Windows/ubuntu.
State actors have security clearances for employees with equipment that allows them to contain state secrets on devices. This is a solved problem and Google not allowing any on device source code is not a security issue, it’s a control issue.
Unless you are very special/lucky then your code will need all sorts of the repo to work.
One of the joys of working at a big tech company with a single repo is just how much shit is pulled in by your dependencies.
my code shouldn't need a custom C++ library that does BLAS 0.15% more efficiently than the opensource lib, its just moving data from one bucket to another. However, it does because of a massive chain of dependencies.
> State actors have security clearances for employees with equipment that allows them to contain state secrets on devices
What level of secret? and how many secrets? all of them? No. Security services don't generally allow people to store secrets on mobile devices, because they get lost a lot. They certainly don't allow all secrets ever stored in the DB to be carted around on >70k employee's laptops (of which at least 1 a day is stolen, most often in sleep so the disk encryption key still accessible)
Thats not to say that low-side devices don't ever contain secrets. They clearly do, but they are supposedly risk managed to limit the blast radius. ie, they need to have a good reason to have that secret, a time till destruction, and clear paper trail to see where and when that secret went.
Thats not really scalable to a repo with > 5 million files.
I'm not aware of any security experts that share this reasoning, if the information is truly sensitive and high value.
"There’s many cheap methods to make source code on a stolen laptop useless."
Such as?
If my laptop is stolen and the thief doesn’t have my keys the data contained is worthless and isn’t a breach notification at all.
Good luck at the new job!
When I'm remote, every email I type, message I send, Jira update, commit comment, etc. are etched in stone for reference in all of perpetuity, time stamped and all. There's an unspoken expectation to be informed and expert in all things in many work environnments to avoid looking "incompetent" (which is absurd, everyone is ignorant about some things). Remote work creates a hostile environment that makes this even worse. It makes people think about if they really want to email or call this person to ask about something because they worry that not being aware or not knowing about something may come off to others as being incompetent (people are aware that certain questions and statements can show your hand of expertise). So if I happened to be half paying attention during a meeting with a client or executive, if some change in an effort occurred I happened to miss or be too busy to see, or if I'm dealing with new tech I'm not quite familiar with... I have to tread lightly.
In person, you meet people, you get body language, everyone is forced to speak on demand so competency and lack thereof become very clear in conversations. Expectations relax because if the head has no idea and no one else does and everyone has to reference it, well then, I'm not doing so bad. I'm not relying on looking at their cherry picked correspondence choices. Not only that, people are then more willing to communicate with people because they become more comfortable. They build relationships and they know it's OK to show their ignorance about some specific topic and that person is going to help them out a bit, mostly off the books. Not only that, communication in general becomes less formal. If I'm at the coffee machine and see Alice there and I had some question, I can just drop it in a friendly way. My intentions are more clear from body language, am I trying to assess her or am I really just trying to get the information I need to do my part. If it's trivial it's more natural just just say hey, I don't know how to do this thing, do you? Imagine sending that in an email or scheduling a conference call.
This means for teams that have already built that level of trust are at an advantage in remote. They're comfortably sending those messages to one another. They've met the person and can gauge their personality. For juniors it's probably petrifying in some cases because they want to look more skilled and knowledgable than they are because they often don't have a general understanding of the level of expectations people have of them so they want to do better and often want to make an impression.
The issue is that office culture often has a whole lot of competitive elements and people are more hesitant to communicate, it brings everything to a crawl. If work environments weren't always pressuring their labor force, people would be more willing to admit ignorance and or make informal communications necessary to speed things along in a more formal and recorded context, at least that's my opinion.
I switched teams 4 months ago (old team dissolved in a merger) into an area where I don't have any experience (Django backend -> "DevOps-y" microservices in Go and infrastructure type stuff). These are skills I want to possess and I was grateful for the opportunity. Unfortunately the outcome has not been what I had hoped. I'm trying hard to teach myself but I'm missing so much. My teammates are all significantly more senior and are extremely busy. My experience and reputation in other areas feels like it actually hurts me -- am I not actually a competent programmer, like I thought I was?
Worse is I feel worried about switching teams again. What if I don't succeed there, either? Will I need another 4-6 months to ramp up and gain knowledge? I don't want to end up a pariah, or be seen as an incompetent developer who can't be relied upon.
I'm applying to jobs at other companies now. I know I'll face many of the same challenges there as well, but I don't really know what else to do.