News for hackers. Stuff that matters.
Re:I patched my Slack client to keep “oops” messages others ... by givemeethekeys on Monday September 05, 2022 @09:26PM (#32731540)
In construction, parts of projects are routinely subcontracted out. The primary contractor is on the hook for ensuring quality.

I don't see why software projects can't be the same.

Re:I patched my Slack client to keep “oops” messages others ... by Kalium on Monday September 05, 2022 @09:42PM (#32731662)
They can be, provided that disclosure is handled up-front and the contract is structured for it. Dropping that on someone who had every reasonable expectation - and possibly even contractual language - about you doing the work yourself is quite a different matter.
Re:I patched my Slack client to keep “oops” messages others ... by jackconsidine on Monday September 05, 2022 @09:45PM (#32731680)
They certainly can be the same. In this case the contract I had with this person stipulated that they would be doing the work and this person denied having another person involved ahead of time. Moreover, there were security clearances associated with this person and expanding the footprint was a relevant consideration for the project.
Re:I patched my Slack client to keep “oops” messages others ... by mh- on Monday September 05, 2022 @09:46PM (#32731694)
You hired a contractor from Upwork for a project requiring clearance?
Re:I patched my Slack client to keep “oops” messages others ... by jackconsidine on Monday September 05, 2022 @09:50PM (#32731718)
Sure. Not state-level clearance with capital letters, but access to sensitive infrastructure etc
Re:I patched my Slack client to keep “oops” messages others ... by mannykannot on Monday September 05, 2022 @09:37PM (#32731623)
The person or entity who hired the prime contractor is also on the hook. If you are in that position, it is better to detect and stop a contractor doing things behind your back than it is to explain that you didn’t know that a contractor subcontracted the work to the person who installed the backdoor.
Re:I patched my Slack client to keep “oops” messages others ... by PragmaticPulp on Monday September 05, 2022 @10:38PM (#32732081)
> In construction, parts of projects are routinely subcontracted out. The primary contractor is on the hook for ensuring quality.

> I don't see why software projects can't be the same.

Contractors can't automatically give subcontractors access to the plans, the construction site, and so on. The contracting agreement will have provisions about who can access the site, how they get approved, on what terms, and so on. Becoming a construction contractor doesn't give someone carte blanche to invite other people to a site without regard to the terms of the contract.

Likewise, a software contractor can't just decide to share your codebase and design documents with a subcontractor because it almost certainly violates many of the contractual clauses they agreed to.

Re:I patched my Slack client to keep “oops” messages others ... by NesiG93vXQiSM8j on Monday September 05, 2022 @10:49PM (#32732172)
> The contracting agreement will have provisions about who can access the site, how they get approved, on what terms, and so on.

I would definitely expect all of that to be handled by the primary contractor (i.e. the person who specializes in construction sites). No?

Re:I patched my Slack client to keep “oops” messages others ... by PragmaticPulp on Monday September 05, 2022 @10:53PM (#32732194)
The terms are negotiated between the company and the contractors.

Being a contractor doesn't automatically grant someone the right to delegate access to sites and such.

I think a lot of people in this thread have misunderstand what the law is actually saying. The law doesn't say that if you're given contractor status you can do whatever you want. The law says that if the job is misclassified as a contracting position when it should be a full-time position, then the employee is owed benefits and such.

If you sign a contract with a company that says you will not share the code, design docs, system access credentials, physical building access, or other common stipulations, you can't automatically ignore those because you're a contractor.

Re:I patched my Slack client to keep “oops” messages others ... by SpicyLemonZest on Monday September 05, 2022 @11:02PM (#32732262)
I mean, yes, that’s right. The primary contractor runs the job site, manages who’s allowed to be on the site, and will absolutely complain if the known subcontractors smuggle in random unauthorized people to run cabling. It’s not like they’re being obnoxious just to make money; in construction, as in software, there are many regulatory and compliance related reasons that who does the work matters.
Re:I patched my Slack client to keep “oops” messages others ... by TylerE on Monday September 05, 2022 @09:27PM (#32731549)
Construction has standards, licensure, bonding...
Re:I patched my Slack client to keep “oops” messages others ... by echelon on Monday September 05, 2022 @09:31PM (#32731570)
Startups are supposedly fast and agile enough that perhaps they can evaluate contractor work week over week.

If the work is good, I'd be fine with the above arrangement so long as I wasn't working in an industry that required regulation (PCI compliance, etc.)

Re:I patched my Slack client to keep “oops” messages others ... by encryptluks2 on Monday September 05, 2022 @09:40PM (#32731648)
The United States has employment laws. Hiring someone as a contractor and then treating them like an employee also likely violates US law.
Re:I patched my Slack client to keep “oops” messages others ... by happyopossum on Monday September 05, 2022 @10:11PM (#32731888)
The employee / contractor thing may be a violation of IRS regulations (depends on a lot of factors). Lying to obtain a contract, and lying about who is doing the work and who has access to any sensitive materials related to the work is straight up fraud, so I wouldn’t want to get into a legal pissing match over it.
Re:I patched my Slack client to keep “oops” messages others ... by encryptluks2 on Monday September 05, 2022 @10:50PM (#32732180)
> lying about who is doing the work and who has access to any sensitive materials related to the work is straight up fraud

Fraud would require a contract saying X is doing the work, which is controlling what will be done and how it will be done which means they would be classified as an employee.

Re:I patched my Slack client to keep “oops” messages others ... by roywiggins on Monday September 05, 2022 @09:56PM (#32731772)
I feel like there has to be a legal difference between treating someone like an employee and requiring, say, your contractor Bob to be the one signing in with their credentials bob01 and not his subcontractor Bill.
Re:I patched my Slack client to keep “oops” messages others ... by encryptluks2 on Monday September 05, 2022 @10:45PM (#32732129)
Why would it matter who is signing in as long as whoever does the work follows the same agreement standards? Sounds an awful lot like controlling what will be done and how it will be done, which is the definition of an employee.
Re:I patched my Slack client to keep “oops” messages others ... by roywiggins on Monday September 05, 2022 @10:50PM (#32732182)
I guess I can't imagine a situation where Bill is contracted at a temp agency, turns around and hires Bob, and when Bob shows up with Bill's badge and is refused entry, and Bill somehow wins a lawsuit on the theory that Bill must be allowed to subcontract and anyone he subcontracts to must be allowed on-site to perform the work, no matter what.

Like, not giving out your password (or badge, or key, or whatever) to someone else is a pretty core job responsibility!

Re:I patched my Slack client to keep “oops” messages others ... by encryptluks2 on Monday September 05, 2022 @10:54PM (#32732200)
If they are contracted at a temp agency, then they are taking on the risks Bill would be an employee of the temp agency... Employee misclassification is frequently abused so don't get me wrong, I think it happens a lot, but in many cases people are misclassified.