News for hackers. Stuff that matters.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by fzeroracer on Friday December 02, 2022 @02:14PM (#33835333)
Normal according to who, exactly? Like where is your reference point for 'normal'? I've worked for companies at scale and have never dealt with these sort of problems before because usually there's an understanding that employees when laid off aren't going to do anything bad (unless you're perhaps cutting them out of severance and spiting them, which...).

Do you have any reference points or reasons why you believe this is normal contrary to my own professional experience?

Re:Twitter engineer: I thought I’d been hacked. It turned ou... by horsawlarway on Friday December 02, 2022 @02:38PM (#33835702)
Across basically every company I've worked for - this is normal. And many of those companies are not 3k+ employee tech companies. Think 10 to 100 engineers.

It's actually a requirement for many compliance certifications in the US - previously employed staff are not allowed access to your systems.

If you're in an office - you can wait until you grab the employee and put them in a conference room to fire them before cutting access (as long as security is there to escort them out afterwards). When everyone is remote - that is not an option.

ex: item number 1 for SOC 2 compliance is

----

Access controls

—logical and physical restrictions on assets to prevent access by unauthorized personnel.

----

When an employee is terminated - they are unauthorized personnel.

Re:Twitter engineer: I thought I’d been hacked. It turned ou... by tyingq on Friday December 02, 2022 @02:50PM (#33835883)
I think it's more the dichotomy of companies asking for high levels of commitment, loyalty & trust, but offering none in return.

It's funny that they would fire people in this way, then turn around and ask the remaining folks to sign up for "working long (uncompensated) hours at high intensity".

They are trying to have it both ways.

Re:Twitter engineer: I thought I’d been hacked. It turned ou... by horsawlarway on Friday December 02, 2022 @04:04PM (#33836890)
I mean - no offense... - but if you still think corporate entities have any real loyalty you've clearly not been paying attention for a long time.

I've never seen that attitude last beyond the initial 50 or so employees at a startup, and it sure as fuck doesn't last past the "we're installing monitoring software on all your machines" stage.

Work is what you do to get paid - it's not your family. It's not your friend. Don't treat it like it is.

That doesn't mean don't take it seriously, or respect it - just understand that work is your family like a hooker is your girlfriend - it's only true until the money runs out.

Re:Twitter engineer: I thought I’d been hacked. It turned ou... by tyingq on Friday December 02, 2022 @07:13PM (#33838757)
I'm not sure if you're directing that at me. We're saying the same thing.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by fzeroracer on Friday December 02, 2022 @02:55PM (#33835945)
The only scenario where I see this being an even remotely reasonably request is if you think someone is a severe risk for harming your systems should they be laid off. In every large company I've worked for (including ones involving high security systems) the standard was that you'd give people a week notice, maybe two weeks of an impending layoff along with a decent chunk of severance. This way those people being laid off could do a knowledge transfer and ensure that their domain experience wasn't lost and that you maintain a good business relationship with your employees.

To me, the way y'all present it is not the norm. It's working for a company that clearly does not trust its employees and treats them poorly. If you find yourself working for those kind of places frequently then please realize that it is not the norm and you should not try and normalize it.

Re:Twitter engineer: I thought I’d been hacked. It turned ou... by smoldesu on Friday December 02, 2022 @03:04PM (#33836083)
It's quite normal, unfortunately. Nobody trusts their employees in a $44 billion company, definitely not in the wake of a highly-televised hostile takeover. They have the MDM software, they intend to lay off the employees anyways... there's no wrongdoing here as far as I can see. This is just how they do things outside the startup sphere, it's not like the CEO is going to schedule you a final Zoom call and have their receptionists bring you a bouquet of roses.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by horsawlarway on Friday December 02, 2022 @04:17PM (#33837044)
> It's working for a company that clearly does not trust its employees and treats them poorly. If you find yourself working for those kind of places frequently then please realize that it is not the norm and you should not try and normalize it.

You keep coming back to this - but even in companies where they do trust the employees - legal compliance is not a joke. If you're doing anything at all with customers who are in any of the following businesses...

Healthcare

Banking

Gov

Finance

Law practice

etc...

Then you turn off access when you fire an employee. Period. You can like them all you want, in which case you might go grab drinks with them afterwards - but you don't fuck around with access to your systems, because you lose your compliance certifications, or you get breached, and you lose a bunch of fucking money, you lose your enterprise contracts, and you yourself likely get fired.

Re:Twitter engineer: I thought I’d been hacked. It turned ou... by bmj on Friday December 02, 2022 @03:14PM (#33836244)
Yes, access controls are critically important for many companies in many domains. My employer operates under such operating procedures. It seems reasonable that if your software collects and stores user information, employee access to all systems should be tightly controlled, and "turned off" if an employee is fired, laid off, or quits.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by fzeroracer on Friday December 02, 2022 @03:19PM (#33836309)
This is a great way to quickly lose critical information from your engineers. The few companies that do follow what you recommend end up scrambling when a key infrastructure engineer leaves, they immediately cut access and realize that he was the only one who knew how to work certain parts of the system. If you're the kind of company that conducts exit inteviews (which are the majority of large tech organizations) then you're no longer going to get any valuable info out of them by burning bridges like this.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by horsawlarway on Friday December 02, 2022 @03:59PM (#33836821)
You're misunderstanding the difference between a voluntary exit and a firing.

This is not standard procedure for a voluntary exit at most companies. The employee puts in their two weeks, works the time, and exits. The assumption is good faith on both ends, because the employee has chosen to leave.

It absolutely is the standard procedure for GETTING FIRED. The other standard part of getting fired is that the company has already decided they no longer need your skills or expertise (excluding twitter's situation, where they decided poorly - according to the news).

If you're laying off 100 people - the odds that any one of them might do something silly is very low. But that chance * 100 is usually considered an unacceptable risk from a security standpoint. Multiply it by several thousand, and it's absolutely not ok to leave the keys to the kingdom with that many fired employees.

All it takes is one drunk employee holding a grudge and you get a really nasty mess on your hands. Not to mention legal hot water.

Re:Twitter engineer: I thought I’d been hacked. It turned ou... by spaceywilly on Friday December 02, 2022 @02:41PM (#33835739)
When I was laid off security walked me from a conference room near the exit to my car. I was not even allowed to collect my stuff from my desk, had to have a friend bring it to me after.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by tartoran on Friday December 02, 2022 @03:14PM (#33836245)
Yeah, that firing process is deeply dehumanising.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by themadturk on Friday December 02, 2022 @05:31PM (#33837858)
This happened to my boss, the IT manager at a law firm, when he was fired. Part of his firing was due to complaints by the IT staff, the rest for other reasons. I deactivated his account while he was at lunch, his staff -- three of us, as I remember -- were told to leave for the day, and he was escorted out when he returned from lunch.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by telotortium on Friday December 02, 2022 @02:29PM (#33835563)
Many, many companies, particularly larger ones (5,000+ employees, but Silicon Valley companies are more likely than non-tech companies of a given size to employ "advanced" IT features like MDM) are concerned with potential sabotage by suddenly laid-off employees, particularly in the U.S. Have you ever worked anywhere with MDM installed on your company-provided devices?
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by WalterBright on Friday December 02, 2022 @03:06PM (#33836127)
One company I'm personally familiar with announced a layoff at a branch office a couple months in advance. When the main branch people showed up two months later to manage the layoff, the building was looted clean and nobody was there. Even the furniture was gone. Only trash remained.
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by tartoran on Friday December 02, 2022 @03:13PM (#33836224)
Source please? It really sounds like a myth but let’s see your source
Re:Twitter engineer: I thought I’d been hacked. It turned ou... by WalterBright on Friday December 02, 2022 @03:27PM (#33836425)
My source is myself. I knew the people involved. No, I'm not going to name names.