lobsters score: 32 · tags: security
The story maintains my conviction that audit-ability is one of the main trust vectors in any software/IT company. As long as people like Jim can be held accountable if things go wrong, we should keep doing it the permissive way. Eventual consistency beats constant overhead, in my book.
(The irony isn’t lost on me: auditing caught Jim, and then he ran off. Accountability is the half the company skipped)
I’ve had a tangentially similar issue, where a contractor was “designing the system” for most of a sprint, pushing changes and rotating cloud machines for “iteration”. The service was constantly being redeployed, and a less inquisitive colleague wouldn’t have noticed anything wrong.
I’ve noticed the machines weren’t actually logging, intentionally, and their traces would disappear short after, always overwriting everything with an idempotent naming&versioning scheme. Once this was corrected, it became obvious that the changes were drivel. Driving back and forth and busywork.
Who knows how long “faking it” would’ve lasted if the history was allowed to be obfuscated.
score 1 · canonical
Real story. Some 10+ years ago I worked at one of those bullshit outsourcing companies (tl;dr needed the money, wasn’t in a position to be picky) that had offices all over the world. The one I was in wasn’t in the most economically thriving part of the world, so what we had were hand-me-down laptops from other offices.
We were issued those laptops, along with a locally-purchased backpack which I generally didn’t use, I used my own backpack (I carry one around everywhere so I have really good backpacks; the company-issued one was really awful). At some point I did use the company-issued backpack though – don’t recall exactly why, probably washed mine and left it out to dry or something, hell knows. In any case, I ended up taking it home, and promptly forgot about it.
Two weeks or so after I’d had enough and quit, our office assistant calls me and says hey, did you forget to turn in your company-issued backpack by any chance? I instantly remember that there is such a thing as a company-issued backpack, I look in the closet, it’s definitely there, I’m like yep, sorry, I’ll come by to drop it tomorrow.
I go back to drop it the next day. It’s a minor struggle because at this point I’m no longer in the HR system, and
nullcan’t return a laptop bag. So we’re both on a call with an IT guy from… I don’t recall where, somewhere in Germany, who’s also handling our inventory – and I’m telling him, hey, if it helps, I have my old laptop’s inventory number jotted down in my notebook, maybe you can use it to look back through your system’s history and grab my employee ID from there?And without breaking a sweat my man goes nah, that’s not gonna help, floating laptops are tracked by which office they’re assigned to, and these ones weren’t even updated, they still show up as floating laptops in our office.
I could’ve taken the bloody laptop home and no one would’ve noticed. That cheap ass plastic backpack on the other hand…
score 1 · canonical
Fun story!
I learned that if something feels off, it is worth investigating.
Also the moral of The Cuckoo’s Egg.
score 1 · canonical
Fun story and all that, but wait…
You go to an Apple store with a laptop and a cool story and they provide you with (at least) the name of the real owner and their home address?
score 1 · canonical
they provide you with (at least) the name of the real owner and their home address?
Worth noting it could’ve just been a case of “Was this purchased by XYZ Inc? No? Was it purchased by Jim Lastname?” since the author already had suspicions. It’s also not hard to find where someone lives, and do the same thing.
But also - retail employees don’t care that much, even Apple ones, as long as you’re polite about it.
score 1 · canonical
Good eyes! I didn’t catch that at all.
The Apple store also told him where the five empty boxes were mailed. For those, he didn’t even walk into the store with physical evidence; all he had were the case IDs. Several paragraphs earlier:
In the message he sent me five Apple repair case IDs. […] I find out that he created the repair requests under his personal Apple account rather than the company account, preventing me from gathering more information about the requests.
I’m wondering if he had some other evidence, such as being able to show that his company was the purchaser. I also wonder if this is just a case of a true-but-embellished story, because it didn’t strike me as entirely fake, either.
score 1 · canonical
Good story, but two things would have made it better:
- “Jim” was actually Clay Buchholz
- But also Jim Anchower. https://theonion.com/i-was-too-gone-to-go-to-work-1819584426/
score 1 · canonical
I saw a laptop for sale on facebook last year that retails for almost $2,000 and the guy was asking $200 for it. It was only a couple months old according to its serial number, clean system install no managed lock, he said nothing wrong with it, was willing to sign a receipt for me, he just didn’t want it anymore… I did a bit of online stalking of the guy and found a linked in saying he’s a IT adminstrator in a neighboring county.
I never proved it but still suspect this thing was stolen from his employer.
score 1 · canonical
There used to be a load of scams like this on eBay. If you bid on them, they’d email you and offer an even better deal if you sent them a Western Union money transfer. And then they’d just take the money and disappear.
score 1 · canonical
I found this story so uncomfortable! Dealing with people who lie directly to your face is really unpleasant.
score 1 · canonical
The company that I worked for dropped the ball on pressing charges. All told, he stole more than 30 laptops over the year he worked there… I guess they didn’t care enough to pursue it.
What Did Jim Learn?
It sounds like the proverbial Jim learned he can make an extra $30-50K per job per year.
score 2 · canonical
Given that I was never asked for my criminal record when entering a new company, you may be right.
inb4: I don’t have a criminal record. I’m talking about a document provided by our police department that reads that you don’t have criminal records.
score 1 · canonical
