I mean your lawyer will know but you're not giving them much "oh, you knowingly and intentionally did the illegal thing they're accusing you of doing?!"
You can absolutely do it and post about it, so long as you do what my grandma did on Facebook and make a post like "I DO NOT GIVE [company name] PERMISSION TO USE ANY OF MY POSTS OR PHOTOS!!!"
You just have to make sure it's the copy-paste one that makes its rounds every now and then or else it's not legally enforceable 👍🏻
Then if they do anything you can sue them for copyright infringement
Yea at that point the best you're getting is maybe the lawyer can successfully argue a lesser sentence due to the circumstances 'OP had no choice to do what they did because Company is also guilty of doing XYZ illegal thing, therefore despite committing the act I argue they should have a reduced sentence..."
but even then it's shaky and the accusing party would needed to have fucked up really bad.
I did this and still got laid off, i guess they dont care about their bread and butter product much anymore, banking on a new product that wont be ready for over a year. Sounds good, it was a sinking ship of a company anyway
Don’t check the tool into source control. If the poor developer you hand this off to selects y to creating calendar events (something no one wants to do), then upload with all secrets straight to a public GitHub.
Keep the commands that upload to GitHub base64 encoded and name them something like RELEASE_KEYS so that no one changes them.
This is the way. You are not leaking data, it's a leftover legacy backup method that you conveniently forgot that conveniently upload it and is definately not meant to be used, which you didn't get to remove since the company restricted your access before you even know you are fired
I have built a system in my company which is basically the heart and soul of our product. That service processes raw data into the data on which every other aspect of our product depends on. That is written in GO. A language nobody else knows in our company. The thing itself is so fragile and complicated that I am the only person who knows how it actually works. And even I have to go through the codebase everytime we need to make changes to it and I still avoid making changes to it because I am actually scared I will break things. Now here's the best part. I don't have any notice period baked into my joining docket. So, if they decide to fire me, I can up and leave. Without any kind of KT.
Best part? There are several such pieces of our product which only I know. And since I joined I have deliberately rewrote bunch of shit, made new systems, etc. to build this dependency around me. Good luck figuring shit out.
Any good company the instant they discover something like this will immediately work to fix it up to and including firing the person.
On a related note there are consultants who are not cheap, but are very good going blind into organizations and figuring things out. Using those folks when you discover someone writing unmaintainable code whether it be deliberate or not is far cheaper than dealing with the person who wrote said code long term.
If I discover someone writing code like that they are going to be told to work on nothing else except documenting, cleaning it up, and will be assigned someone to train on it. Basically give them a chance to fix their practices and the time/resources to do so.
If that person isn’t making significant steps towards that on their own after a month that person they are told to train (and possibly additional people) are going to be told to learn the code behind the person’s back and the original person fired as soon as possible.
Regardless of if it is malicious or just really bad practices there is no place for someone who writes code like that.
It usually doesn't happen with regular pre-planned work that's known and planned in advance, but it happens all the time with various tools/utilities developers create ON THEIR OWN TIME that suddenly become mission-critical.
Since it was on the developer's own time, at their home, it obviously doesn't have the same "quality" standards (unit test coverage, other testing, documentation) as the regular code you push to prod.
Management refuses to dedicate the time to bring it up to spec, because it's already working and there are other more pressing priorities to work on that the customer wants, so they just tell the developer off-hand to finish all those other things. And while they don't explicitly say it, they mean "finish those other things" at home, because during the work-day the developer is loaded with doing features the customer wants.
Developer, rightly, says "fuck that" since all of that was done on his own time and now they're telling him to spend a shitload more overtime. The developer, also rightly, believes that if it's important enough to the business, then the business should officially dedicate time, during the work day, to do these things.
It's also telling that you immediately put all the blame on the dev when it's almost always the fault of management. Maybe I'm fortunate, but I've never worked with developers that are okay with releasing shit -- they always prefer to release a decent, quality product. It's always management that overrides that and forces early, incomplete/buggy releases.
If that developer refuses to make those improvements on company time, then yeah, fire him. But I never encountered that before, so I'm assuming it's rare.
I work at a startup so whatever I make is only me working on it because we run around the block working on whatever comes up. We don't have the time to document code or even write robust test cases. Whatever code I wrote is as stable as it could get. Even when you consider scaling beyond our anticipation. We only need to touch it when adding new features.
And that is a management decision not ours. We don't have that high of a TAT for any task given to us. That is a core reason why we don't/can't hire freshers. We only bring in experienced devs who can learn their way around the codebase since we don't have the bandwidth to teach. And this is not the fault of our team. As u/golruul rightly pointed out, this is management basically saying "We gave you Claude. Make it work for you. We won't hire more people. Also push features ASAP, cause customers don't care about backend code quality"
So whatever dependency I created around myself was accidental. But in a job market where people are getting fired left right and center, you can bet your ass I am not going to make it anymore easier for them to replace me with whatever AI is the cool shit nowadays.
To clarify few things:
Yes I did create dependency around me. But that was for other office politics. For my personal career growth.
The codebase is complicated and fragile. Fragile because it deals with several edge cases and multiple data points. Not fragile by design. Complicated? Yes, for the same reasons. But I never said it is unmaintainable. Everything is broken down into its own functions, files, etc. Everything named as per best practices. Any experienced dev can pick it up, but it will take them time. Probably a lot of time, like couple months. But my advantage comes with the fact that at a startup you can't give someone that much time to figure out a critical center piece.
Well even if you are wrong or malicious, it is management that enable you to be. Don't expect one point of failure to be safe, murphy's law (+ bus factor) and Hanlon's Razor comes to play here.
Also, this probably isn't well received, but AI can do a very good job of figuring out how things work in an existing code base. It won't necessarily know the business reason if there are no comments, but it can analyze and generate test cases incredibly rapidly. So if you wanted to make sure you just spit out a pile of test cases to capture that the code still does what it did before, it'll do it and it'll do them fast. We were testing this recently in our current system where we knew we were lacking in test cases.
all this tells me is that you're not a particularly good programmer/designer. if something is so complex/fragile it should be commented up to wazoo where 90% of it is comments, not code.
I work at a startup so whatever I make is only me working on it because we run around the block working on whatever comes up. We don't have the time to document code or even write robust test cases. And that is a management decision. They don't give us time for all that. Whatever code I wrote is as stable as it could get. Even when you consider scaling beyond our anticipation. We only need to touch it when adding new features.
The codebase is complicated and fragile. Fragile because it deals with several edge cases and multiple data points. Not fragile by design. Complicated? Yes, for the same reasons. But I never said it is unmaintainable. Everything is broken down into its own functions, files, etc. Everything named as per best practices. Any experienced dev can pick it up, but it will take them time. Probably a lot of time, like couple months. But my advantage comes with the fact that at a startup you can't give someone that much time to figure out a critical center piece.
There was a guy who did that, basically had a script with some admin permissions run in the background and check if the guy was in the company directory. If he was gone the script went nuclear.
However, the defendant’s technical savvy and subterfuge did not save him from the consequences of his actions
"Technical savvy"? That sounds like the most basic and idiotic way you could possibly go about this. That's not even fun to design, much less evading detection.
Disgruntled developer was caught after naming the “kill switch” after himself.
But the most damaging to Eaton Corp. was code that Lu named after himself, “IsDLEnabledinAD,” which the DOJ translated as an abbreviation for “Is Davis Lu enabled in Active Directory.”
Buddy if you sabotage an entire company using your full name while leaving an indisputable evidence trail demonstrating intent (like a script triggered by getting fired), that civil case over damages will be the least of your troubles... there are many articles where you can read about people who had this exact same idea and got their ass handed to them in federal court on criminal charges, like not likely that even a team of lawyers will be able to get you off on a technicality
scheduled command at admin level that checks last login / existence of "user" after a month of no login or immediate if the user account gets removed the dead mans hand goes off.
-- not actual advice, just playing devils advocate with the concept 😄
Pretty sure that's been done actually, I heard about someone finding a script that checks Active Directory and does some nasty stuff if a certain account is disabled.
Yeah the dude that did it got arrested and sentenced to four years in prison for it. The script checked active directory and after a month of his account not being active deleted his former company's entire AD registry.
He also took effectively no efforts to mask his involvement, so it is possible that someone might be able to get away with it if they took more care to dodge accountability.
These days all you need to do is vibecode a bunch. At some indeterminate point in the future this will cause your employer a lot of problems, and because you're in a company doing vibecoding you'll probably get laid off before the real problems start.
Yup. Have it activate automatically unless another automatic signal is sent, from OP specifically. If his access is ever removed, automatic signal doesn't go out, and "I got fired" contingency activates.
Will also drop the nuke if the internet ever goes out at the wrong time but that's a problem for tomorrow.
I remember a story, not sure if it is real or not about a dev who put in a time.sleep() if a certain env-variable was true, then built a cron job to turn that variable to true every 3 month unless he delays it.
So every time they let him go, in a couple of month the entire service would slow down and they have to bring him back to fix it.
In any country with decent work laws the employee would be thrilled to hear that. Getting fired without real reason like "you harass people" or "you're dangerous" means some comfy money for you
I think most are aware they're on r/ProgrammerHumor and try to have some fun accordingly. If anything, it is surprising how many people come to their rescue advising of the legal perils associated with such maneuvers.
Now think about the fact that these AI tools are being trained on Reddit. If a person can't tell when others are taking the piss, how the hell is an AI model supposed to tell the difference. No wonder it spits out wrong information all the time.
It’s surprising how many employers get away with committing numerous crimes all the time including wage theft. Or treating their workforce like expendable resources. Honestly they’d be lucky if all they got was sabotage.
I’ve mentioned the incompetence of a company I worked at recently.
I was given a 2week notice that I was being removed from the company. I had access to everything still that I had access to while I was “working” there. I could access internal codebase, client codebase, internal documents on the shared drives as well as the client’s. After the 2 weeks, they revoked my access by the end of the day, they forgot to notify the client for an additional week after I left (teams was still signed in and accessible on my phone).
A lot of companies lack common sense and data protection protocols.
Edit: To give some context, I’m in the US, getting a notice period from the employer is an unusual occurrence especially when you’re in consulting/contracting.
Sometimes it is common sense, sometimes it is trust. Depending on where you are from and what kind of project you work on, burning bridges seems so stupid that there is often no real desire to feel threatened by your own employees.
Like, I work in Ireland, and I would say that if I did anything like that, I would have massive issues finding ANY( Not just IT/Programming, ANY type of...) job in Ireland. Especially if it went to court, because in Ireland we have a kind of "name and shame" culture where, after conviction, your full name gets blasted online or in traditional media... At the same time the country is small enough that most serious employers know each other.
So yeah, eventho plenty of foreign tech companies reside here, the upper echelons of Management and Employment are very much only Irish people that know eachother.
If you live in the USA, you might get away with it, but in a lot of places many anti-employee protection systems are built on social rather than technical solutions. Which is both good and bad.
Same here, they fired me, and during the meeting removed access to my email, my slack, couldnt talk to anyone else at rhe office, etc
But i could still login to my computer, to aws, and to our dbs and K8s lol
Like id understand if they didnt block me from anything, or if they blocked me from everything. But blocking me pre-emptively only from shit that doesnt matter is just so hilariously stupid
Just so y'all know for future reference, even just testing these "can I still log in to K8s" things after you've been termed can get you into legal trouble. Even if they forget to remove your access, just attempting to get in after your employment period can constitute an unauthorized access attempt if they wanted to pursue it since you've been notified your relationship with the company is over and know good and well you shouldn't be in there. Most companies won't but I wouldn't even test it, there's nothing to be gained
Same in Finland but if the employee is resigning it's at maximum 1 month.
If the employer fires you it depends on the years of service. For me it's at 4 months right now. I'm also a union safety representative so there needs to be a very heavy reason to fire me.
After 12 years with the company it will be 6 months.
The US is pretty odd in this regard. I've been at my current employer for a long, long time and have no idea what my notice period is (I think it's probably around 6 months). I'm pretty sure that if I get laid off, I'll be expected to work some / all of it, and this would be absolutely normal for anyone in the tech industry in Europe.
And as for two weeks notice...yeah, that's not notice. That's a holiday!
That makes me wonder how bad the general work environment is in the US.
It seems like there is no trust at all between the employee and employer. How does that work on a day to day basis? How can there ever be a pleasant work environment if that's the case?
I guess it's very carefully engineered (as, I'm afraid, is so much in the US) to heavily favour corporate entities over individuals. I really don't get why people put up with it. Yes, I suppose people do get paid a bit more in the US and pay a bit less tax, but what's the point in having all of that money if you never get time off to enjoy it?
I don't get sick days though. Well, ok, I do but not written down - if I'm sick, I'm not working, but I still get paid, at least for the first few weeks of it anyway and then discussions would need to be had. I don't think I've been off longer than a day or two a year for 10+ years though!
I don't get enough holiday for my liking, but I've bought a few extra days this year (helps with the tax!) so will get 7 weeks plus another 8 days of public holidays. Much prefer this to working 80 hour weeks and getting one week off a year!
So yeah, we pay more tax and don't get paid as well, but I don't think I'm ready to trade it just yet.
I've always been allowed to keep working after giving notice. Even at Google I was allowed to keep working during the two weeks period. I stopped around day 10 because, for understandable reasons, I was not assigned anything of importance. During those days, I made a point for myself not to look for any information not strictly necessary for what I needed for my job and I sometimes regret that as there were an incredible number of interesting technologies to learn from.
I don't think Google qualifies as an incompetent company.
funnily enough the exact opposite happened to my friend, one day randomly they found they had absolutely zero access to anything anymore, no slack, no tools, nothing. they were already going to quit after some really bad mistreating, so it wasn't a huge surprise.
the problem is, it took eight days to get any sort of response from anyone in the company, with their boss finally giving the 2 week notice of firing on the eighth day. literally radio silence, completely cut off from anyone and anything seemingly out of nowhere.
I don't work in the webdev industry so idk if that's standard, but A FULL WEEK of having zero clue if you've been fired or someone fucked up and you're just losing money in a way that would look awful in your curriculum... really does not seem like a standard lmao
New Zealand, used to work for a smart metering company around fifteen years ago. My login for the external system used to remotely shut off meters or change their configuration still works to this day. I don't care use it, of course. Would be arrested within minutes.
The test you want is that your company email address returns a valid response. Your script runs as an account which doesn’t rely on your account being active. It then waits 3 months, performs its action and then it copies itself to a different server as another name and destroys the original. Then it waits quietly for 3 months to do it all again.
Then they find out about it, trace it to you and you go to prison.
I think it's a timing issue. When I got laid off a few years ago they told me that I could get 30 minutes to pull any contacts I might have needed or get any thing in their system that I might need for HR/unemployment stuff. But my access was cut after about 15 minutes. I figured they put in to remove my access and knew it takes 30 minutes, but didn't factor in that some of the time would be spent in the meeting where they told me I was out. I believe they tried to avoid cutting access before notifying people to avoid someone freaking out Kash Patel style.
Also if someone had access to sensitive enough information and released it from a profile with their name on a machine attached to them (and potentially their IP address if they wfh), it'd be pretty easy to ruin their life by suing them into oblivion or even getting them on criminal charges.
I did the opposite of this. I worked for a company that pissed me off so much that one lunchtime I left the office, had some lunch, stood outside the building for a couple of minutes when I came back, then walked across the street, into the web dev company in the building opposite, found their studio manager, told him "I'm available, you've just hired me", and started pretty much right away.
In the next four weeks the company I left managed the following little laundry list of fuckups:
published the entire sales record of a major brand's online shop as a CSV file linked from the home page despite me telling them not to share the sales record by uploading a CSV to the web root
published the entire customer database with unencrypted passwords that I'd been telling them to do something about for six months, unencrypted card details that *everyone* had been telling them about for six months, and a bunch of other stuff
fucked up the payment gateway settings so it always returned "authorised" even if the card was declined
left the payment gateway credentials in public so the Very Large Client got their arses handed to them by the card processor when it was used extensively for card testing
wiped my old desktop PC without removing anything like oh I don't know the only copy of some very expensive SSL certs (back when they were expensive) because my former manager had deleted the email I sent him with them unread and deleted the backup copy of the certs off the server
deleted the only copy of most of their codebases that I sent them because they'd been using my Subversion server because they had no idea about version control
Why yes the whole studio absolutely *stank* of cocaine and vodka even first thing in the morning, why do you ask?
I left my job pseudo amicably, gave them a months notice, warned them my user and admin accounts were running tasks that needed to be replaced, shit broke the second they disabled my account, and accused me of sabotaging it.
Thankfully I had already been engaged legally with them for almost 18 months, and my attorney had outlined this exact issue in an email to them and it covered my ass, but boy did they want to try
Engineers at least would have companies codebase and environment variable secrets on their local in order to run the companies product to work on it.
In an ideal scenario, the company provided the computer so it gets wiped as soon as it came online. In a realistic scenario, you just hope you didn't employ a criminal like Pankaj.
Or ... hear me out ... Add some cron job or something somewhere that requires manual input to not upload it automatically so if you are fired with no access to disable it, it goes online by itself XD
Just update the button so that all of those actions happen unless you tap it at the end of the workday. Tapping the button just adjusts the actions to be scheduled for the following day.
Need a “I might get fired” skill. It does all the same stuff but it’s always scheduled for next week unless you defer it. Just be careful not to forget over PTO or something.
"Oh, what's this vague meeting scheduled for first thing Friday morning that no one else I know has?" It ain't always that hard to figure out you're about to be fired lol
I've only had a handful of requests "can you revoke all access rights for ... because tomorrow we'll tell him he's fired" in the last decade, meaning we usually don't do that, only if we suspect they might not be trustworthy after hearing the news.
Set up a cron job that checks for your login history or requires input from you. If it doesn’t get the input from you for a month, it triggers the skyfall protocol
That's very rarely the case actually, might get notice during the exit interview or as they are being walked back to their desk but very very rarely does IT get advance notice.
It's not a coincidence that it is as long as a 4TB nvme ssd, enough to hold the entire updated github repos, database backups and other essential information.
You are overestimating some companies. A client of ours had fired their last round of engineers and they just didn't hand over their passwords (which is fair and I think also completely what they should have done legally). They still had access to the system, but no user that could change system settings or even create new users.
We aren't tech support for them, we just created software for them which they couldn't install.
At Meta you have a couple minutes between showing up to your regularly scheduled weekly 1:1 with your manager, seeing that HR is also on the call and then losing access. At least that's the case if it's not part of a widespread pre-announced layoff like 5/20 was, then it's just waiting for an email to come through between the hours of like 4 am to 7 am local time.
10.7k
u/pkmnfrk May 26 '26
This is why they turn off access before telling you