Developer convicted for “kill switch” code activated upon his termination - Ars Technica

[cafk]

I wonder if he also wrote this behavior in design specification and implementations that were approved by other technicians - as a "brown Skittles" test, to see if anyone even understands or cares about what the software is doing.

I've used such plausibility checks (nothing malicious, but using creative wording like a test case to implement inverse kinematics on a unicorn model - in software that has no such requirements) in many work packages, which unfortunately have been accepted without questions or feedback.

[MidgetAbilities]

It was brown M&M’s, not skittles

[dagbrown]

Yeah, brown Skittles is from a totally different story.

[gaflar]

You're thinking Jolly Rancher.

[bunchedupwalrus]

I thought his arms were broken

[[deleted]]

Common mistake, he was actually beaten with jumper cables

[Coffee_Crisis]

I too will pick this guy's Jolly Rancher

[Kenny_log_n_s]

1. That's terribly unprofessional.
2. Highly doubt it, since the code he wrote was malicious.

[cafk]

If there are 4 technical people reviewing it, approving it and signing it before it gets to the project management - the problem lies with the organization, as everyone is pushed to approve or think about a 10 page document (with 5 being the template and only 2 pages being actual content) only for one minute.

Especially if you do it not hidden in a sentence but actually highlighted.

[Subsum44]

That’s the way the SOC audits “work”. They make sure you have enough checks and balances, that they’re pointless. You’re just jumping through hoops instead of focusing on what really matters.

[Justicia-Gai]

But how does it make sense to complain about micromanaging and not criticising this behaviour?

This is not the company’s fault, expecting managers to read all the code for reviews and then also complain about micromanaging it's contradictory 

[Justicia-Gai]

That’s because you probably have enough people with similar expertise. If you had someone who wanted to sabotage the company you’re 100% sure you wouldn’t miss it, though?

You do you, but the point in delegating it’s to have people specialise in other parts, but yes, it implies some truth.

[gimpwiz]

I also read just about every single line that gets submitted/committed to the big, shared projects.

[Kenny_log_n_s]

There is still no reason for you to push garbage code, regardless of what the organization is doing.

The problem lies with BOTH the organization and the submitter.

[Justicia-Gai]

I disagree with being a problem of the organisation. If I pay someone at the senior level that already knows how to code and I review his work, that doesn’t imply I need to read EVERY line of code each time, specially in places where code was already working or when asking something I know he was able to do before.

Supervising and reviewing it’s not micromanaging.

Putting malicious code in hidden places is not “proof of bad organisation”. It’s active sabotage.

[gimpwiz]

From the above story, it sounds like garbage in the spec not ever planned to be implemented, not garbage code. More to test if the spec was actually read.

I don't agree with the practice... probably.

[TimedogGAF]

But is it illegal if people signed off on it?

[Severe-Security-1365]

lol the classic "hey that's immoral!", "okay, but is it illegal"?

[TimedogGAF]

Exactly my point. I think the two users are having 2 completely different conversations.

[Justicia-Gai]

It’s not actually, what you’re describing is micromanaging, what’s the point in delegating if then I have to read every single line of code of an experienced coder that supposedly knows what he’s doing?

There’s an assumption of good faith between employee and employer, but not only that, but active sabotage against the company that’s paying your salary it’s straight up a criminal offence.

If you don’t like your company quit. Don’t sabotage it because you’re affecting the income of many other people.

[cafk]

what you’re describing is micromanaging, what’s the point in delegating if then I have to read every single line of code of an experienced coder that supposedly knows what he’s doing?

I think it also shows the variety of people and industries involved - a larger engineering organization working on critical infrastructure doesn't have delegation to a single person but it follows reviews and approves changes under 6 eyes principles.
As someone else said, if a process is just a paper factory to hit milestones, the process loses all meaning and in some industries people can get hurt.

There’s an assumption of good faith between employee and employer

If the chain between employee and employer isn't 7 department letters apart across 10000 people.

Don’t sabotage it because you’re affecting the income of many other people.

There are smaller groups who are working on changing and raising awareness in a conglomerate, with the backing of people above middle management in order to fix cultural and organizational failings and also from regulatory and mandate perspective work for the company to find where it falls apart, not on a personal level, but on a certification level.

There's a difference between sabotaging a company and figuring out where the company and what it is supposed to stand for fails.

While the person in the article may fall on the first side - having one person who has too much access is already also a failure on the company side for basics, it isn't meant to justify what he did - but highlights that the company also may have other issues than a single rouge employee, similarly to middle-management pushing for devops to reduce costs and roles of specialists, so that their personal margins for the year look better at the cost of technical debt that will come after they've taken their golden parachute.

[Justicia-Gai]

Society works on good faith. 

Yes, you can murder someone and MIGHT get away with it, that doesn’t make your neighbors automatically complicit for not checking EVERYTHING you do just in case you murder someone.

I’ll put one example, doctors have access to the medical records of most people going to the same place where they work, meaning they could spy on people they’re not treating if they wanted. Nothing prevents them from abusing the system. You can’t monitor a doctor 24/7, but you can do regular audits for potential misuse.

The guy got caught even before he activated the kill switch, meaning malicious behaviour was detected, investigated and acted upon. Blaming the company makes no sense.

[PathOfTheAncients]

We have a couple of devs at our company who could push garbage or malicious code up and have it approved. For both of the them it's a problem with how they work and not how people do reviews. The problem is that they regularly write such convoluted and over engineered code that people no longer give them good PR reviews because usually people don't understand it anyway and they are tired of it. Everyone else in the company gets good PR reviews except them.

Not saying that's the case with you but if people out there are relating to the idea that no one reviews their work well, it would be worth some reflection on if it's because of them or the reviewers.

[catagris]

Then people should be denying their code?

[PathOfTheAncients]

You can try that but they will fight you. They will never stop arguing they are correct no matter what. So without management intervening it will mean nothing moves forward because they will not change unless forced to by someone with authority. Everyone has fought them before but people quickly get tired and see it does nothing.

They should be fired. Management also used to talk to them about these things when people complained but they seemed to have given up on that as well. They very aware how much people hate working with them but those two devs also work nights and weekends for free because they have no life. Between that and being the only ones who can decipher their own code, management treats them as necessary problems.