Hacker News new | past | comments | ask | show | jobs | submit login
There's been a big rise in monitoring workers at home (zdnet.com)
216 points by walterbell on Dec 17, 2021 | hide | past | favorite | 219 comments



My previous job used MS Teams with that "productivity dashboard" built in to it. I reported to multiple people within the organization. One of those people was adamant about the team being signed in and available at precisely 9AM PST and he loved his dashboard metrics. And whilst I spoke with this particular manager about this issue, he wouldn't budge on the subject and unfortunately wielded a bit too much political power to be routed around.

To sign in to MS Teams at the company you needed to run a 2FA app from your phone to get the code that would let you log in. I wrote a Python script that ran on a Raspberry Pi, that would pull the 2FA code from an Android emulator running on another machine running the 2FA app, and then the script would paste the 2FA code in to MS Teams running on the corporate laptop using a USB keyboard/mouse h/w emulator. Every morning my machine dutifully booted up, logged in, signed in at precisely 9AM and made sure it showed I was available and active throughout the day until it was "time to go home."

The company overall was pretty decent, but unfortunately there are toxic managers and little Napoleons everywhere.


>I wrote a Python script that ran on a Raspberry Pi, that would pull the 2FA code from an Android emulator running on another machine running the 2FA app, and then the script would paste the 2FA code in to MS Teams running on the corporate laptop using a USB keyboard/mouse h/w emulator

That's amazingly brilliant, but Unfortunately it wouldn't work everywhere as in our org, the 2FA app will only be allowed to be installed on our company provided phones bound to our company issued phone numbers/SIM.

Also, depending on your company and employment agreement, if your Raspberry PI gets compromised by an attacker and uses your 2FA to gain access to your AWS account for example, and causes damage, then your employer can hang you out to dry in court.

I already saw one case where an ex-employee is being sued by his former employer because he decided to be clever and knowingly worked around the company's security policy measures, which he agreed to adhere to in his employment contract. Workaround which lead to an attacker getting his keys and stealing customer data from AWS buckets. Ouch!


Almost all of the 2FA apps are just using bog standard TOTP, and have a way of getting to the cleartext OATH seed that's needed to automate it. It's typically just a few lines of Powershell, Perl, Python, etc, to take the seed, interval, and current time to spit out the right code.

Pretty much, if they offer a phone app, you can replicate the 2FA codes yourself.

Edit: Of course, protect the seed with gpg or similar if you do this.


You could automate it with a camera and OCR even if the software is locked. ;)


Yeah, "webcam pointed at a security token" is a classic:

https://smallhacks.wordpress.com/2012/11/11/reading-codes-fr...


Hackers would be better of looking for a flaw in the security envelope in the enterprise than in the security envelope of my internal network. I am pretty confident in stating that the only way you could compromise the Raspberry Pi is if you had physical access to it, and you'd still need to get past the encrypted filesystem and the password on the OS. I think there are higher value targets with less security than a Raspberry Pi that lets me sign in to MSTeams at a specific time of day. Would I deploy this on anything that was critical or mattered? No. Would I let one of my team deploy this on anything that was critical or mattered? Also no.

As a footnote, I can guarantee I could make it work on your company provided phones too. Even when they're locked and with a biometric scan requirement and the inability to run any non-approved software.


need to automate the company phone then. Not impossible.


Don't think iPhones are open to invasive automation tasks. At least that's their main sales pitch in regards to security vs Android that's more open to these kinds of things.


I created a computer vision based bot that would play an iPhone match-3 game. A lazy Saturday afternoon of work. It was fun.


You can tape a touch simulator to it (or use a fake mouse, afaik that's nowadays supported) and monitor the screen with a camera. If it requires FaceID or TouchID it's getting trickier, but even that's probably doable in an environment you control.


Or...you can take all that time and energy you'd invest building this complex Rube Goldberg machine that just proves you're present 9-5, and instead, invest it in finding a job that's not so toxic.

Seems more healthy for your mental wellbeing in the long run, as toxic policies in workplaces rarely come alone but tend to come sequentially one after another as time goes on if the terror managers don't change or enough employee don't jump ship simultaneously to trigger a management change.


> [...] instead, invest it in finding a job that's not so toxic.

Nobody's saying they're not doing that. Depending on life circumstances and where you live, it can take months to find a new job that's actually better than the one you're in, even when actively looking.


You seem to take this seriously but putting something together like this is exactly what makes programming/engineering fun. lol. I love putting together weird crap like this.


I build a lot of things that like that. From putting a space invaders game on my digital resume website, to an autonomous R/C car that can evade a pursuing dog that jinks left and right like a rabbit, to an internet controlled robot arm used as a cat toy, to a touch screen cat toy that exhibits predator/prey response from the feline interacting with it that results in a paper about improper toe bean rejection because there are not enough science papers written about cats interacting with touch screens, to figuring out which way up a piece of material has been loaded in to a CNC, to "open the pod bay doors" that will open my garage door, to an interactive smart home screen that monitors where my cats, phone, wallet and amazon packages are (and also displays the weather), to a multi-camera streaming setup that is voice activated "Hey producer, roll VT" that talks to me like Cortana from Halo, to a computer vision system for recognizing electronic components and sorting them into appropriate piles, to a remote operated cat litter cleaning robot arm, to cataloguing every book read, science paper digested, class attended, movie watched and album listened too since 1984. And then there is the weird stuff.


Sure, but I'd apply that at the point of the original posters setup already.


You've assumed an awful lot about me based on a few flippant comments I've made on social media. Perhaps that time would be better spent finding a different outlet for your frustration. It appears that these days people on HN jump to the "find another job" solution as fast as people on Reddit jump to the "get divorced" solution.


Can biometric auth be required on iOS? I had thought iOS treated these as convenience alternatives to device pin.


By default in a standard iOS installation, it's a convenience (one only unlocked after a PIN is input on rebooting). Individual apps may request access to FaceID/TouchID (not the raw data, but the iPhone's verification of biometric identity.) The user must whitelist the apps to use that permission, but a company could easily make their app not function if that permission is denied.


I've already circumvented a variety of biometric requirements in various devices in my personal research and just for funsies. FaceID is fooled by a 3D print, and also if you never enroll your face in FaceID but instead use something else that is face-like, the system doesn't care. FaceID is dumb, insecure and doesn't care. TouchID similarly - it just wants to see a squishy thing pressed against it that vaguely resembles a human finger to enroll. It's security theatre. Consumer grade biometric security is as useless as consumer grade paper shredders.


> Consumer grade biometric security is as useless as consumer grade paper shredders.

IIRC, consumer grade paper shredders got pretty good in the past few years. And your examples both rely on the person setting up the security circumventing it by supplying bad training/enrolling. Which makes it bad if you want to guarantee a person is behind it, but fine if you want to treat it as something that belongs to the person doing the enrolling.


You're not wrong, but anything up to DIN P-4 is a couple of evenings of work to defeat with an automated computer vision algorithm. Ask me how I know. Most consumer grade shredders on the market are DIN P-2 and DIN P-5 is where it starts to get really tricky but is still possible to work with.

And I have found that most corporate security, especially in the biometric arena, is sub-par, usually because of the human component doing the enrolling. I am not saying it isn't workable, but that there is a vast landscape between people's perceived utility/functionality of the security and the actual security envelope it provides. Fortunately for me, security is very difficult to get right.


What’s the right way to dispose of paper containing sensitive information?


The NSA recommends P-7 with full incineration. Fellowes has a P-7 model, but do you really want to spend $7,000 on disposing of your credit card statements. P-5 and P-6 are acceptable for home use. P-4 is also acceptable if you aren't really trying to hide anything and just want to dispose of those credit card offers, CVS receipts and that printout you received from your vet. Disposal security sits right alongside digital security in that you have to ask yourself, how much of a target do you consider yourself to be?

I use a P-4 shredder, also from Fellowes, that cost a couple of hundred bucks, that replaced a burnt out P-2 shredder I got for $30 from Staples. I am considering going to a higher capacity P-5 if I can find one at a reasonable price on eBay, mainly for the extra shredding capacity and the hopper feeder than any additional security it provides.

How seriously do I take my disposal security in my home? Well, I'm not a target, and there are other higher value targets with less security, so why would they go after me. I shred any mail or paperwork I don't wish to keep physical copies of, but it sits in the "to be shredded" basket near the shredder for a good six months before I get around to it. There's an oppportunity there, if I were a target. And the "to be shredded" basket will contain bills from my medical insurance provider, phone bills, ISP bills, electricity bills, cheques I've deposited, grocery receipts.

Whilst I practice good op-sec within my house -- no paperwork leaves without being shredded, tightened network security, VLANs for suspicious devices, locked down networks, and 2FA where appropriate -- I'm not a target and I have very little reason to be a target, so I don't need an onerously heavy shield. I'm cautious, not paranoid.

You need to evaluate your disposal security within the context of "what is convenient" rather than "what is best."


Thank you for this detailed response.


Nice.

If you can automate the observation, you can automate your observance of the observation. The symmetry is great.

It’s even kind of poetic, because the more creative type of person who is less valued as a drone is the type of person to extend the effort to do this, whereas the clock-in-clock-out type with less investment and motivation is less likely. Sort of a “if you’re clever/motivated enough to end run it, your clever enough to not need this anyway.”


> If you can automate the observation, you can automate your observance of the observation. The symmetry is great.

Never measure the productivity of engineers with plain numbers. They will just take it as a challenge on how to optimise for that particular measurement.


Not even engineers; this is true of all business. Any metric defined quickly becomes a goal whether it was intended to or not. Once you attach incentives to the metric, it will be focused on to the exclusion of everything else.


Easier said than done, but if you can manage to set up the metric to align the business and the employee, life becomes very easy for management. Working on designing and implementing production-based pay systems in warehouses, when it goes right the department runs itself with barebones management as a little profit generating machine that fairly pays workers a very good wage. When it goes wrong though...


Yeah, the problem comes in when the dynamic changes and you’ve overoptimized for the old dynamic and don’t have any ability to flex within the systems without totally overhauling them. Hence the current supply chain problems…


> If you can automate the observation, you can automate your observance of the observation. The symmetry is great.

Nice quote.


> if you’re clever/motivated enough to end run it, your clever enough to not need this anyway.

Except that controlling people changes their motivations.


What about adding a captcha?


Outsource it to amazon mechanical turk, or something equivalent ;) Pay a dollar to have someone else fill it in.


Simple CAPTCHA work pays 3 cents. Ask me how I know.


there are captcha solving services


Every morning my machine dutifully booted up, logged in, signed in at precisely 9AM and made sure it showed I was available and active throughout the day until it was "time to go home."

That's how Edison got started.[1]

[1] https://www.gjenvick.com/Biography/ThomasAEdison/05-TheBoyTe...


Edison was probably using a different version of MS Teams, before Microsoft added all the extra bells and whistles like video meetings.


/sensible_chuckle


As a manager, I can’t even imagine a scenario where I would require someone to be online at a certain time.

Maybe it’s the type of work or business requirement that causes this behavior, but I view this as such a violation of autonomy that it would immediately kill team morale.

You sound like a very creative/talented developer, if I were you I would not put up with this.


I think it’s really hard for people to shake the old work ways. Once we went fully remote my whole department fully embraced flexibility. And guess what productivity was good and work was getting done. People worked all kinds of work hours to either care for children, sleep in, do whatever who cares. I’m more productive in the afternoon so I log in late morning. I could log on and get nothing done but I’d rather sleep in. There are no expectations to respond to messages in off hours. You get to it when you’re working. You are not expected to work extra. It’s taken a bigger adjustment periods for some of my people but we are getting there.


It killed morale, and due to other issues, eventually killed the entire project about a month after I left. I have already found a new position.


This, crazy management always backfires

At a previous job we had to log all hours of the day, with a comment, in existing tasks. I felt like my work time was spent mostly making stuff up to manage management expectations, instead of development

On Teams, I believe now on your account management, setting up the 2fa, you can say you have trouble using their app and download the otp key which you can use in a generic app like FreeOTP, or integration

On the desktop I use Caffeine like apps to force the status always online


  Every morning my machine dutifully booted up, logged in, signed in at precisely 9AM and made sure it showed I was available and active throughout the day until it was "time to go home."
Heh, an old coworker was doing that manually back when we were at office that had a tool tracks how much time we spend at office and shows that on an internal webpage. He was logging a perfect 8:00 average at the end of the month because it was such a stupid system


> I wrote a Python script that ran on a Raspberry Pi, that would pull the 2FA code from an Android emulator running on another machine running the 2FA app, and then the script would paste the 2FA code in to MS Teams running on the corporate laptop using a USB keyboard/mouse h/w emulator

That's fucking hilarious/brilliant!


> that would pull the 2FA code from an Android emulator running on another machine running the 2FA app

Brilliant. Curious what software do you use to run Android emulator(qemu, bluestack)?


What Android emulator do you use?


If you want to monitor my work PC usage, you also need to take into account my unbidden shower-time work insights. And my countless 3 AM waking work thoughts. And the dreams I’ve had about my job that are really hard to quantify, but which played a role in the solutions I have provided.

And all the outside-of-work time spent exploring and evaluating the ideas I came across from just being interested in the state of the art. And what I learned from building hobby projects that put those ideas to the test with things that nobody cares about except for me, instead of trying them out for the first time on the company’s flagship product.

And.

You also need to account for all the time I had nothing to do because I wasn’t allowed to proceed since I was waiting for the Product Owners to approve the development effort, and they rescheduled the meeting four times.

You need to account for the times when I asked for more work and wasn’t given any for three days, and was told to “just be available.”

You need to account for when my workspace broke when someone in Security blocked ALL of eclipse.org because “you can’t trust that open source stuff,” and your sanctioned resolution process is slower than a tortoise on quaaludes.

You need to account for choosing to band-aid your tech debt until even the scion of [Rube Goldberg, Frankenstein’s Monster, IE11’s Quirks Mode, accidental dynamic scope, the Pennsylvania Lottery] told you that the latest “feature” would break stuff with 100% confidence, and you still went for it.

I stopped putting sugar in my coffee and I think it might be affecting my outlook.


>If you want to monitor my work PC usage, you also need to take into account my unbidden shower-time work insights. And my countless 3 AM waking work thoughts. And the dreams I’ve had about my job that are really hard to quantify, but which played a role in the solutions I have provided.

And if they just want to see you glued to your PC 24/7, doing work stuff, and if not they'll fire you?

That's an easy response for an in-demand job like programming, but for other jobs, from call centers to all kinds of services (translation, accounting, etc.), it can be met much more sternly by employers.

What's really needed is a more massive societal rejection of this, similar to how people would respond to monitoring school bathrooms...


One of the best sayings I've heard is that you don't charge for the time it takes you to do something, you charge for all the time it took you to learn how to do it.

University isn't free, time spent learning as a junior (probably at another company) isn't free, and programming isn't something anyone can do well. The only real measure should be the result.


This is a classic 1958 spanish film. 30 glorious seconds.

https://www.youtube.com/watch?v=Q-w7JCTOpwU

"Do I owe you something?" "That's 100 pesetas". "100 pesetas just for tightening a screw?" "No, that's free. It's 100 pesetas for knowing which screw needed to be tightened".


I think that’s a riff in Steinmetz’s bill[1] to the Ford Motor company for fixing a generator.

“ According to Scott, Steinmetz listened to the generator and scribbled computations on the notepad … Then he told Ford’s skeptical engineers to remove a plate at the mark and replace sixteen windings from the field coil. They did, and the generator performed to perfection.

Henry Ford was thrilled until he got an invoice from General Electric in the amount of $10,000. Ford acknowledged Steinmetz’s success but balked at the figure. He asked for an itemized bill.

Steinmetz, Scott wrote, responded personally to Ford’s request with the following:

Making chalk mark on generator $1.

Knowing where to make mark $9,999.

Ford paid the bill.”

[1] https://www.smithsonianmag.com/history/charles-proteus-stein...


This story/joke is so old and I've heard it in so many contexts that I doubt it really happened.


This story probably happened —maybe not exactly as told here; however, the framework of someone making something ordinary valuable through precise application of knowledge is likely older than Steinmetz.


I've made the analogy many times to various managers, "A tracheotomy is a small incision, the difficult part is where to make it."

I leave out that since I built Frankenstein's monster I may be the only one that knows where to do it :)


You assume the other person is rational and reasonable.

If the mouse ain't movin somebody's shirkin


Never use the mouse on commandline work ;)


ah the sweet release of mouse jiggler software

work for me, script


I worked for a company a number of years ago which demanded accounting of everything company related so I did indeed timesheet stuff I did outside of the office. I got paid for it. Of course I mentioned this to colleagues who did a combination of the same and putting any old shit in it to get paid.

Eventually after a few weeks the requirement to timesheet our work was removed. Clearly it was costing more money than they anticipated. This was under the guise that they trusted us and didn’t need the reporting any more (bullshit!)

One of the glorious things about timesheets is that they are an interesting infallibility paradox. The owner of the timesheet system will tend not to question what is recorded as it proves the system is fallible, so you can record anything.


> You also need to account for all the time I had nothing to do because I wasn’t allowed to proceed since I was waiting for the Product Owners to approve the development effort, and they rescheduled the meeting four times.

> You need to account for the times when I asked for more work and wasn’t given any for three days, and was told to “just be available.”

If they want you available from 9-5, then they are accounting for that time. Well, they're paying you for that time at least.


It’s a problem when I have to report all my hours and “twiddling my thumbs due to corporate incompetence” is not a valid time code. But yes, it should be if that’s how they choose to go about it.


don't give them ideas, you don't want them to start monitoring your showers and dreams too :-)


Tell me about it... My own experience with forced fun and creepy contests that encroach on free time has left me in a state where I wouldn't be shocked if a company one day didn't introduce a "dream tracker system" where employees wear electrodes at night and are expected to compete for the scientifically recommended amount and kind of sleep, to drive down premiums.


I put my work computer on it's own vlan this week, no rules to talk to anything else in the network. I keep the laptop closed so the camera doesn't catch anything ether. Really just peace of mind things.

I wouldn't be surprised if there's some sort of productivity software installed on my work laptop that I'm too lazy to investigate. It's their computer, they can do what they want with it.

If a manager ever talks to me about metrics vs output, I'll likely just not listen. The advantage of being skilled labor, I guess, is you kind of make your own rules as long as you meet goals.

This situation is much more dire for upcoming generations who work low level jobs like the service desk, where metrics are absolutely hammered and abused by bad managers. I can see this breeding a generation of tech workers who have ptsd about 'not being productive', which leads to burn out before they even get to a level where being monitored stops being relevant.


This is mostly my sentiment. They can monitor the laptop they provide. I am mildly concerned about 'company' attempting to monitor wifi traffic, which I use for other things, but not enough to setup its own vlan ( although I will admit that I am debating it ).

In my case it helps that my current boss is not into simple metrics and goes out of his way to be fair and transparent, but not everyone is so lucky. I still remember one of previous bosses, who wanted me to track average processed cases and wanted to make sure they did not know what is being measured. What I quickly learned is that people are not idiots and figure out what is being rewarded even if they are not explicitly told.


> This is mostly my sentiment. They can monitor the laptop they provide.

I don’t agree. Company surveillance of workers is very stressful and invasive and saying “it’s their laptop” isnt good enough. The worksite of most workers is theirs too, so does that mean it’s okay to put microphones in the break rooms and cameras tracking bathroom breaks? I don’t mean legal, I mean morally.

I don’t want a company microphone listening on my family conversations in the distance


I agree with you. When I said laptop, I assumed the monitoring of whatever signals go through it. I would hope that no one would suggest monitoring of external environment at my place.

For example, teams/zoom call? Go nuts. Screen shots of laptop screen. Go for it. Chat. Fine. Listening in to me jacking off to dwarf porn? Not cool.

I still see it as mostly useless. And I am saying this as a person, who worked at a place that had 'bathroom break' policy. The most annoying thing about it.. it was used as a tool to get rid of people management did not like.


> I don’t want a company microphone listening on my family conversations in the distance

Indeed. These machines should not have a built-in microphone. How do you really know if it is not listening? Cameras can at least be covered.


> I am mildly concerned about 'company' attempting to monitor wifi traffic

It is possible to do this? Also, would it not be very illegal?


> It is possible to do this?

Yes. Intrusion detection software will want to know everything about the network and peers.

> Also, would it not be very illegal?

You've likely already agreed to let your employer and their equipment do whatever they want it to do.


Wireshark can pick up any traffic on your WiFi network so they could run something similar.


Wouldn't it be encrypted HTTPS traffic?


> Also, would it not be very illegal

Depends on the jurisdiction. In the EU, very much so.

A ruling from a few years ago, and regulations are only getting tighter ( this was pre-GDPR): https://www.theguardian.com/law/2017/sep/05/romanian-chat-me...


> I put my work computer on it's own vlan this week, no rules to talk to anything else in the network. I keep the laptop closed so the camera doesn't catch anything ether. Really just peace of mind things.

What do you do about the laptop’s microphone?


> The advantage of being skilled labor

Skilled and currently in-demand. Plenty of skilled people don’t have that chance.


> Everything about their employees is monitored and tracked, down to individual finger and eye movements, to prevent waste and track performance. All emails that are sent out include an estimate of how long they should take to read. Go to fast, you get scolded for not paying attention. Go too slow, you get scolded for inefficiency. Get it just right? You get scolded for being a smartass.

—- Snowcrash


IMO this doesn't go away until we get rid of the 8 hour model. Stop caring about how much time (salaried) people are spending at work. If workers participate in meetings, remain reachable during the work day, and meet deadlines, why does it matter if they're on their work laptop for 30 minutes or 8 hours?

OTOH, this monitoring stuff makes sense for hourly paid jobs where the employee has to deliver a certain amount of completed items per hour. But that's the exception, not the norm.


> this monitoring stuff makes sense for hourly paid jobs where the employee has to deliver a certain amount of completed items per hour.

Couldn't you just monitor that deliverable directly? Why would you have to monitor anything else?


I've observed this issue over and over at a dozen tech companies I worked for. They're not interested in deliverables IMO, they're interested in employee head count and total compliance.


Yeah, I've noticed something similar. If feels to me kind of like everyone who has people working below them are interested in having a story that prevents them from being fired if something goes wrong. "Hey, I had everyone working 50 hour weeks. So it clearly wasn't my fault." Because random events can make things go wrong at any time, there's always a pressure to have all your ducks in a row.

Apparently, just saying your employees were working a bunch of hours and having time sheets to back you up isn't enough proof for some people. Enter employee monitoring software. Prove to your bosses that you can't be fired because you made a bunch of people jiggle a mouse for 8 hours.


Yeah, it probably makes sense when there isn't an output product, like minding the counter - pay for an hour of time, doesn't really matter if you ring up 100 customers or the store is dead and you literally get no customers.


I agree with you. Salaried workers are paid based on doing a job, not based on time, so who cares what hours they work as long as the job is getting done?

It is the incompetent butt-in-chair managers and other talentless cling-ons in the tech industry that concern themselves with such trivial nonsense because they don't have the skills necessary to discern productivity in any other way.


I mostly agree with you; but what if knowing being “available for work” means being available for a specific 8 hours of the day is crucial to my mental health?

On call is brutal. What if I want to go camping, hiking, on a road trip? I’m only on call once a month and it still drives me crazy that I lose my freedom for that week.


I've realized that people who are task oriented lean more towards creative. People who are effort oriented tend to want management positions.

My manger complain, "I was so busy I had six hours of meeting"

My fellow dev would say, "I was nose down. I really wanted to get that status message to stop flickering"

My manager would report that there was 15% more story points completed over last sprint

My dev would report that the new grid view is complete and is ready to go to QA.

People who work together often have fundamental different ideas of what success looks like.


> IMO this doesn't go away until we get rid of the 8 hour model. Stop caring about how much time (salaried) people are spending at work.

Does getting rid of 8 hour days just turn into 24/7 work, in the same way that unlimited vacation time turned into less vacation time?


> in the same way that unlimited vacation time turned into less vacation time?

I think these are both related to culture. My company went to unlimited vacation earlier this year and people have been noticeably taking more PTO than before. I ran the numbers and I've used an extra week so far than I would have been allowed otherwise.

Maybe other teams haven't been taking as much, but as far as I can tell people are taking advantage of this because we've all heard the unlimited PTO leading to less time off stories, we don't want that to happen here.


It won't go away until your employers are contractually or legally unable to do so. If you're passionate about this, you'll have to get your fellow workers on your side and make your demands collectively.


>this monitoring stuff makes sense for hourly paid jobs where the employee has to deliver a certain amount of completed items per hour.

Ah, yes, so we have the 2 hours per day salaried remote-work six-figures compensation tech class and the 10 hour per day full surveillance janitorial wage class. We are so content so serve you, milord.


Rest assured that we will join the "janitorial class" as soon as our management can figure out how to quantify software deliverables. I give it 10 years.


> Stop caring about how much time (salaried) people are spending at work.

Personally I think salaried work is the problem. "Meeting deadlines" only makes sense as long as the deadlines are reasonable, and how do we decide if they are reasonable other than how much time they take? There's always more work to do, always more bugs that can be fixed, code or processes that can be improved, etc. At least in software engineering, salaried work makes no sense to me at all, and my eventual goal is to become hourly, because otherwise it's just a nebulous set of expectations and constant (explicit or implied) negotiating about how much time is worked.

It should also be easier to do less than 8 hours a day, but I view that as a mostly separate issue than the salaried vs hourly discussion. Salaried work just is just another way of saying the company gets free overtime work out of its employees.


You sell your hours to the employer at a bulk discount rate, but in return you get predictability of income independent of actual work load. This is a compromise most people are happy with.


That’s just plain creepy. Germany had many cases of super market and drug store chains secretly spying on their employees and they were rightfully punished for their practices. https://www.focus.de/finanzen/karriere/berufsleben/spitzel-v... (2013)


Supermarkets and drug stores are the worst. Remember when one of them made menstruating employees wear arm bands, in order to make it obvious for the supervisor that this employee is entitled to additional bathroom breaks?

https://www.theguardian.com/business/2004/sep/05/theobserver...


“The telescreen received and transmitted simultaneously. Any sound that Winston made, above the level of a very low whisper, would be picked up by it; moreover, so long as he remained within the field of vision which the metal plaque commanded, he could be seen as well as heard. There was, of course, no way of knowing whether you were being watched at any given moment.”

- George Orwell, '1984'.


A great thing to unionize over. If you just quit your job eventually the equilibrium of the system will probably result in most jobs having this surveillance over time. You need to fight it directly with coordinated work stoppages.

The reason the system will equilibriate is that at first you'll have your pick of many more jobs. However, certain employers at the margins try it first, then more prestigious ones that keep their employees there with golden handcuffs. Then the rest follow the prestigious ones until there are few jobs without it and your individualist strategy has no where to turn.


I disagree. This sort of thing costs the company money, opens them up to possible legal issues, and doesn't actually do anything to improve performance.

The companies that understand that "butts in seats" does not equate to performance will not use this, as such. If those aren't currently the most prestigious, they likely will become so, because they care about doing things that bring results, not merely make bad managers happy. Because of that, while there's an uptick right now, I don't see it lasting; I certainly don't see it taking over.


The alternative to "butts in seats" is some kind of hard KPI. Uber doesn't need to pay for "butts in seats" because it can manage workers through discrete and easily monitored performance indicators.

For any job where performance is hard to measure, either a company needs to basically manage contracts (why not just go to Fiverr), or manage by a bad KPI (lines of code? feature points?) or pay for "butts on seats".

"Butts on seats" means "employees who are present, and hopefully intrinsically motivated (rather than driven by a bad KPI) to add value to the company in a way that's not fully specified by their manager."

They very existence of employment as a phenomena (rather than contracting, as it originally happened (IIRC a "factor" was a subcontractor who made goods at home, before it became better to employ them in a "factory" where they didn't need to be micromanaged by KPIs) is because employees are better (in a lot of ways) than management by "things that bring results".


>> "Butts on seats" means "employees who are present, and hopefully intrinsically motivated (rather than driven by a bad KPI) to add value to the company in a way that's not fully specified by their manager."

Does the company gain value in employees being present? Sure, if the employee is a security guard. Not so much if it's a dev.

"Hopefully (something else happens)" feels like you're saying "we need a KPI, this is -a- KPI, ergo...". Hoping an easily measured KPI correlates with what you actually care about feels like a -really- bad choice of metric.

I'll also mention, pre-COVID, I've worked at places where attendance wasn't tracked; we had high performers we kept, and low performers we let go. I've never worked at a place that actually checked or cared about attendance, so I can't speak to that, but I can say highly effective workplaces didn't need it.

How did we determine low performers? Well, the tasks they were given didn't get done, nor did they raise up the fact they were stuck. When asked they got defensive. When it eventually was handed to someone else it was done quickly. When they were asked to work with someone else on something, the other person ended up doing all the work. Etc. None of those are "hard KPIs". They're all data points that indicate "this person is not actually moving the work forward".


You seem to make the assumption that employee productivity must be reducible to and quantifiable as one-dimensional measurable metrics.

I’m not saying it’s generally wrong to do so but just because it’s tricky for certain positions doesn’t make it a good idea to force it.


> This sort of thing costs the company money

You underestimate how much are companies willing to sacrifice efficiency (total amount produced) for profit (extraction of value from labor to capitalist).

There was this book (I don't remember the name) that claimed that UAW unions wanted more worker autonomy to compete with Japanese, and it was more actually more efficient system, but the management killed it because it threatened their position.


This is a "just so" story.


So is your parent post on how monitoring will take over if devs don't unionize.


Perhaps, but do you really think developers are different from every other kind of employee? While we are well paid, the overarching story has been to systematize the work and increase the number of workers in an effort to drive down costs and increase management control. I think it's naïve to think this trend will lead to companies making wise decisions that cede additional control to workers. After all, this isn't speculation, we're discussing an article where 1/3 of workers are already subject to it!

The main thing that has made our profession different is that the work is intellectually difficult and requires a lot of training. If you think similar knowledge work jobs aren't subject to such pressures, I know a doctor that is freaking out about how they are training nurse practitioners in online schools to take away hospitalist jobs.


No, but I think everyone being forced to work remotely due to a worldwide pandemic -is- unique. The switch was not a carefully considered bought into thing, and companies are reacting to it with what they think they need, not what they actually find they need.

You call out 1/3 of workers are already subject to it; I will call out that despite almost -every- company going from "I can see who is in the office, at their computer, and I can walk by and get an idea if they're just doomscrolling Facebook, or at least staring at an IDE" to "now I can't tell at all what they're doing", a full 2/3rds of companies, in the UK (a country that already has a culture of passive surveillance, with cameras on most urban street corners and the like) -haven't- instituted such measures.

As time goes on, will that 2/3rds of companies also buy in? Maybe, if they find they can't actually determine who is and isn't producing. But that has always been a challenge with knowledge workers, and the move to remote hasn't actually changed that calculus at all. What -is- certain is that increased monitoring, especially in countries that historically have objected to it (such as the US, which is also a leader in the industry when it comes to establishing trends), has a cost, both monetarily and in morale. If companies don't see a return on investment, the push for it will likely subside, and it becomes something to cut for the sake of budgets, if not also competitiveness in attracting talent.

I will also point out, pre-COVID, most companies didn't actually track time spent in office for knowledge workers. While blue collar employees would clock in and out to ensure they were putting in the hours, and service industry employees would, necessarily, have specific hours they worked, knowledge workers such as devs (a very different category of beast than doctor or nurse, who though knowledgeable and highly trained, are not actually knowledge workers. A nurse is not nursing if they're staring into space thinking about their patient. They are more like service industry in that regard, working well defined shifts that require manpower. Same doctors; there are appointments and scheduled events they have to attend and do. You can't replace a surgery, unlike many meetings, with an email) generally have had no such measures, despite it being no more difficult to institute them. Why? Because companies realized that attendance is not a proxy for performance. The fact a bunch of bad 'leaders', faced with the most singular workplace disruption of our lifetime (hopefully), reacted poorly in trying to pretend it is, doesn't tell us anything about long term trends.


> However, certain employers at the margins try it first, then more prestigious ones...

A slippery slope argument. The fact that there exists a gradient of willingness to monitor remotely isn't a sufficient (or even necessary) condition to guarantee that most workers will be monitored: equilibriums can be established at 0% or 100% or anything in between. If remote monitoring isn't tolerated by individuals, I don't think it would become a prevalent practice, even without coordinated collective action.

Apply your logic to pay. Some employers pay very low wages. Others pay high wages. If you just quit your job, will the system reach an equilibrium with low wages? No, in fact, we know that wages in tech are quite high.


> in fact, we know that wages in tech are quite high.

Are they? Compared to what a janitor makes or compared to what management makes? Compared to what they would be if they hadn't been held back by anti-poaching agreements in the bay area?


You guys will do anything to avoid even considering collective action because you want to hope you don't have to do anything. Hope doesn't guarantee results.


That guy, a vishal garg, who fired 900 employees, domestically and internationally --most of them were not developers/programmers, etc. Just run of the mill white collar workers --who presumably he had statistics on given he mentioned many "only worked two hours while claiming eight". So... like everyone who works using a computer then would have to be unionized?


Just run of the mill white collar workers --who presumably he had statistics on given he mentioned many "only worked two hours while claiming eight".

He claimed that at the same time as firing 900 people. To me it sounded much more like his internal justification for his actions rather than something that was true. Essentially I believe he was mentally shifting the blame from his own failing to successfully run a company that could profitably utilise 900 people, to making it the workers fault that he had to fire them.

The fact that he doesn't appear to be replacing the workers shows there wasn't work to be done. Is it your fault if you do all the work required of you in 2 hours?


I don't know this story, but didn't they consider firing themselves or their one downs who led this state to exist, if it really did.

900 is not a huge number in Operations. Given a span of control of 10-20 per team per manager, and around 5-8 managers per senior manager, that's about 8 people for them to be managing directly, perhaps add 3-4 as heads of admin or automation functions with small teams then that's an incredibly typical Operations office, at least with boilerplate span of control recommendations that come out of McKinsey, BCG etc (indeed I have problems with these, but it is 'standard').

Was everyone lying to this Head? Did they create a culture of busywork? Did it become a dysfunctional closed shop impervious to supervision? Did the Head at least know their two-downs' names or ever have a chat, or the offer of one?


Well, (a) management lies but it's possible and (b) bigger unions are better!


Can we just unionize against _this one topic_ and not the other baggage that unions bring?


Nope. I'd much rather unionize for better wages, better conditions (that includes this topic), collective bargaining, and to wrench some of the power back to the people doing the actual work. Not every software developer is making six figures working for FAANG, some of them have to put up with some awful conditions, and the whole "just get another job, it's not that difficult" attitude is a bubble that a lot of HN lives in.

In short, I want democracy to extend to the workplace. The line we've drawn is artificial and one-sided.


The problem people have with unions is that many of them elevate the lower performers by pushing down the higher performers. The higher performers have leverage already without a union. Of course this only works when there are more positions open that benefit from high performers than there is supply of high performing workers. Many tech workers believe this will be the case for some time to come.

What would work better is if a union could allow for varying wages based on skill set. The problem here is demonstrating that skill, as often times it is difficult to objectively measure.


Many unions do exactly that. Every movie star in the US is represented by SAG-AFTRA, which is the same union that represents B-list infomercial actors. The union helps the stars negotiate multi-million dollar contracts, and the same union ensures actors you've never heard of are compensated and treated fairly. Same thing with professional athletes and their unions.

White collar unions usually negotiate a floor that individuals can up-negotiate from. Not only can you negotiate for better compensation, unions will happily represent you and help you get what you're asking for.


"many". No. Very few (in the USA) in fact act in that way. And a union for white collar workers would most certainly not.

A union for white collar workers would be closer to UAW or AFLCIO and would most certainly have fixed compensation packages


You understand unions are democratic, right? You can vote out the leaders if you disagree how they manage it.

Now of course, if you are in the minority, and still feel slighted (and under-appreciated), there is always an option to start your own business with like-minded people.


I do understand that. And it is one of the reason I do not support them. I am an individual, I support individualism not Majoritarianism

Direct democracy normally end badly because simple Majoritarianism is bad

This is way in most democratic nations the will of the majority is balanced by other means or controls.


OK.. You might as well be a solipsist.

Why do we even have the discussion, then? If you don't want to participate in society, just don't. It's not clear to me why I would support you being an individualist (and adopt any of your political positions), when (according to your philosophy) I get nothing back in turn.


lol, nothing could be further from the truth, I have to say though this is the first time I have been called an egotist for advocating for a voluntary, individualist society. That is a new one, I thought I had seen all the ways people that want collective control over society could manipulate my words so A+ for being able to surprise me at my old age.

>> If you don't want to participate in society, just don't.

Participation in society does not require an over aching organization either governments or collective body's to manage my participation for me. I participate just fine negotiating my own individual contracts, my own business deals, etc. I do not need a third party to inject them selves in the transaction. Looks up Voluntarism, and/or Georgism and you will get a since of my worldview, it is far from solipsist

>> when (according to your philosophy) I get nothing back in turn.

Then you have a very narrow world view. The best interactions are voluntary, I attend social events because I enjoy the conversation, I buy a new computer because a need to get X done, I work for my employer because I need income to do the other things, my employer pays me because they need my skills, knowledge, and labor to advance their mission. These are all voluntary exchange where we each get something from the other.


I don't think you're an egotist necessarily, but rather misguided. I mean, how do I know that you aren't egotist if your demand is to walk away from any deal on the basis that it is voluntary? If you reject any tool through which I (another party) can force you to follow the contract? You have to admit, it is very suspicious.

I am not clear how you imagine resolving conflicts in your society. That requires some sort of authority, and this authority being based on democratic vote seems to me like a decent solution. Especially if the conflict involves third parties - negative economic externalities for example. I think to try to understand the world (especially society and politics) as a series of two-party interactions is grossly reductionist.

Not to mention the distinction between parties is rather arbitrary. For example, let's say you consider joining a multinational company as an employee, and the company already has unions, but the legal contract you are having is with the local subsidiary of the large mother company. Then on what basis do you recognize who or what really constitutes the other party - the multinational, the local subsidiary, the multinational including the unions, your hiring manager, or some other combination? What about joining a worker cooperative, would you refuse to join on the principle, because it is internally democratic?

And if you, in this case, accept the legal definition of contracting party as the "other party", why do you have a problem accepting a legal concept of democratic constitution? Or any other law or regulation, for that matter?


You wouldn’t have to stand in line behind him at the hospital or wait for the fire department to put out the fire at his house first. Because as an individualist, this person can tend to such matters themselves.

That seems like a benefit to you.


You’re leaving out the part where those who come to control the union also import their personal politics/agendas, bully others into silence, and abuse their position far more than company management. Look at any major union like the NEA - the leaders and their acolytes are weaponizing the power intended for collective bargaining to push ideological agendas and propagandize children at schools. Meanwhile they barely do their actual job and resist all accountability. So why is the authoritarian control of unions preferable to that of company management that just advances the company’s financials and leaves the rest out of it?

Regarding developers - you seem to be ignoring that most software developers outside of FAANG are just not very good at their job. They have to put up with conditions in part because of their low value and replaceability, but certainly no one is forcing them into one industry over another. Therefore they must see the compensation as a fair trade if they are choosing to remain in the industry. Given the lower quality of work, I also wonder why you think they’re doing the “actual work” and not their management or other job functions at the company.


It is people like you that drive high earners away from unions. Single issue unionization is a lot more important for upper middle class. If you cannot get enough high income workers to buy-in, then your plan is dead on arrival. Bernie will be proud.

Not everyone cares about the social justice issue du jour, most people just want more money. Ultimately, any union plan must show clear benefits and right now if you are earning more than 6 figures, unions are nothing but a waste of time and money. You have yet to demonstrate that an upper class union can go beyond crabs in a bucket gatekeeping.


> Single issue unionization is a lot more important for upper middle class.

It's just not particularly valuable.


Unions aren't democracy, though. They're seniority.

If you start at a company, it'll be harder to rise through the ranks.

And if you start a company, you'll be forced to go through union processes to remove bad fits.

Our industry and compensation as they exist today don't need the baggage. If Europe and emerging markets put price pressure on our jobs, then maybe we can reevaluate. As it stands, we don't even need pensions when we can FIRE in under a decade on existing comp arrangements.


There isn't one single type of union with one set of rules. Do Hollywood actors get paid by seniority?


Just when I was going to chime in that IATSE had seniority rules [1], I found that SAG-AFTRA does too!

[1] https://iatse99.org/job-referral-rules/

[2] https://www.opeiu537.org/Portals/local537/cbas/.SAG-AFTRA%20...

You can't escape it.


I think you'll find that unions are defined as democratic organizations of workers and so they will be whatever you and your colleagues want them to be. There is also a legal framework established to keep labor peace, but you don't have to be peaceful (in the sense of not resisting) if you don't want to.


Something that gets lost in the US is that the Union is made up of members. Many Americans appear to have the idea that the Union is the HR department for the employees. As a result, members often stop attending meetings, advocating for policies, etc. The unions devolve into a corrupt body because the lax democratic oversight allows a populist leader to provide just enough bread and circus to member while lining his or her own pocket.


The problem union advocates in America have is whenever things don't go their way, they immediately resort to calling the workers idiots. The workers aren't idiots. When they perceive that unions aren't listening to them, it's usually because that's true. The union corruption and contempt for workers is the cause, not the consequence, of workers giving up on unions.


lol what do you think the bosses do when things don't go their way?


But union heads are elected by union members, aka workers. If the latter consider the former to be corrupt, they have the power to change that.


Voting in a union like the teamsters might as well be pissing into the wind. The ability of any individual worker to change the way things work is academic at best, particularly in the big unions.

Practically speaking, the most choice a worker has is to vote against the union in their shop, since their shop is much smaller than the union itself. Suppose you've got a shop with a hundred workers, and a union representing a million workers wants you to join. In the initial vote of whether or not to join, each worker has a hundredth of the decision making power. After they join, each worker only has one millionth of the decision making power. The only meaningful choice is whether or not to join that union; after you join you're going along for the ride with no real input into it.


> I think you'll find that unions are... whatever you and your colleagues want them to be

This is not a realistic model at all. The kind of people who tend to accumulate power in unions, especially more white collar unions, do not tend to be the same kind of person or have the same personal or political goals as the people they nominally represent.

Fledgeling tech unions in particular seem terrible here; I don't get the sense that they represent my interests as a tech worker at all, but rather that they come with a ton of political baggage and they only want my membership as a pretense for demanding random crap that I don't care about and doesn't benefit me.

For example, the (unpopular) Alphabet Union "aims to stop Google from allowing its social media platforms such as YouTube to function as a hub for right-wing extremism and white supremacy". It has nothing to do with improving the material working conditions of union members.


I used to be my company's union rep when I worked in Norway. I had zero need to fight for anything my coworkers did not want. Actually, I was very happy to do nothing until my coworkers complained and asked me to talk to management.

Not all unions are the same, if you think those others are bad you can make your own.


Unionization in the US is very different than in Norway.

Anti-Union bias in the US is well founded and rational due to the terrible union laws we have, combined with the terrible track record of US unions


> Not all unions are the same

Which is why I very specifically called out tech unions. Plenty of unions seem to be doing the thing I said unions should do (attempt to improve the material working conditions of their members).


I suspect that you and I disagree on the politics, but it sounds to me that the unions haven't found the right issue yet that is broadly appealing enough. This issue of surveillance might be one.


My non-political normative belief is that unions should represent the interests of their members in their capacity as an employee working under the union.

Stopping employers from spying on employees would definitely fall under this description. Again, I just haven't seen any tech unionization efforts in the US that legitimately seem to care about workers instead of using them as a pretense to accumulate power towards some other end.


Well, I do agree they should represent their members' interests. I will aver that fighting alongside your fellow workers builds class consciousness and progressive values, but that's up to you and your colleagues.


Countries with high union participation rates have not seen nearly the divergence between wage growth and productivity growth over time that the US has. There's tons of data on this. Unions are good, union participation is good.


This statistic isn't enough to say whether unions are good or bad, even if you assume there's causation. How do you know they don't do that by slowing down productivity growth, rather than by speeding up wage growth?


An employer owns your productivity, not you for the 8 hours (or whatever logged time) you work a day.

"Owning people" in the classic sense (even during limited periods of working hours) is slavery, and that's not legal (any more, at least).

Through over 20 years of work in IT, I've learned that managers get this wrong far too often. Even performance reports are direct evidence of deep breaches of personal rights.

The model of employees not being able to use personal time as guaranteed by law, Surveillance tactics, hostile work environments, etc... have all been rampant in US culture forever.

If you're entry level you're a beast of burden, and deeply entrenched in proving yourself and solving critical problems, also at the mercy of accountability and almost always underpaid... At the "trusted top" they're playing golf on the clock and getting golden parachutes even if they under-perform... There is a better balance than this.

Now I'm not into a chaotic work protest as much as anyone else, but the truth is that even the poorest and least powerful masses can overwhelm and conquer any small handful of wealthy elites if they say "Let them eat cake" as history has shown...

We're facing a huge breakdown of everything that makes the world work unless people re-align their perspectives of equality and fairness in labor, and it's a lot bigger than just a few employees unionizing.

Employers own the productivity that employees agree to delivering, and if there is a performance issue, then there's already plenty of precedent to handle that. Expecting an employee to work every minute of an 8 hour day is insane, and not remotely realistic, even if they are a horse.

Employers adding surveillance to the mix only highlights the encroachment of the slave owner mentality in employment, and it could easily create a lawsuit over mis-use and abuse, and it probably will end up in court soon in a very public manner.

It's probably the USB "self-moving mouse" that created all this hype to be honest, but it's still a necessary move for many.


Is there anything good that humanity did not turn to shite given enough time? I mean we could very well work half the hours and be as rich and have zero unemployment but heck no. We need to have 10% or more unemployment rates and work our a$$es off.

Same thing with remote working. It was a dream that came true and in record time turned to a maze of horror rooms.

Dunno. I guess do not work for such companies (if you can find something better anyway).


Monitoring your employees' work at their computer is losers game.

This only works for menial jobs where you can actually see the work happening, the widgets being cranked.

But even in a job as simple as callcenter operator you can have people who treat your customers well and you can have people who are there to just get as many calls as possible to get their stats for the day. You can't tell that by looking at time spent and number of calls served.

For people who are supposed to organise their work, think through plans, etc. the work does not happen in the computer, it happens in peoples' hearts and minds. I know a lot of people who spend their entire days with busy work providing no value to the company, because they are only interested in continuing their employment.

It is stupid because it is saying "I can't evaluate the value you provide but at least I am going to make sure you pay the costs (in time spent at the computer)"

My company has very simple vacation policy -- take as much vacation as you want. Come back when you feel fresh and ready to something great. Which makes me want to figure out how to actually be more productive.


A colleague at the company I worked for was asked to explore available options regarding this matter. It simply didn't occur to him that this was supposed to be kept in secret, so pretty much everyone knew about this being planned, which turned out to stop this idea before it has been implemented.

Later, I was asked to implement some metrics in our in-house ERP, which would tell the management exactly at which time what employee was doing what - think of a same level of insight an Apache access log would give you. This was one of the few times I intentionally obstructed and eventually blocked this request. There were ways to measure performance anyway, I just refused the idea of live-monitoring.


"There's been a big rise in monitoring workers at home"

Which operating systems can the monitoring be installed on?

I understand the principle of wanting to ensure that if you pay someone to do 9-5, they actually do it, but in practice, "nicer" employers get more from their employees by not being complete muppets. There is of course always one or two employees that spoil it for the rest, but intrusive monitoring is only one obnoxious way of detecting under performers.

Also, this sort of monitoring just reminds me of horrible stuff like Blizzard's "Warden", and Sony's root kit (https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...).


Big legal issues for the video/audio monitoring. That's essentially wiretapping. Also other data privacy issue if your housemate also works from home in an industry like financial or healthcare and has to routinely discuss customer/patient information.


Incidentally: after working from home since the start of the pandemics, I feel the need to actually monitor myself as I often lose track of my working hours and I have a suspicion that I work longer hours than previously. Related to that, less amount of movement/exercise. My plan is to monitor the situation with simple Raspberry Pi zero based project - add a current sensor (to sense if my main display is on/off) and a distance sensor (to see if my standing desk is up/down), store the data in local time series database and present in local Grafana (no way I am going to put this outside my home network) with the possibility of alerting via PagerDuty.


“Monitoring” covers many things, some more concerning than others.

Activating the camera or mic without consent? Yeah, that’s bad.

What about recording which websites are visited on a work device? Not so unreasonable.

Taking screenshots of desktops at random intervals? Could be a huge liability if you capture some confidential information and the screenshots go into an unmanaged data dump.


> Taking screenshots of desktops at random intervals? Could be a huge liability if you capture some confidential information and the screenshots go into an unmanaged data dump.

I'd just have a fully naked picture of myself in the corner of my screen at all times :D


> Activating the camera or mic without consent?

Creepy

> What about recording which websites are visited on a work device?

Creepy

> Taking screenshots of desktops at random intervals?

Creepy

Don't hire people if you don't trust people. Monitor their output not their process


I agree in principle but there's context to this discussion. I've had people argue (to be clear, on work provided computers) that having EDR software phone home with "User downloaded free-movies-mp4.exe and it contained ransomware" is a massive privacy violation. There's got to be an acceptable limit.


Logging DNS traffic is valuable during a security investigation. Depending on your company’s acceptable use policy, no one cares that you are on Reddit.

Monitoring Remote Desktop sessions either by random interval screenshots or screen recording is valuable when you have vendors/contractors connecting to your net. IMO, this is unacceptable for normal employee workstations.

Turning on the mic or webcam is a major violation of privacy. If your doing something SO important/secret/critical that you need to monitor the person doing it you should not be working remotely to begin with.


I'm not using employer provided DNS servers either haha


Monitoring the camera and monitoring the mic without consent are different areas legally. Photo/video recording is permitted in many circumstances. Recording from the microphone falls under old Federal wiretapping laws. It's why you never see professional security cameras with microphones on them.


There was a recent decision, in the UK I believe, where an individual sued for worker comp for an injury that occurred during his walk to his desk. While the story was amusing, it actually worried me.

If businesses are liable for what occurs in my home, would they not push on controlling more of what is in my home?


It appears to be Germany: https://www.theguardian.com/world/2021/dec/09/fall-on-walk-f...

There are a couple of things worth noting here. Firstly, the accident was covered as the walk was deemed to constitute commuting. This suggests that events that happen outside of an employer's premise and in an environment they cannot control being covered is not particularly new or uncommon. Further, it was the employer’s insurance that refused to pay out - the employer did not directly suffer any loss (though presumably the insurance company could set requirements for the employer as a condition of the insurance contract).


Story time I suppose (from a former colleague).

Managers were looking at buying a monitoring tool for a dev team. Somehow dev lead was included in the meeting. Vendor comes in, does his pitch. Dev leads pulls the manager aside and tells him "we already have a monitoring tool installed called git".

Non-technical manager is intrigued so dev leads pulls out a GUI front-end for git and shows the commit history. "You can see who added what to the codebase and when"

"Neat. How much does it costs us?"

"Nothing. It comes with the tool! How much are they trying to charge us for this monitoring software?"

"They want to schedule a separate call for pricing..."

We all know git metrics are pointless, apparently management was satisfied to know that they were collecting metrics and could use them if they wanted to (and they never bothered with it).


My Solution: artists tape for covering the webcam and the Jiggler to randomize my mouse movement: https://github.com/bhaller/Jiggler


If they can install monitoring software on your client they can see what software you’re running, what its hash is, what special permissions it has and what api calls it’s making. If this is something you need to do I would recommend you accomplish it outside of the computer.


That's one of the reasons why, according to a friend of a friend, those in the know prefer hardware mouse jigglers to software mouse jigglers. It seems to have spawned a whole new industry, with devices like the Wee Shoogle: https://www.weeshoogle.com/ . Edit: It seems there's a wikipedia page about this too: https://en.wikipedia.org/wiki/Mouse_jiggler


This would be the perfect project for a simple Arduino board connected to USB pretending to be a mouse and/or keyboard. Add an on/off switch and you can step away any time you want.

The best choice would be to have it open Notepad and type "All work and no play makes Jack a dull boy" over and over again.


Devilish


The last 4 years I've been following TransparentBusiness as they lobby state legislatures to mandate the use of their tracking software on state employees. Only Louisiana has picked it up so far, but that was before covid. 2023 is going to be the the year when I predict a bunch of Republican led state legislatures start accepting the intrusion into their worker's privacy at the cost of tax payer money and trust.

https://transparentbusiness.com/news/louisiana.html


It must be incredibly anxiety-inducing to have a camera in your own home that someone else could be looking through. And I thought the horror stories about at-home test proctoring were bad.


IMHO experienced devs should leave places like this or demand change - others might not be able to move so easily and companies cannot afford working only with unexperienced staff.


I refuse to place monitoring software on any company device unless there is an open HR case corresponding to a specific issue. I'll die on that hill.


That would probably be the fastest way of making me quit.


I think what is described in the article would be illegal here in Norway. Quite possibly illegal in the office too, not just the home.


When you leave a job, voluntarily or not, it's amazing how long it takes for that job to leave your mental system. A year later I still find myself occasionally wondering whether a project went well or more recently after I left I'd still have the monthly work schedule in my mind. It requires discipline/distraction to free yourself!


Interesting. Things monitored and systematically captured can often be translated into ML models.

What do you think? Is this how white collar workers become more fully outsourced via automation, as an unintended side effect?


Big big no-go for me. The only metric you get from me is my performance and interaction with colleagues. Those are what matter to the company, anything else is an ego trip.


Look out for companies using Hubstaff or similar tools.


If you work for an employer that has rolled some monitoring service out, or is considering it, and you are in a place of power or privilege to influence that decision: do so. Resist the temptation. Just say no.

I've yet to hear a legitimate argument for monitoring employees against their will. If there's a security concern, patch it another way. There's always another way.


Closely monitoring former managers as they manufacture license plates seems perfectly reasonable to me. Though some might quibble over the "employee" part...


I’m a remote team manager and I’ve considered putting tracking software on low performers computers, and have not gone through with it yet. I’m super happy to put in the time to coach someone who is trying to make it work but if they’re putting in 2 hrs/day on a remote job and not making the cut it’s not worth my effort to try to coach them out of that.


You're thinking of this back to front. You're saying "I'd rather do the easy, invasive thing first; based on that, I'll decide whether I want to try and coach them".

No. Talk to them, say "Hey, it feels like you aren't performing as highly as I'd expect. Anything up?" and make it clear -you're paying attention to them-. You've now spent time you -should- already be spending (on a 1-on-1), and actually did something to try and solve the problem, rather than to try and make it "easy" to just let them go.

If their performance starts to improve now that you're engaging them, great, no privacy encroachment (and if they -were- only putting 2 hours in, and now are putting in more, even better! You avoided the pain of termination and replacement).

If their performance doesn't improve, also great; now you can let them go -knowing you did everything you could-.

Why the hell would you want a half-assed outcome that, at best, will still require the same effort from you, and at worst will save you no time (again, you should already be having regular 1-on-1s), and leave you wondering if there was more you could have done, and in either case cause a morale hit to your team who now knows you're willing to electronically track them?


(I will also hypothesize that the time the person is working is actually irrelevant to you. If you have a high performer, and you found out they managed that level of performance only working 2 hours, as tracked by whatever software, would you fire them? If not, quit creating bullshit metrics - address the one you actually care about, the person's performance).


If they’re putting in 2 hrs/day on a remote job and not making the cut it’s not worth my effort to try to coach them out of that.

Right, but it's your job to treat them like adults, not babies.

And the first rule of dealing with adults is: how they spend their time is up to them. Granted, if they were working onsite ... you could at least require that they be on site during certain times. And then there would be the implicit surveillance that comes from just being the same room with other people and all that. But sorry, the situation has changed and that luxury is no longer available to you.

Accordingly, your recourse should be: tell them what deliverables you expect, and by when. If they don't meet these goals -- sure you can offer coaching -- but it's not up to you to "diagnose" them (never mind whether this involves invasive techniques or not). Just tell them what you want, and leave it up to them to manage their own time and resources to deliver.

If you can't that -- that is, articulate your expectations, offer support and treat them like adults -- then as a manger, you're the one not "making the cut".


Why do you need the tracking software to tell you what you already know? Have you considered talking to them and asking them?

If you're looking to catch people in a lie, there are easier ways than installing spyware.


This will have two effects:

1. The low performer will stay a low performer.

2. Other people will leave, including high performers.

You will gain nothing, but lose something.


Then just find someone better? I kinda doubt monitoring low performers will suddenly turn them into high performers


And it’ll encourage the high performers to look elsewhere as soon as they learn their boss is doing creepy stuff like installing spyware on their machines.

I think a lot of these “solutions” are rooted in the fact that managers—like the spyware-considering person above—are genuinely not good at interacting with other people. This person already knows who’s not getting work done, but for some reason isn’t comfortable having a direct conversation about it. “You’re not meeting your goals, and you don’t seem to be improving, so I think you should find another job” is a more mature, professional way of addressing the problem than surreptitiously collecting statistics on how much time your employees spend in the toilet.

Keeping in mind who I’m talking to here, I think a far better approach would be to step away from the tools and data-mining for a moment and deal with people like people, not machines.


Do you put creep software on your own computer for not doing your job? Have a 1:1 lmao


Have them pair with people instead. It will become quickly apparent during pairing if they’re not pulling their weight, and what the problems may be.


This sounds so much more difficult and costly than have qualified managers.


There's a big rise in, well, everyone asking everyone to do stuff.

People keep asking me to stand inside little circles, put things on my face, walk in specific directions, etc.

The more you acquiesce to silly stuff, the more it happens.


Are you equating following safety measures with docility?


Seen this a lot on the internet lately. Usually followed by some crazy extrapolation along the lines of allow the small restrictions and before you know it bam fascism


I'm equating standing on little circles and walking in proscribed ways with docility, yes. They are not safety measures, they're some bizarre form of religious ritual / cargo cult like behaviour.

Motorcycle riders don't wear little pin badges for good luck, tape toilet rolls to their knees, or simply look at and polish the bike, they wear real protective gear, practice evasive maneuvers, look for escape routes, etc.

It's not at all "safe" to run around like a headless chicken panicking for years on end; it's a mental disorder. Intelligent people owe it to themselves and others to protect them from maladaptive thinking and help them to develop mechanisms for operating normally in society.


This would be the point where I quit and find another job.


I'm with you. But, that's easy for me (and maybe you) to say, since I'm a SWE and can get a remote job without any BS monitoring reasonably easily.

Note that while 80% of workers are against such monitoring, nearly half of workers 18-34 are being monitored. This suggests that perhaps just "quit[ting] and find[ing] another job" may not be so easy for these people.


If you work remotely, there's a 100% chance you're already being monitored without your consent. It doesn't matter if you work for FAANG, a startup, or a government.

And, no, you won't be able to find an alternative employer that offers remote work and doesn't monitor you.

An employer can also deny that they're monitoring you, and there's nothing you can do about it.


This is not true. We don't monitor any of our employees directly, across the world. We have audit logs for activity to internal services, of course, but that's different than monitoring workers.

If you need to keep a log of what applications a user is running and when, or what websites they're visiting, then you have security issues elsewhere. If you solve those issues, then it makes no difference what the worker is doing.

And if they're not doing work when they should, it's not exactly rocket science to figure that out. We've been doing that for hundreds if not thousands of years.


Maybe you can elaborate? 100%? I’ve worked remotely for 3 companies over the past decade as an SWE. I’ve got admin access to my workstation, hardware usually comes from the office or new in a box shipped to the door, nothing out of the ordinary.

I don’t think monitoring is even remotely the norm, but I can see how it could be. I recall MS Teams has some kind of “productivity” monitor that could definitely be abused and eventually normalized.

The companies I’ve worked remote for can generally tell if you’re slacking off by whether or not you get shit done. No need (or time) for monitoring nonsense.


I expect my boss to be monitoring me. I expect him to have reports of what I'm doing, what I'm working on, and who I'm talking to.

All of those can be collected by talking to me, and few can be automated from the chat and email programs I use for company activities. The tooling they're talking about in this article is a whole other level - surreptitious screenshots and logs of which programs are open. Camera shots without warning.

My boss should know what my work-product is like and what my coworkers and customers think of my performance. They should expect me to be presentable with a moments notice while I'm on the clock, but I can do that while I'm sitting on my couch in my underwear.

Quite frankly, the ability to remotely trigger a camera without warning is a nightmare - for the employers. It's a sexual harassment lawsuit waiting to happen. Someone will time their shots (or simply take one a second and more when they see something salacious), and it will leak. There's no business need for these tools and we should make clear in our reactions no jury would question large judgements in harassment suits for use of this software.


What if you own the equipment you work remotely on and have not installed anything (inbuilt OS VPN doesn't count)?


I can confirm 100% that I am being monitored, without having any remote monitoring tools installed. I periodically send my boss status reports on items that are still outstanding. If there is something blocking me I will mention that too. If there are more tasks then I can fit in a given time frame, I send that along along with what I see the priorities as well as results of me negotiating priorities with various stake holders. And there are various team meetings where questions are ask and relevant answers are delivered. And when it comes to annual review time and raises, I fill out a self evaluation (to point out various high impact accomplishments and how I measured up to the annual goals), and my manager either agrees, disagrees, or adds to this list to justify a given pay raise and/or promotion.

Is this what you meant by monitoring?


On the glass half full side:

As the police have found, being monitored can actually help in the event of false accusations of misconduct.

Furthermore, if you are monitored and nobody has a problem with your performance, now you have evidence (even if you don't have it, it's discoverable) should they try to change the rules or the enforcement of them.

I really can't count the number of times my manager thinks something is wrong and I have to patiently dig up emails to prove it's not. Furthermore, as long as people don't really hate you for some reason, every time you successfully defend yourself against a false accusation should be some banked goodwill.

I've heard stories about how in olden days subordinates would have to take notes longhand to protect themselves from the bosses rewriting history. Sounds like a lot of work.


Do you recommend software for the purpose of self-monitoring for this purpose? It doesn't phone home to employer but rather to your own personal surveillance record?


That doesn't sound worthwhile to me, because of the official records which would carry more weight anyway.

People used to take notes to prove their boss wrong when he said "I never said that!" because they weren't under surveillance.


Take your example of the ineffectiveness of the note taking defense in support of a dispute. What would it take to overcome that and still retain control of the recording hosting/mechanism? What features would be necessary so that self-recorded records rise to equal authority with corporate records? Will they ever? What about recorded through a 'notary' service offered by a tech giant that you already resign any sense of privacy with?

A hopeful example of the value of self-recording: Car dashcams are relevant for insurance claims. Or are they?


Very much not true.

I'm a manager at an F50 company and we have no monitoring tools out side of normal security scans of outgoing e-mail content and such. I couldn't even get stats on employees hours at their laptops if I wanted to.

I watch what is produced, if it is good and constant there isn't a problem.

Yes, there are many options for companies to do this but for most it is not worth the investment in time/money/maintenance to let you catch a low performer potentially a bit earlier than just using their output as your yardstick.


There’s different levels of monitoring. Having a webcam so your every movement can be seen is drastically different than monitoring whether you have moved your mouse, or are online (ie your Slack status) The first would be a non-starter for me and I would quit if that was done. The latter, I would probably be OK with.


you would really be okay with your employer monitoring mouse movement, and using that as a metric to determine if you are working or not?


"And it is all because of that mouse. You see, Steinbrenner is like the first guy in, at the crack of dawn. He sees my mouse moving, he figures I'm the first guy in. Then, the last person to leave is Wilhelm. He sees my mouse moving, he figures I'm burning the midnight oil. Between the two of them, they think I'm working an 18 hour day!"[0] - George Costanza

[0]https://www.amazon.com/CRU-30200-0100-0011-WiebeTech-Mouse-J...


This seems to be part of Microsoft Teams.


Really? And people here are okay with this?


I mean, I'm not aware of centralized tools built in to Teams that are used to systematically evaluate people, and if they exist, I wouldn't necessarily expect they are being exploited by my organization.

What I was referring to was simply that there is a little color coded status symbol by a person's chat icon, which is green if they are active, and turns yellow if they are not doing much.

However, if you have a meeting or appointment on your calendar, or you are presenting/videoconferencing it goes to red, so you really don't have to be green or yellow any more than you want to.


>I'm not aware of centralized tools built in to Teams that are used to systematically evaluate people,

Oh boy are you wrong.


I'm not wrong about my own awareness.

I think I recall threads on HN about such things existing.

But I'm not aware of how to use them or that my organization is using them.

It wouldn't shock me if they were, but my prior is no more than 50%.

I observe that people around me usually don't use 99.9% or more of Microsoft software features.


Technically you are correct about your awareness. My apologies.

But in context, MS Teams has extensive dashboard analytics, some of it promoted under the guise of "employee wellness" but mostly used for command and control and monitoring, and there are several addons that add even more extensive tracking and analytics, e.g. ActivTrak.


I think that’s used to determine your online status rather than a centrally tracked metric. But it’s fair to say that your status is watched by some managers with nothing better to do.


reading this comment made my IQ drop. If you do not disclose that information you can get in a lot of shit.


What none of these three points are true.


Could you be less cryptic, please?


[flagged]


Please don't post unsubstantive comments or fulminate, regardless of wrong something is or you feel it is. Maybe you don't owe nosy employers better, but you owe this community better if you're participating in it.

https://news.ycombinator.com/newsguidelines.html


You're right, and I apologize. I just got really pissed off at this and didn't think before I hit the button, so I'm going to own my mistake here and fully admit that's on me. I'm sorry about that, folks.

If there was a delete button on my comment here I'd hit it, but I don't see one. Feel free to delete this entire "thread" (my comment itself and these replies) if you like, I don't mind at all.


Appreciated! We don't need to delete anything. The important thing is just to course-correct for the future. We're all learning here.


Oh Noes! A curse word!

Solution: Monitor every single comment with a curse word!

Wow, Dang, you must be a busy zir

Here-- I found another use of the "f" word here: https://news.ycombinator.com/item?id=29588054

Time to go rebuke them! Yayyy, dang has a life purpose everyone! come look!!

pats dang on the back you're doing such important work bud!


You know we don't give a fuck about swearing right?

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: