Ask HN: What is the most unethical thing you've done as a programmer?

https://news.ycombinator.com/item?id=17692005

432 492 8 years ago

news.ycombinator.com

There was an article a while back about how cell service providers were selling extremely granular location data, and some of the programmers working on those systems immediately showed up on HN to comment on their moral dilemma. I suspect it's not an isolated case.

WillPostForFood• 8 years ago

Did a project using Cold Fusion.

bswitzer8• 8 years ago

I have been working in Cold Fusion for the past year and I feel the same way.

crunchlibrarian2• 8 years ago

Used some of the more advanced features in git to delete commit history and cover up bunch of illegal activity shortly before an acquisition.

I used to feel really bad about this, but apparently there are whole teams dedicated to this sort of "cleanup" in M&A nowadays. Now I just feel bad about everything!

gnuvince• 8 years ago

Without going into specifics, can you outline the kind of illegal activities that might appear in a git commit history? I'm guessing copyright infringements mostly?

crunchlibrarian2• 8 years ago

Basically lots of tracking of users and reselling that data in extremely detailed ways. Whatever the marketing team demands or you're fired, that kind of environment.

dav3• 8 years ago

I did some contract work for an online “payday loan” company for a bit. It didn’t take me long to realize I was ashamed of working with such a terrible industry, but my professionalism kept me there until I finished the job. Definitely a low point.

RaceWon• 8 years ago

Having spent most of my spare time for the past 8 months on a FinTech idea (which I now question the cost of launching) I spent the day yesterday looking into PayDay loans as one of the URL's I got for said biz is pretty damn catchy for a PDL endeavor. Case in point--GoDaddy has all kinds of loan ads on the parked page.

I agree with you though, that's a sleazy way to make money, IMO.

albertgoeswoof2• 8 years ago

Payday loans are bad but they are not that unethical. The alternative option for people reliant on payday loans are actual loan sharks, which will turn out a lot worse for the debtor. So don’t be so hard on yourself.

I think it would be difficult, but possible to run an ethical payday loan company that focuses on building people up and out of long term debt.

diminoten4• 8 years ago

I love the Freakanomics podcast that gives both sides to the Payday Loan industry: http://freakonomics.com/podcast/payday-loans/

northwest652• 8 years ago

Definitely a low point.

I totally understand. It just made me feel dirty. I quit as soon as I was able.

iamdave3• 8 years ago

I once got pulled into an arbitration hearing to explain how certain code functions operated. While not necessarily unethical it was a moral moment because I knew the inquiry came with the loaded intent to twist whatever explanation I gave into the worst possible extreme.

Sure enough that's exactly what happened and a really hard working and honest developer lost their job so an executive could save face.

Left that company a month later but I still feel horrible

charmides• 8 years ago

Without giving away more details than you feel comfortable with, could you share more about what the developer was fired for and how it made that executive safe face?

iamdave3• 8 years ago

It was a feature set that was supposed to provide additional reporting views and expose data to customers when queried. Turns out one exec had some very embarrassing transactions that emerged from this and he wanted that info suppressed and the person who leaked it fired.

The feature worked as designed, and this exec was the one who pushed for it to go to market despite all warnings that a review of the depth of exposed data was needed first. Nothing was ever leaked, as I mentioned it worked exactly as we were instructed to build by the product managers and our engineering lead.

The outcome is the outcome scoped for.

Fwiw many engineers left after that moment. We were already at odds with leadership and when they showed their colors in that incident it resulted in nearly the entire engineering department bailing.

This never made it publicly, it was an internal product demo to the whole company leading up to launch. To my knowledge no customers or media outlet caught wind of the transactions or the internal coup that resulted.

throwaway0255• 8 years ago

I was once assigned a task that had been estimated at 8 hours of development time, but only required the modification of a single line of code.

I finished it in 5 minutes. My boss asked what happened, I told him, and he told me to revert the code, work on other tasks, and redo it at the end of the day so he could bill for 8 hours (in addition to billing for the other tasks I worked on).

I did it and didn’t say anything. This was just a few weeks into my career.

I’m surprised this kind of thing doesn’t happen more often, to be honest. The people handling the business and writing the checks never seem to know anything about software. You could probably get away with telling them just about anything.

I’ve only ever seen it happen once, though. Software industry has been pretty honest in my experience (at least as far as billing goes...)

danso• 8 years ago

Guess I haven't had enough coffee -- I'm struggling to remember the joke in which the punchline is the professional telling the client something like "You're not paying me to do [one simple/small thing], but for the years of experience it takes to know that [it's that one simple thing]".

The problem with trying to charge for programming work is that so much non-trivial work can be summed up as a few keystrokes, or an addition of a single line, or even producing less code (by deletion/refactoring). That said, I don't understand why your boss thought this subterfuge was necessary. If the client is non-technical enough to approve 8 hours of billing for something that takes 5 minutes to fix, how is that client competent enough to look through the git history to know that it was only 5 minutes of work?

ColinWright• 8 years ago

Available in many, many places, but here's one:

https://www.buzzmaven.com/old-engineer-hammer-2/

jwilk• 8 years ago

https://www.snopes.com/fact-check/know-where-man/

analog31• 8 years ago

My art history textbook has a similar story about James McNeill Whisler, who when challenged on charging 200 guineas for a painting, responded, "I ask it for the knowledge of a lifetime."

Theodeus2• 8 years ago

I think this is extremely common in payed-by-the-hour scenarios, when the person doing the tasks aren't on-site.

I also think most people are aware that's the case, and are fine with it since they've got an estimate that they've approved. The estimate was good enough to justify the business value so they expect to pay the full hours.

Letting people know you need more time is probably a bigger issue.

icedchai6• 8 years ago

Your mistake was getting it done too quickly. I hope you learned to manage your time better for future endeavors.

mnm1• 8 years ago

For a salaried position, this wouldn't even be unethical. When I finish my work, I take off and have fun. Even for hourly contracting, it's dubious whether this is unethical. The only mistake is telling people it took five minutes. Ideally you'd spend the day having fun and check this in at the end. Not getting paid for actual work done is so common in contracting, however, that I certainly wouldn't feel bad about using up the whole time estimate for a five minute task.

xauronx2• 8 years ago

That’s how consulting usually works. You scope out stories and commit to the number of stories in a sprint. Even if you wanted to add more to the sprint you’d just mess up the allocated time of QA and add more stuff for the dev ops team. That’s why more than one person (and people who know the system) should be giving estimates.

Otherwise, if it takes half the time use the other half to test, or train yourself to be better at your job. IMO

ivank2• 8 years ago

not mine, but someone programmed The Drop https://www.youtube.com/watch?v=pCOCKS5AJI8

hjorthjort3• 8 years ago

Is this real? Can't find any sources on it.

ivank2• 8 years ago

I don't think that particular feature made it onto the record, but Garret's confession rings true because AT&T did have a lot of capacity problems for a few years after the iPhone launch, especially in New York and San Francisco. I can find a lot of articles from 2009 mentioning dropped calls.

sudhirj• 8 years ago

While working at a services / consulting company, I've been privy to cases where we put our own interests over the client's, essentially getting them to pay us to screw them over.

icedchai6• 8 years ago

You’re kidding. I can’t even imagine something like this happening in business.

atmosx3• 8 years ago

The Big Short - nice movie, check it out :-)

cirgue• 8 years ago

I have literally never seen a consulting engagement where this wasn’t the case. I’m sure they exist, I just personally haven’t witnessed it.

throwaway44345• 8 years ago

I’ve fired people on behalf of more senior managers too cowardly to do it themselves.

wordswordswords3• 8 years ago

Implemented ads to be served to customers who had specifically paid for an “ad-free experience.”

albertgoeswoof2• 8 years ago

How did that work?

wdr15• 8 years ago

Don't call them "ads." Call them "promotions."

wordswordswords3• 8 years ago

They were ads to upsell them on a higher level of subscription. The argument was that they were "promotions" from US, not advertisements, which were from a "third party."

Of course, this is nonsense. An in-house ad is still an ad. When someone pays for an "ad-free" experience, we know they don't expect that they will still receive a full-screen modal popup, even if it is a house ad.

thewarpaint• 8 years ago

Worked with PHP for four years.

lima• 8 years ago

The story mentioned: https://news.ycombinator.com/item?id=17081684

throwaway14b141• 8 years ago

Took liberties with our interpretation of a third party TOS so that we could utilize a product. I surfaced this to leadership when I realized we were not in compliance, but we kept the outcome of what we needed from it, although we did cease to use the tool. I chose less career friction over fighting further.

xauronx2• 8 years ago

Saving data from something like google places API?

jgalvez• 8 years ago

Nice try, FBI.

throwawayayayau• 8 years ago

Worked on an automated system to skim tips from crowdsourced 'contractors' without them realizing it was being done. Don't worry, legal says it wasn't technically against the law and the fine print of the contracts said we could do it.

mkoryak3• 8 years ago

In my first job out of college i worked at a big consulting company on a project at a company that used interwoven teamsite cms. Teamsite was a cms written in Perl, JavaScript, and Java with lots of xml sprinkled in. It was a horrible system.

I blogged about it on my personal blog. All the posts were about how to solve issues I had using it. This was before stack overflow.

After I had about 10 such posts I wrote a post titled "interwoven teamsite sucks" and linked all the other posts there.

I started noticing traffic to that post from specific ips accross the country.

A week later I was pulled into a meeting with the top see directors and told to remove my blog. Interwoven was an Accenture client.

I removed it.

hjorthjort3• 8 years ago

I like how you dropped the name of the "big consulting company" in the end, there.

mkoryak3• 8 years ago

Yeah that was a mistake on my part, but you can easily find it on my resume anyway.

cimmanom3• 8 years ago

Ever so slightly surprised you didn’t get fired immediately.

mkoryak3• 8 years ago

I had already given notice at this point, so maybe that is why they didn't fire me. They could still tell interwoven "this asswipe is no longer with us".

Djvacto• 8 years ago

What was your experience like in Consulting?

throwawaymath6• 8 years ago

I've done a lot of work involving scraping, data analysis and reversing private API access from mobile applications. A lot of this work is legally defensible (if you do it correctly) and not particularly unethical. After doing a bunch of this type of work I started to accrue subject matter expertise in the area that led other companies to come to me with more questionable projects in mind. I turned down many of these, but two projects stand out to me as unethical or borderline. In fact, this was the reason I eventually stopped working with these companies.

The first project was for a large, (now) well-known fintech company. They needed to develop login integrations with consumer banks to acquire customer account information for verification purposes. But many such banks didn't particularly want to grant them any special API access. More importantly, these banks typically forbid scraping and made it explicitly difficult by implementing JavaScript-based computational measures required on the client in order to successfully login. I helped this company develop methodologies for bypassing the anti-scraping measures on several banking websites. However, I stopped working on this because 1) I felt uncomfortable with the cavalier way they were ignoring banks' refusals, then using the reversed integrations and onboarded customers as a bargaining chip for more formal partnerships, and 2) performing huge amounts of analytics on customer data acquired as part of the account verification process.

The second project was for a tech startup working on insurance and credit analytics. This company is one of several that popped up in recent years to use machine learning and social data in order to develop a more "complete" credit score (in their eyes). They had an impressive team of machine learning researchers but their data acquisition team was comparatively mediocre. So I worked with them to improve their acquisition methodologies for a variety of social media websites. I stopped working with them for three reasons: 1) fundamentally, I lost faith that their product was actually generating a meaningful signal over traditional means, 2) I was worried that the data they were collecting might introduce spurious correlations or illegal biases, and 3) if any team was going to do this correctly, I didn't think this particular team was the qualified one to do it.

jscholes2• 8 years ago

A lot of this work is legally defensible (if you do it correctly)

Could you expand on the correctness aspect? I'm currently working in this space for what I believe to be good reasons (to improve the accessibility of a particular service for visually impaired users). But I'm eager not to abuse my position and knowledge.

sjtgraham• 8 years ago

Depends on jurisdiction OP operates in, but clean room reverse engineering is one technique, i.e. OP reverse engineers a piece of software, documents how it works at a high level, and hands off the documentation to legal counsel who reviews it for IP infringement etc. The doc is then handed off to a completely different team/engineer who implements the API contract documented by OP.

throwawaymath6• 8 years ago

To be clear, I'm talking about scraping. I think the sibling commenter is talking about developing competing products via reverse engineering ("clean room implementation"). I am also not a lawyer, so I can only tell you the guidance I received from one for the projects I worked on.

Technically speaking you can scrape data in a legally defensible way if you do not need to accept any terms of service explicitly prohibiting scraping in the course of grabbing the data. The distinction is that browsewrap T&C have plausible deniability, but clickwrap T&C do not. And if you receive a cease and desist order, you abide by it with a mea culpa. This also means you don't scrape so loudly as to be noticed, which has the happy side effect of probably not disrupting the target's service.

But again: The grey areas of ethics are a separate question from legality. Please engage a lawyer for your specific work.

diminoten4• 8 years ago

I don't necessarily agree that the first project was unethical, the banks were saying no because they wanted to develop a product of their own to compete with the company that hired you, not because they had any moral standing to prevent the customer from running analytics on their own data. The company you did the work for is immensely helpful to the consumer, and banks refusing to let consumers interact with their own data is, IMO, more of the moral violation than forcibly scraping that data out.

mindslight2• 8 years ago

Even worse, the banks preventing users from straightforwardly accessing their own data is exactly what is pushing users right into the arms of these "fintech" surveillance companies.

The technology (OFX direct connect) and software (Quicken, now Moneydance) for users to privately track their finances has been around for quite some time. But the protocol appears to be getting deprecated in favor of this "web download" rigmarole as banks attempt to decommodify.

I had thought about futzing with Plaid for my own monitoring purposes, figuring since they were B2B they wouldn't be directly surveilling (leaving that up to customers instead). Apparently I was wrong. Surveillance capitalism, indeed!

qmalzp• 8 years ago

First project sounds like Coinbase.

bgnm2000• 8 years ago

I was thinking the first is Mint

ptenk• 8 years ago

Thank you for sharing. This is why I never sign up for any fintech services. The amount of data I hand over is never worth the "benefits" they provide.

throwawaymath6• 8 years ago

Most of those sorts of companies (both B2C and B2B) ultimately end up selling the user transaction data (or some derivative analytics thereof) to hedge funds. It's used (for example) to forecast the revenue of B2C companies in advance of equity earnings announcements.

NB: I don't have an issue with user data being mined for things like market research if it's a situation where the product is free and users can be easily made aware of it. But I find it dishonest if the company mining that data is doing so without direct user consent, or in a "backdoored" manner using their status as a downstream client's "affiliate" for T&C purposes.

ryanackley• 8 years ago

I'm guessing the first company is Plaid. I'm in the ACH payments space so we're a potential customer of Plaid and I vaguely remember a presentation or something where they (Dwolla + Plaid) promise merchants the ability to grab 12 months worth of transaction history from a user's bank account. Could be wrong about that. I do know for sure I made a mental note to myself to never use Plaid as a consumer.

throwawaymath6• 8 years ago

Well, since you already guessed it: yes, it was Plaid.

asragab• 8 years ago

Throwing in a guess for the second company, was it Zest Finance?

I know this isn't the point of the thread, but I couldn't help myself. I will ask for forgiveness (as I am sure we have all done in both technical and ethical matters)

joewee2• 8 years ago

Sounds like you would be a valuable member of any company, especially a startup. I’d love to hear your thoughts on more ethical ideas for analyzing difficult to obtain data. Feel free to ping me directly.

brokenmachine5• 8 years ago

hear your thoughts on more ethical ideas for analyzing difficult to obtain data.

See, this data is not difficult to obtain if you're operating in an ethical manner.

You can't do ethical analysis of data obtained in an unethical fashion. Fruit of the poisoned tree and all that. I guess it worked for radiologists after nazi germany however...

driverdan• 8 years ago

What's wrong with allowing customers to fetch their own data from their bank? I hold the opposite point of view, that banks withholding information from their customers is unethical.

thom2• 8 years ago

As a gentle satire of a much-hated London-based design company we were working with during a project for a major brand, I added something called 'disco mode' to the customer's site if you crafted the correct query string. It progressively added more and more random jQuery effects to the page on a timer, while the customer's logo jumped to a beat.

hjorthjort3• 8 years ago

How did you get that past code review?

thom2• 8 years ago

It's cute that you think every company, even the kind that did brochureware sites for brands more than 10 years ago, does code review.

zuck9• 8 years ago

That's an Easter egg.

iammiles2• 8 years ago

Circumvented browser features to force autoplay on videos with high volume on our websites. While not a morally bankrupt thing to do especially compared to some of the other examples, we all felt dirty doing it.

j88439h84• 8 years ago

While not a morally bankrupt thing to do

Could you explain this position? (Honestly asking.)

diminoten4• 8 years ago

From my perspective, at least you could stop going to the website if they did stuff like this, and TBH anyone's free to do whatever they want on their website. A lot of these other stories are doing things without informing customers, or using customer data illegally, and stuff like that.

It's sure not great if you want people to come back to your site, but it's not morally bankrupt.

iammiles2• 8 years ago

Aside from the accessibility issues pointed out by another comment, this was mostly an annoyance upon our users that the higher-ups decided converted well. FWIW we did try to argue against it but profits dictate behavior in a large corporation. :-/

Either way, it doesn't exist any more and if you were ever bothered by it (I apologize), there are no over-arching effects that you have to worry about.

jscholes2• 8 years ago

From an accessibility point of view this can be more than an annoyance. If your video means I can't hear my screen reader, and I'm the sort of user not to plan for this inevitable sort of event, my computer is unusable until it finishes or until I recover sufficiently from being disoriented to remember the hotkeys to get out of there. So please never do this again. Thx.

somedangedname• 8 years ago

So what you're saying is that loud ads are grounds for an ADA suit? Color me interested.

linkmotif• 8 years ago

Your superiors thought this was a good thing? Funny how people do t realize that makes your product insta-toxic. Or am I naive?

rezashirazian• 8 years ago

You monster!

tedeh2• 8 years ago

Sites like that is why I have the Chrome plugin "Quick JavaScript Switcher" that instantly disables JavaScript and reloads the page. As soon as noise starts blasting when it's uncalled for, I just hit the panic button next to the address field!

GuB-42• 8 years ago

Did your company made any money off that? It sounds like a great way to make sure people don't stay there and to get downranked by Google.

scott-smith_us7• 8 years ago

As a frequent victim of this, perhaps you can satisfy my curiosity: What is the logic behind auto-starting videos at MAX VOLUME?

That just sends me stampeding for the [X] on the tab button all the faster.

paultopia• 8 years ago

What's it like to work for CNN? Did you ever get to meet Wolf Blitzer?

gworley32• 8 years ago

Let ye who hasn't exploited a web browser for commercial gain cast the first stone.

pippolong• 8 years ago

Amazing there’s nothing here about crypto.

CPLX• 8 years ago

Probably because the people in question are still drinking the Kool Aid.

dabockster6• 8 years ago

Sounds about right. I've only met a handful of devs in crypto. They were all in college or recently graduated individuals. I don't know if they were getting paid in cash or tokens, but it was hinted at that they were being paid, at least in part, under the table.

Most of the crypto workers I've met in the last six months have been mostly freshly minted MBAs or marketing people with tons of money to burn.

octotoad• 8 years ago

There's nothing wrong with developing cryptography software.

emilfihlman2• 8 years ago

More about intentionally breaking it.

CM30• 8 years ago

Most unethical?

Probably pre checking one of those cookie policy checkboxes or what not. Wasn't too happy about that, especially when the software used removed the feature before for exactly the reason you may expect.

I also previously used a mod to read personal messages on a forum once, though that's one of those things which is heavily, heavily debated about on community management sites, with about half the audience saying its an unethical breach of privacy and the other half saying either that it's their site and property deal with it or that it's a good way to stop poaching and abusers.

But that one wasn't exactly coded by myself, so eh, it's an edge case for this question.

So probably a tie between those two, depending on what you count by 'as a programmer'. Fortunately, everything else I've been asked to do in my career has been pretty normal/ethical.

machiavelli1024• 8 years ago

While I haven't done anything nefarious other than putting a few tracking/analytics frameworks into our product, I have heard a few stories from my colleagues...

E.g. at a contractor company, a client wanted to lease 5 developers for a project. We didn't have enough free developers, so they assigned a single guy to the project, who was making commits from 5 different accounts. The client was paying for 5 devs of course.

There was also a client who was building slot machines, and we wrote the software for it. We ran experiments to figure out the best way to rip off gambling addicts.

The first company I worked for took EU innovation grants and when the deadline came, they simply copied their existing product, replaced the logo and showcased it as something they used the grant for.

3pt141594• 8 years ago

I suspect you're not going to get many personal stories here because it would be self-incriminating. But I have a couple from some people I know in tech.

1. I know the guy who, pre-Snowden, actually designed many of the pieces of network gear needed for the dragnet. His perspective was basically: Yes it's wrong, but what do I know? I just design electronic circuits.

2. Same guy also mentioned how at another company he worked at they used DNS tricks to exfiltrate data out of their enterprise clients. Nothing crazy, mostly just analytics to aid in things like product design. They got caught though. First Intel went out, then a couple hours later 4 other big tech companies (including Apple and Microsoft). Then a huge swath of devices stopped reporting. They got acquired shortly afterwards for a large, but sub-billion dollar amount.

3. I know a couple people that crack into devices and sell the 0days to the highest bidder. I consider this practice for anything cyber-physical (self-driving cars, etc) to be so unreasonably unethical that it should be against international law. It's one thing to sell these things to an allied government, it's quite another to have them on the open market.

nharada• 8 years ago

Yes it's wrong, but what do I know? I just design electronic circuits.

This outlook, along with "well if I don't do it someone else will anyway", is why tech workers are quickly becoming the new bankers in the view of the public.

amelius• 8 years ago

Yeah, some hackers wear white hats, others wear black hats, and then there are those who wear paper bags over their heads.

TeMPOraL9• 8 years ago

This outlook, along with "well if I don't do it someone else will anyway", is why tech workers are quickly becoming the new bankers in the view of the public.

Which really annoys me, because while moral indifference of some tech workers is wrong, there are still the business guys actually giving the immoral orders. Those are conveniently forgotten in the new narrative.

atmosx3• 8 years ago

I am not sure I understand the distinction you make between a government and the higher bidder? How can you be reasonably sure that your findings will not be used wrongfully by X gov official?

user59944617• 8 years ago

The highest bidder is likely to be a government agency.

3pt141594• 8 years ago

You can't, but if the NSA or CIA wanted to kill a bunch of people they could. Whereas ISIS and company can't. Not knowing who is buying your 0day is dangerous to public safety.

throwawaymath6• 8 years ago

Was the second company Meraki?

EDIT: I don't expect to receive an answer to this (and that's fine), but I'll give more color to my guess. Meraki had a side venture in internet connectivity-enabled location analytics which was more profitable than its actual router sales. This is one of the reasons why its acquisition price was so high. It has since contributed to a location analytics service within Cisco.

3pt141594• 8 years ago

No, sorry.

avs7333• 8 years ago

1. I know the guy who, pre-Snowden, actually designed many of the pieces of network gear needed for the dragnet. His perspective was basically: Yes it's wrong, but what do I know? I just design electronic circuits.

In case anyone wonders, this is why so many engineering schools are increasing their focus on teaching ethics.

avs7333• 8 years ago

It's one thing to sell these things to an allied government, it's quite another to have them on the open market.

Honest question...why?

The result/intent seems the same whether done by a state or nonstate actor. In fact a state actor seems more likely to use it because of a greater feeling of moral justification.

3pt141594• 8 years ago

Because terrorists target civilians on purpose.

hkai3• 8 years ago

Nice job, we know it's you.

orarbel1• 8 years ago

You forgot to add “confiding for a friend”

TrolTure• 8 years ago

Take people's content and put ads on it. TOS compliant but shady.

wand3r• 8 years ago

Do you work at Google?

throwaway9258jj• 8 years ago

I worked for a major gambling tech company. There was almost no oversight and I pretended to work when I really didn't.

siliconc0w• 8 years ago

Moral questions come up surprisingly often in product development. Especially for smaller companies looking to grow fast or things like how aggressive to get with opt-ins and other 'dark patterns'.

Online lending, for example, is a pretty tricky area. You have to subscribe to a pretty hardcore version of a capitalist moral philosophy to justify the %xxx percent interest those places charge. Especially as the 'ideal' customer isn't the one who pays you back, it's the desperate population who continually re-up their ridiculously expensive loans.

RomanPushkin• 8 years ago

On one of my previous jobs they asked to implement WebRTC session recording without recording indicator. I didn't do that.

Theodeus2• 8 years ago

I built campaign sites for the automotive industry. Always felt wrong. Was asked to pitch for a client in the petroleum industry and declined. That felt great.

bigfudge• 8 years ago

I remember working for a heart/health charity at the same time as a large fast food company. That felt weird.

throwacake• 8 years ago

I present security research in big conferences. This means that I find a serious security threat that affects many systems, and then I do not say anything to anyone for 6 months so that, when I do, I can get more publicity.

jessaustin3• 8 years ago

Don't you typically inform the system's owner as soon as you discover the vuln? You still get "credit" in that case, don't you? Somehow I suspect you're not really a security researcher...

dabockster6• 8 years ago

In a lot of non-tech business, they would probably not award credit. Some would even sue you for even implying that their "perfect" brand could be vulnerable.

INeedToGetOut• 8 years ago

I live in a dictatorial country with 90%+ of the tech, industrial, and service sector owned directly by the president's family. So I kinda feel like whatever work I take on in this country is evil in one way or another.

I haven't had to hack independent media agencies and opposition parties yet and I plan to keep it that way.

nyolfen2• 8 years ago

can you give us the continent at least? ;)

i have a couple of guesses.

jdowner• 8 years ago

I once mixed tabs and spaces.

gitgud• 8 years ago

Unbelievable, how do you sleep at night?

eof• 8 years ago

Very short backstory: I was very severely punished for breaking security on our pcs at school (utilizing interactive startup on windows 95 to not start the "fortress" process.)

For a final project presented which was ostensibly a limited auto-translation application, I made an application which just popped up an alert, "program unable to run due to security"

Got an A!

aidos2• 8 years ago

Upvoted you because me and a friend did exactly the same thing. The IT guy was really pissed about it, but we didn’t think it was such a big deal. Nothing came of it in the end but I think we were banned from the computer lab. Pretty backwards priorities on behalf of the teacher in retrospect.

stordoff• 8 years ago

I was very severely punished for breaking security on our pcs at school

I wonder how common this is. I've seen it happen at my school - when you have a VNC server on every machine with a 3-character password (three guesses what that is...), the local admin password on every machine is school, and the domain admin password is a single dictionary word, bad things are going to happen.

ryan-allen3• 8 years ago

Our school spent loads of money security their network with some Novel boot thingo. I bashed in some DOS interrupt keystrokes and was able to bypass it completely.

The whole class was playing networked DOOM about 10 minutes later.

I thought I was going to get suspended or expelled, but instead the teacher in charge of IT came to me and said "I know you did it, if you show me how you did it you wont get in trouble."

The look of disappointment on his face when he saw how easy it was... I'll never forget it. I wonder how much the school paid for that 'security' :)

beaker523• 8 years ago

I worked on a penny-bidding site. These guys "auctioned" items like PlayStation, tvs, cars to the user who placed the final bid on an item after 60 seconds of no further bids. Each bid would increase the final price by 1 pence/cent, but each bid would cost 50 pence/cents. You could "win" a $20,000 car for $500.37 and the house would have taken 50,037*50 cents. It might be okay if that was it -- but I was asked to code some "house bidders" who would outbid players until a certain threshold was met. I left that job shortly afterwards.

AndrewKemendo• 8 years ago

Is that even legal?

thisone• 8 years ago

Penny bidding, yes. Shill bidding, no.

digianarchist• 8 years ago

I worked on a system like that but it was run by a charity so whilst unethical at least somebody wasn't profiting from it.

njarboe• 8 years ago

I wonder what the percent of that unethical charity's income was spent on its stated mission? Many charities are just fronts for marketing companies with super high salaries and almost none of the money goes to what the donors would expect.

lunulata2• 8 years ago

Ditto, in my case the site was like this, wasn't itself a non-profit organization, but said proceeds from it would go to the specified NPOs... but that never actually happened as far as I know.

pc8613• 8 years ago

If it's unethical, it's unethical. Does it really matter if a company is profiting off of it or not?

icedchai6• 8 years ago

You missed out. You could’ve rigged it so you could easily win yourself.

dvtv752• 8 years ago

I'd fully expect the business to fire him for unethical or immoral behavior...

beagle3• 8 years ago

I think it's more often referred to as a Dollar auction[0] - an example where a series of rational decisions leads to irrational behaviour.

[0] https://en.wikipedia.org/wiki/Dollar_auction

beaker523• 8 years ago

It has many names.

https://en.m.wikipedia.org/wiki/Bidding_fee_auction

dmurray• 8 years ago

The dollar auction is usually run as an experiment in game theory classes and works a little differently from the penny auction sites. In the latter, all of your bids at any point are a sunk cost.

ender893• 8 years ago

I saw an ad for something like that a while ago, but realized that you couldn't sell an ipad for $0.56 if you weren't getting the full retail plus a margin from somewhere. Thankfully I never got into it.

fastbeef• 8 years ago

How was this not regulated?

scott-smith_us7• 8 years ago

Sounds like Beezid. Worse than payday lenders IMO.

Twirrim• 8 years ago

A few years back I was house hunting with my wife. We found a lovely house that was a short sale, and put in a bid.

Holy crap, that process was all kinds of frustrating and drawn out.

About 3 months after we placed the offer, the bank put the house up for auction on another site, to try and drum up more offered. On the auction day, I checked in routinely no one was bidding. All was looking great. About three hours before closing, a bid came in that was lower than our offer. OK, still good. Then another about an hour later. Still good. Then the "final hour" of the auction happened and it slowly but surely started ticking upwards, bids started trickling in and the price started climbing higher and higher. About 20 minutes before the end it got past our offer and my heart sank. As the end time drew near it started getting bumped out by further offers.

I told my wife we'd been outbid, after a stressful day, following on from months of stress and frustration.

Next day, our realtor reaches out to the selling realtor who reported that the bank told her no one else had actually bid on the house.

Yay.

pc8613• 8 years ago

Good on you guys for not increasing your bid!

hirundo4• 8 years ago

I wrote telemarketing software. Not sure if I'll go into the same circle of hell as telemarketers, or something worse. But it is an incentive to live as long as possible before going to my reward.

tedeh2• 8 years ago

Ha, I write telemarketing support systems for a living and feel your pain. It might not be sexy work but sure helps to grease the wheels of commerce and put food on the table.

hirundo4• 8 years ago

Repent therefore, and turn back, that your sins may be blotted out.

Rjevski12• 8 years ago

Telemarketing does not help grease the wheels of commerce. It helps grease the wheels of scamming.

Commerce is when people buy stuff they do need and that provides value to them. Telemarketing is conning people by pushing them to buy shit they never needed and that won’t provide any value to them. It is not commerce, it is scamming.

I’m not criticizing you for doing the necessary things to put food on the table, but please don’t justify it by saying it helps commerce.

diamondo25• 8 years ago

Our crappy ActiveX object was made for the windows xp era. When it started to glitch, my boss told me to 'just disable UAC' on our customers pcs (instead of fixing the issues). Did not do it and instead told him what to fix and fix some things myself...

Another one is installing basically trackware on the website, from an external party, that recorded certain input fields so it could mail you later when you didnt buy the product...

VLM• 8 years ago

Interesting the comments are all "The companies business model sucked" and nothing from

https://en.wikipedia.org/wiki/Programming_ethics

Also WRT ageism and changing ethics over time, "we don't have automated testing infrastructure" was BAU in the 80s/90s yet today would be an ethical WTF moment.

Something that probably still happens today is the old "address ... economic .. issues related to work projects" Pointing out this thing is never going to run a net profit just means I'll get downsized first; everyone who's numerate could run the numbers if they wanted to and they're all theoretically responsible adults at the meeting table, so ... If you mean address the fundamental economic issue, as in make sure my resume is updated while avoiding a meaningless fight with execs, sure...

Oh and edited to add, WRT taking responsibility, a couple of times I've optimized and improved processes to the point its a one line shell script wrapping a grep or echo and that's kinda queasy taking responsibility for "writing" that. Replace half the job responsibilities (and presumably employee slots) of a department with a one line sql query in a cronjob, that kind of thing.

jonnyrockit• 8 years ago

Hard to believe there's no mention of working on projects for the NSA.

pmiller2• 8 years ago

If you worked on something evil for the NSA, would you mention it? I’d like to think most HN posters aren’t that stupid.

ryan-allen3• 8 years ago

Not only that but they quite possibly could face jail time? Security clearances are pretty serious business!

quickthrower2• 8 years ago

Buge• 8 years ago

Do you want to live in Russia for the rest of your life?

akudha• 8 years ago

Not me personally, but the company I started my career with (was an intern there for a few months).

ERM software. When a new client comes onboard, install the product and database, but make sure not to make any optimizations, not even the basic indexes in the DB. Depending on the usage, the DB will get slower and slower in a few months. Then send a "consultant" who will simply run a script and add indexes etc and test a bit (no more than an afternoon worth of effort) and charge a high fee for it.

We had a project once for conversion (not getting into details). My team found a tool online. Boss bought it, finished the entire project in one day. Boss bills for month (which was the original estimate), puts the team to work on another project for the next 29 days, gets paid for that too. The only decent thing in this story is that we didn't know before the quote, that such a tool was available. Some would say this is smart way to do business, it felt shitty for me though.

nyolfen2• 8 years ago

i wouldn't sweat it, a lot of economic activity is just information arbitrage.

FLUX-YOU• 8 years ago

Sounds like a dream job or a nice side gig if you just want a job. Login, run script, log out, bill for thousands, then go back to doing your own thing.

Intentionally withholding stuff without offering an upfront option is shady though.

hkai3• 8 years ago

Where do you draw the line? My grandma was once contacted by a scammer who offered to "optimize" her laptop, and she ended up paying roughly the same as the price of a new laptop.

TeMPOraL9• 8 years ago

Yeah, that's in fact a good test for whether your work might be unethical - if you're relying on information arbitrage, you're screwing someone over.

Raed6673• 8 years ago

For the second part, I dont think about it as you sold a month of work. You just agreed with a customer that this task is worth X amount of money. If you managed to do it in one hour, that's just good business.

radicalbyte• 8 years ago

In this case you got lucky; other times you'll underestimate the amount of effort required. In the end it'll even out.

maxxxxx• 8 years ago

That would require that you eat up the cost if something takes more time. Most of the time the customer will pay for the additional time or at least part of it.

r00fus• 8 years ago

That's not ethical if it's a time&materials statement work agreement (because it's an estimate; if the actual work takes 10% over you bill that).

If it was a fixed-bid, then yeah it's completely fine. Though usually I'd say there should be a bit more time spent delivering some additional (canned) documentation and the like.

tonyedgecombe3• 8 years ago

I've had a couple of customers that double bill their own clients, I never stuck around long once I realised what they were doing.

Moru• 8 years ago

We had a 'missing indexes' consultant do a big job for us. The database quickly got really slow. Needlessly to say we do not hire them any more and do not recommend them to anyone else. The index problem I fixed in five minutes plus eight hours waiting time.

marktangotango• 8 years ago

Car mechanics do this all the time, so what if an experienced mechanic can do a task in 1/10 the time, they always charge for the book time.

0xfeba• 8 years ago

Mechanical work is straightforward though, and book time can be a bit liberal but is otherwise fair.

TeMPOraL9• 8 years ago

We have a mechanic now that constantly surprises us by billing us something like 2-5x times less than we expected. Turns out, he's good, and he bills us for actual time spent and parts cost. Like last time, I expected to pay ~$270, ended up paying $65 - $32.5 for parts, $32.5 for work time.

This guy only takes work from existing customers and people referred by them, because it's widely known in the local community that he's good, and has way more people wanting his services that he can handle. He could rise his prices, but it turns out, he's a decent human being.

Zelmor• 8 years ago

Are they by any chance working with AX Dynamics?

vidanay• 8 years ago

Didn't do it, but I was asked to "pre-package" the results of a piece of test equipment. Basically, we didn't have a clue what we were doing, and we were in way over our heads on the project. The customer was coming in to do the final approval and we were nowhere near complete. The boss told me to make sure the test results matched the specification "no matter what".

I quit instead.

lunulata2• 8 years ago

Implemented APIs for clients that were based on scraping data from other competitor sites that did not give permission, it's some kind of service hi-jacking. Similarly, implemented some clone sites that just rip off other people's work #zuckerberging Some bug bounties ask pentesters not to hit their production servers hard with automated tools... I've ignored this to find some bugs in production servers on occasion.

Rjevski12• 8 years ago

Scraping is not unethical IMO. If you make the data public then everyone has the right to use it for whatever reason.

Arbitrarily restricting what the data can be used for is what I would call unethical.

jessaustin3• 8 years ago

Scraping becomes unethical when it turns into a DOS, doesn't it? In some cases it wouldn't be an issue, but some scraping definitely makes the service less responsive.

Raed6673• 8 years ago

(I didn't go through with this, but considered) While I was a student I worked for a small shop that sold online services. I was something between an intern and a junior developer/security guy.

The boss (non technical) privately asked me one day to do some research about automating some data entry processes, basically reading from excel files, some databases, formatting and putting it all in another database.

I found out later that if that script is made it would lay off a number of people doing data-entry. I didn't go through with it for many reasons.

insickness• 8 years ago

There is nothing unethical about this. In fact I applaud your boss. If you can automate something instead of pay people to do it, you should do it.

Raed6673• 8 years ago

Some of the reasons that stopped me:

- He asked me privately during a lunch, without telling the people that do the actual work about it.

- I only knew that he intended to fire these people later when started putting the spec of the project.

- He asked me (someone very junior/intern) instead one of his more confirmed devs, which means he didn't want the company to know yet.

- I had a lot of sympathy and even kind of a friendship with those people.

- I wasn't paid enough for it.

AJ007• 8 years ago

Not only is it ethical, it is the reason we are on computers right now and not foraging for food.

Sophistifunk• 8 years ago

Agreed, it's pretty much what we (programmers) do. A cleverer boss will use his people to make more profit, instead of fire a bunch to reduce costs, but cest la vie.

blub• 8 years ago

All depends on what would happen to the laid off persons.

If this were a country with good social support and they would get some sort of severance, it would be fair.

If they would not be compensated for the caused harm, it would be unethical, since one's action would be a key contributor to that harm.

tonyedgecombe3• 8 years ago

I remember my first on site project at a paper mill in the north of England. I couldn't figure out why the people involved were so hostile. It was only later when I was talking to the salesman about it that I found out they were all going to loose their jobs once I'd finished.

dschep2• 8 years ago

Should've gone through with it but shared the result with the data-entry people instead of the boss!

jakobloekke• 8 years ago

Made a regular cms-based website as an SPA. Using Angular.

dabockster6• 8 years ago

If the actual content was simple enough, you could have just wrote it in straight HTML with some Apache magic and no one would have been the wiser.

efiecho• 8 years ago

Let me answer on behalf of programmers employed by Facebook.

The most unethical thing I have done as a programmer is going to work everyday.

m90• 8 years ago

One size fits all and everything.

seattle_spring• 8 years ago

Such a brave and edgy reply.

dang• 8 years ago

Please don't post unsubstantive comments to Hacker News.

dabockster6• 8 years ago

I still hear from a lot of the younger programmers there that feel like they're still working on revolutionary social tech. Aside from everything that has happened in recent years regarding Facebook, these people always cite the fact that Facebook has connected a lot of the world together in the social graph and that somehow outweighs all the negative consequences.

SamReidHughes• 8 years ago

I built my computer graphics final project in Haskell so that the TA wouldn't be able to run it and grade it. Then for our presentation, I babbled on and on about the math and went over time so we wouldn't have to give a really crappy demo.

huhtenberg3• 8 years ago

Reminds me of

    int main(int args, char ** argv)
    {
        static int foo[640*1024];
        return 0;
    }

This compiled into a valid MS-DOS .exe, but spit out "Out of memory" and exited when attempted to run. Was quite handy for getting an extra day to work on lab assignments back at school.

londons_explore• 8 years ago

I looked at that code wondering how on earth it could run out of memory. Surely 640*1024 couldn't OOM a machine, even an old one...

Then I re-read is as 640k and went "Oooh"

dopeboy• 8 years ago

You got an extra day for an out of memory exception? I wish I was that lucky

kimdotcom• 8 years ago

I think I work with you.

dirkt• 8 years ago

Wouldn't have worked back when I was TA ...

First, I'd have been able to run it (or grade it even without running it). And yes. I've seen a lot of crappy Haskell code. I've written a good amount of that myself when I was learning Haskell back then.

Second, assuming I didn't know Haskell, I'd have stopped your babbling in the presentation at some point and asked you to run it.

Third, any student that does unusual things is either very good or very cheeky, so those students deserve special attention. So 10 minutes at your and my convenience to run the demo in my office would always have been an option.

(But then, teaching at my university probably was quite different from teaching at your university).

wean_irdeh• 8 years ago

What does crappy Haskell code loook like?

pc8613• 8 years ago

I'm not sure how you think this comment makes you come off, but it's certainly not good.

wdr15• 8 years ago

Worked at Ticketmaster.

curiousgal• 8 years ago

I hate them so much I almost downvoted you.

wdr15• 8 years ago

Just as long as you pay me the $3 downvote fee.

tonyedgecombe3• 8 years ago

You monster.

dav3• 8 years ago

Well, you could put LiveNation on your resume to hide the fact ;)

wdr15• 8 years ago

Worked for them before the merger.

vumgl• 8 years ago

I worked at a company that was acquired by Ticketmaster, and I have a change to talk to one of the executives in casual way. They are not as bad as the may seem, but the business model is definitely intriguing. They go to a venue that hosts, say U2 for a concert. Say a U2 wants to sell a certain ticket for $100. Ticketmaster says: Look, If I get exclusive rights to sell your tickets, you will get not 95%, nor 100%, but you get 105% of the price of ticket, because I can charge whatever fees I want. So when you complain about Ticketmaster's high fees, hate then just slightly less, and hate U2 a bit more because they are ripping you off by pretending that Ticketmaster is the only bad guy.

wdr15• 8 years ago

Yep.

Ticketing is actually fairly complicated, both technically & as a business.

everdev3• 8 years ago

One of my employees was contracting out his entire job. His performance was great and then fell off a cliff. Turns out he stopped paying the contractor and the contractor stopped doing his work for him. When he had to do it himself it was horrible.

hirundo4• 8 years ago

I don't fault the guy for the arbitrage, just for not fulfilling the contract. It would be about equally unethical if he were doing the great work himself and got bored and wandered away.

dantheman• 8 years ago

I strongly disagree. Even if we ignore confidentiality and security issues, there is a fundamental difference between contractors and employees. Employees are generally paid less than contractors and are provided stability inn return the company gets a stable employee.

Contractors are expected to be shorter term and change tasking if new opportunities arise, even for a short time.

If both parties enter into a deal then it's fine, if one is misrepresenting themselves it's not.

scott-smith_us7• 8 years ago

I don't fault the guy for the arbitrage

Well, it's entrepreneurial, but he's almost certainly also violating all kinds of employment stipulations and policies he's formally agreed to (security, privacy, etc.)

GhostVII• 8 years ago

I think it is pretty unethical to give someone access to company data without the companies permission, and especially to allow that person to actually work on company products.

_throw_away• 8 years ago

Ran an illegal live streaming site for a few months. Had a lot of fun with it and used the experience to transition to a legitimate job in that space, but I probably cost some people some money, and for no other reason than "I could".

I also worked at a startup briefly that was run by a convicted con man. The business was legit but it was immediately clear he was using the same confidence techniques on everyone - clients, employees, etc. Not a good scene.

jedberg3• 8 years ago

I wrote the initial SEO optimizations for reddit.

dpatrick86• 8 years ago

So, to be clear, the real problem here is the "upvote this so that when people search..." meme that you inadvertently created. :)

jedberg3• 8 years ago

Apparently. Although in my defense that didn't happen till much later once reddit got a lot more popular.

slater• 8 years ago

And what were they?

jedberg3• 8 years ago

The main one was the code that put the title of the post in the link. That created a huge traffic boost.

Also added a sitemap and rel=canonical links.

cm2012• 8 years ago

How is this unethical?

northwest652• 8 years ago

I was subcontracted as development resource to a short terms loan company. They had me implement a piece of software that lets people enter their online banking details (yes their name and password, that thing that the bank says if you reveal to anybody you have no protections on your account), store them in a database, and then use those credentials to scrape their bank records so that their loans could be approved without the user having to send their bank statements in.

I wasn't comfortable working for a company that preys on the fiscally challenged, so I found another job and quit the contracting company I worked for.

devwastaken• 8 years ago

I've been on the receiving end of this once and the company refused to not use the automated system. The automated system didn't believe my savings account was a savings account since my bank had it under 'passport savings' or some such nonesense. Even through emailing they basically said if the system doesn't do it then there's nothing they can do about it. I think it's a big invasion of privacy for a system that doesn't even work well.

craftyguy2• 8 years ago

What you described sounds a lot like mint.com.

0x00000000• 8 years ago

Paypal does this. I don't know how it's legal or your bank doesn't care.

nickjj• 8 years ago

Back in the day I wrote some "AOHell style" apps for AOL and Yahoo chat.

Also trolled my non-programming friends who had computers by installing a personally developed backdoor that allowed me to open and close their cd-rom tray remotely. That was really fun.

TeMPOraL9• 8 years ago

In high school, almost all the IT work was done by the students who were trusted by the computer class teacher. That trust was often used to facilitate light-hearted mischief.

A colleague of mine developed and infected every student-accessible computer with a remote-access tool listening over a TCP socket. We'd mostly use it to open and close CD trays. Another colleague was unsatisfied by how the TCP approach made the CD trays go off one-by-one if you tried the batch mode, so he wrote another remote-access tool, this time masquerading as a Windows service, and listening over UDP. Then he'd use UDP broadcast to simultaneously open and close CD trays everywhere in school.

Fun times.

Oh, and one of the first things they did to me when I was getting to know them was installing and hiding simple PHP script in my WWW folder on my account on school server. The script would basically evaluate its input param in backticks. That is, a minimal remote shell accessible in my public folder. AFAIR it took me couple of months to track down why some weird things were happening to my account from time to time.

ndh23• 8 years ago

Was fed up with Quake Live not providing any matchmaking, so I tried to make my own. Of course they didn't have any API, so I needed to scrape their website to get the match results. I sent a lot of requests.

So when they blogged about their web site becoming occasionally very slow, I sheepishly emailed them, and asked if this might be due to my scripts. I assumed that of course they'd have some sort of IP based limiter in place in case I got to greedy. Well, they didn't. They requested that I send them my scripts, which I happily did. They also banned my account, which I thought was quite petty.

They might have unbanned me a couple weeks after that, but I quickly lost interest in Quake Live.

rajacombinator• 8 years ago

This is about as far from unethical as you can get...

ndh23• 8 years ago

Well, the title asked for "most unethical", so, yea. It was against the terms of service...

INTPenis• 8 years ago

Not really as a programmer but I've hacked an online cooking competition to win a kitchen aid. It was just extremely poorly setup.

ruskie• 8 years ago

When a deadline had passed sent blank tapes to clients and then claimed the postal services had wiped them when scanning with xrays, asking the clients to send back the tapes so we bought a few more days

chrisfinne• 8 years ago

"I guess we'll have to send them another blank tape" was a common trick in the 90's.

Paul_S• 8 years ago

This also happened more recently in the CD era with intentionally badly burned CDs.

dvtv752• 8 years ago

I worked for a business that sold videos burned to very cheap blank DVDs, for a pretty high price. We tested them onsite, and had about a 20% failure rate (they cheaped out on the equipment, too) and the passing discs wouldn't work for about a third of customers anyway. I think those discs delaminate after a few years.

Grangar• 8 years ago

Even in the internet era. In high school I often just renamed some random file to a .doc extension and sent that in. No teacher ever had any idea. I'd just play dumb that I had a bad computer.

pnloyd• 8 years ago

I wrote a tampermonkey script that automates this:

https://blog.bench.co/blog/how-to-hack-priceline

Rjevski12• 8 years ago

Doesn’t look unethical to me. The site is making money by intentionally withholding information and getting people to pay more than what they should.

It’s only fair that someone uses this trick against them and defeats their bullshit business model.

cdoxsey• 8 years ago

So my dad told me this story once,

He was working on a large, industrial construction project and they were nearing the end of it, so a QA engineer was scheduled to do a walk-through, and before that happened a higher-up purposefully damaged finished work, dented a pipe with wrench, unscrewed a bolt, etc... That way when the QA engineer did his checks, he'd find these obvious, easily fixable defects and mark them, whereas if he had found no problems, he would end up digging deeper, since he'll feel like he has to find something, and then he might potentially uncover some major, catastrophic problem that'd be impossible to fix and still hit the customer's deadline.

Theoretically everyone's happier at the end of it... QA because they did their job and found stuff wrong, the client cause the project was finished on time, and all that for an afternoon of extra work.

I worked for a company with an extensive QA process and on occasion I found myself being less then thorough before handing the code off. I knew there were bugs, but just left them in there, because they had bug quotas they had to meet, and we had a tight deadline, etc... At least that's what you tell yourself to justify the behavior.

Sometimes I wonder just how much of this kind of greasing-the-wheels goes on in other industries...

sitharus• 8 years ago

It happens all over the place. I haven't done it to QA but I've certainly done it to project managers, similar to this story: https://rachelbythebay.com/w/2013/06/05/duck/

scott-smith_us7• 8 years ago

I used to do this defensively when submitting 8-bit games for publication back in the 80s.

The non-gamers at the publishing company seemed to feel they had to get back to you with a handful of changes. If your game was really polished, the changes would be pointless or even harmful things. I quickly learned to leave in a few obvious things that were trivial fixes, e.g. blocky bitmaps, misspellings, jarring colors.

Instead of coming back with:

we really like the game, but couldn't the snake be an F-15 fighter, and couldn't the scrolling be vertical instead of horizontal?

...it would be more like:

Change that color, fix that icon, correct that spelling

makapuf• 8 years ago

See also the story of the duck and the queen on game battle chess https://en.m.wikipedia.org/wiki/Battle_Chess

shoo• 8 years ago

similarly, in the context of nightmarish optimisation death marches to fit inside a memory budget -- see "the programming anti-hero"

https://www.gamasutra.com/view/feature/4111/dirty_coding_tri...

neumann• 8 years ago

I did this in our University laboratory for OHS, we called it window shopping. By giving the inspector a few easily visible, but not dangerous issues out in the open, he was satisfied we were up to scratch safety wise but could also tick all his little boxes. An out of date MSDS for chemicals we no longer had, a not tested and tagged electrical cable used prominently, a drink bottle left next to the lab computer by a student.

Graham24• 8 years ago

I've done this, leave an obvious trivial bug for the QA to find otherwise they'll keep digging until they find something pointless and hard to fix, which is not a problem in the first place. they have to find something to justify their jobs.

I wonder if there's a name for doing this?

bklaasen• 8 years ago

That's a team-wide failure to understand business value.

cimmanom3• 8 years ago

This is much scarier for a construction project than the game programming anecdotes that follow.

unethical01• 8 years ago

Anonymous account for obvious reason.

We're a software contractor for: DHS, ICE, CBP and more. Took the job knowing that was some of our clientèle.

Was in a tough spot. That job was hiring. Didn't have other bites. Food and living expenses is nice to have (and so is not living in a car).

I also have a clean criminal record, and nothing exciting in my history.

brightball2• 8 years ago

When I was in college I finished a couple of programming projects late. My professor said if we could prove that it was done on time he wouldn’t penalize us so I found a program that would let me alter windows time stamps.

I’m sure he knew and accepted it anyway because he was a great teacher that seemed to enjoy letting us creatively solve problems more than sticking to specific curriculum. Was my favorite class in school.

I still feel a little guilty about that though.

rootsudo2• 8 years ago

That's so complicated. You could've just changed the system time or hex timestamps.

brightball2• 8 years ago

Honestly, I don't remember why I went that route. It was 1999 and we turned our programs in on 3.5" disks (aka - save icons).

alain_gilbert• 8 years ago

lol, I did the exact same thing.

The teacher's face was priceless as she discovered my work was on the school server since "3 days ago". (she was looking for it specifically every single day)

scott-smith_us7• 8 years ago

There was an ongoing prank in my high school (late 70's) to insert John Holmes' name whenever/wherever possible. For example, one trick was to ask someone in the front office to add to the end-of-day announcements "{popular girl}, John Holmes won't be able to give you a ride today". Eventually the front office caught on, and it got riskier and more difficult to do.

I was asked to write an Applesoft BASIC program to help the front office collate and remove duplicates from attendance lists taken first and second period. At some point, I added some obfuscated code that would add John's name in when the total number of names was over some threshold.

Believe me, I'm very very ashamed of myself...

hnzix2• 8 years ago

Did you get busted?

Timpy• 8 years ago

I didn't know who John Holmes was. Don't google it at work guys.

kulahan• 8 years ago

FYI for the morbidly curious, he's apparently an adult film actor.

throwaway-18• 8 years ago

Worked quite a while for an "Internet Cafe" SAAS company. If you're confused by the quotes, these internet cafe companies basically sell internet time to users and with each minute purchased, you also get an entry into a sweepstakes where the prize is a jackpot. The sweepstakes entries would be redeemed electronically by way of slot machines, video poker, etc. They're basically legalized gambling. I suppose that in and of itself isn't unethical, but we didn't exactly operate by by the book.

In order for this to be legal, the sweepstakes games have to have a defined number of entries as well as a defined number of winners and losers. None of our games did, it was just too prohibitive. We did provide to our customers, by law, our average payouts and our games did adhere to those through averages over time. But there were many occasions where the games didn't pay out jackpots regularly or paid them out too frequently, hurting stores that were using our software. Our recourse was to provide them more "entries" to distribute to sell to their players, which of course cost us nothing.

Business was good for quite a while, but stricter laws and states cracking down really killed profits. I just feel like any type of gambling in unethical, it seems to really pray on people's dopamine addictions. And these internet cafes, in particularly, are largely occupied by retires who, I'd wager, can't really afford to be throwing their money way.

Years later, my Aunt and Uncle became addicted to gambling on those casino boats and have now lost the house my Grandmother left to them when she passed. I don't necessarily believe in karma, but that certainly made me rethink it.

ada19813• 8 years ago

I wrote code to automate my 15 hour per week grad assistant job.

One or two clicks and some php magic.

Rjevski12• 8 years ago

Not unethical at all. They were paying X amount of money to get Y work done. You were providing that just fine (I’d say you were providing them even better value because you eliminated human error).

It’s not your fault if they would rather hire a human to do some automatable task.

SurgeonOfDeath• 8 years ago

When I was in highschool there was an online competition every week.

So one week there was this very hard problem. I didn't knew how to solve this but I figured out that there is one answer per 10 tests.

I bruteforced easy tests and send program with different answers std::cout<<30<<endl; ... So I send like 500 different programs. Then I just combined correct result with size of test ;p. I use while true to figure size for every test ;p

I passed every test. Week later my solution was removed and I got very nice e-mail about what I did and how wrong It was to exploit platform.

I still managed to be in top 10 at then end of competition but It was mistake huge mistake

Ps. Competition was with very good prizes but still I am ashamed of myself for that.

hjek5• 8 years ago

Worked for a company that was contracted by DOW to make an app promoting some extremely toxic agrochemicals, such as Forefront. They talked about this being so poisonious that if animals eat grass sprayed with it, then crops grown with their manure will be unsuitable for human consumption. Was also asked to fake ("round up") the calculations of how much money you'd save if by those chemicals.

Read up a bit about DOW and the Bopal disaster and started to feel horrible about my work.

Tried to gently bring concerns up with the management, and was laid off immediately.

I feel really bad about doing that work, but trying to make up for it by not eating animal products anymore.

secfirstmd3• 8 years ago

Why not channel your feelings and talk to a journalist, NGO or regulator willing to act in the public interest?

dabockster6• 8 years ago

People have been known to disappear for less.

hjek5• 8 years ago

Good idea. I don't really know anything that isn't already out there, but still happy to talk to any journalists/NGOs/regulators about it.

I have been going on about this to a journalist friend of mine who's works at a public broadcaster, but it didn't really go anywhere. Well, at least I'm airing this on HN now.

It's made me wary of wild-camping on grassy areas around farms, knowing what some farmers might be spraying there.

This is the app: http://uk.dowagro.com/grassland-weed-app-now-available/

About the killer compost it creates: https://www.sustainablemarketfarming.com/tag/tomatoes-with-d...

jliptzin• 8 years ago

How does not eating animal products help with your guilty conscience in this situation?

hjek5• 8 years ago

Animal husbandry has a large negative impact on the environment. After this DOW Grassland app I felt I needed to take a look at the environmental destruction I'm contributing to.

pc8613• 8 years ago

It may help with their conscience but it has no positive impact whatsoever.

brokenmachine5• 8 years ago

You sound like a good dude, that's why they laid you off because they knew you'd call them on all other shady stuff they'd do in the future as well...

I hope karma does happen in the end but I fear it doesn't.

whatsstolat• 8 years ago

Like the Roundup pun

spo81rty• 8 years ago

I made software 15 years ago to automatically buy concert and sports tickets from Ticketmaster and other websites. At the moment tickets went on sale we used hundreds of computers to buy up the good tickets.

I'm sorry your daughter didn't get Nsync tickets.

aidos2• 8 years ago

Wasn’t there a big case about that?

CPUstring• 8 years ago

That's just arbitrage, right? If you're able to sell them at higher prices, the venue should've done it themselves.

sincerely• 8 years ago

I mean, without scraping, it basically comes down to whether or not you care enough about the event to be online refreshing the page at exactly 10 AM or whatever. with scraping it becomes about whether you have more money. some artists prefer the audience be more of the former and less of the latter

godelski• 8 years ago

There was a Freakanomics episode about this. http://freakonomics.com/podcast/live-event-ticket-market-scr...

spork12• 8 years ago

Me and a friend setup a fake electronics store on the dark web and ended up making a lot of money when bitcoin spiked in value.

movedx6• 8 years ago

Brutal.

jrs952• 8 years ago

Personally I don’t think scamming people who intend to buy stolen electronics is particularly unethical anyways. It’s sort of like...profitable vigilante justice.

AboutTheWhisles• 8 years ago

That's not programming, that's just fraud.

movedx6• 8 years ago

Not a programmer at the time, but a system administrator. I won't mention the company. This was 2011-2012 -ish.

We hosted dedicated servers and most of the time, they were mostly Plesk or cPanel servers run by people selling email and or web hosting to hundreds of clients from a single server.

This one time a client joins the network, buys a server from us, and migrates from Rackspace. We wondered why he'd move from Rackspace given they were better than us, and it turns he was kicked off of their network because he basically submitted tens of support tickets daily asking for all kinds of optimisations, improvements, and silly stuff not covered by the support contract. Rackspace had decided he wasn't worth it and booted him.

We ended up with him and boy was he a pain in the backside. Anyway...

Long story short, he cost us more in engineering time than he paid us and this irritated the owner of our business. The owner had my team leader find someone on his team willing to do the following: dump the guy's Plesk database containing all of his customers and make a copy of it on our network. I took on the task and was told it was simply a backup. I was young and didn't really think things through. I feel bad about it now because...

The customer was booted from the network a month later and all of his customers were offered free email and or web hosting for the year, including migrating them over to our network... the owner absolutely annihilated the guy. He contacted all his customers and simply wiped him out.

That same owner is now a highly respected business man and an MBE.

You might be able to do some digging and find out who this company and owner is, if you look hard enough.

iamdave3• 8 years ago

.....isn't HostGator by chance is it? Sounds like the kind of stuff they would have pulled back in their days

movedx6• 8 years ago

No. They're UK based.

valar_k• 8 years ago

Was gonna say, it sounded like HostGator.

One of the HostGator former admins actually doxxed one of my old accounts on reddit by typing my full name in response to some random comment. When I asked him how he knew it, it's because my reddit username was the same as my domain name at the time, and he remembered looking through my server. Whenever the admins would get bored, they'd just dig through peoples' servers and see what they had. He remembered mine because I had a lot of sheet music on it.

They get people like this because they put their admins through the puppy mill process. Basically hire anyone not braindead, train them to do basic shit, and then pay them peanuts. The company men eventually get a high position in the hierarchy for a negligible pay bump and then help keep the new ones in line.

Such a shitty company, but I don't host anything sensitive there and it's been reliable for the last 10 years so I haven't migrated anything yet.

angersock• 8 years ago

That sounds like Hostgator.

movedx6• 8 years ago

No. They're UK based.

hello_newman• 8 years ago

what is an MBE?

movedx6• 8 years ago

"Order of the British Empire" - it's awarded by the Queen her self, directly.

typpo• 8 years ago

UKFast is a UK-based web host whose CEO has received an MBE.

Probably not that many other web host CEOs with an award from the Queen.

movedx6• 8 years ago

;-)

TeMPOraL9• 8 years ago

https://www.ukfast.co.uk/images/2018-redesign/logo.svg

UKFast - your future is our business.

Turns out it's meant seriously.

mancerayder• 8 years ago

Fascinating story! I'm curious why this isn't massive lawsuit material, I know in the US it would be. I thought the UK was similarly litigious?

gremlinsinc4• 8 years ago

Sounds like something people over at bluehost or EIG would do...lol..

powvans3• 8 years ago

I helped build Grindr, which of course I don't think was unethical. But I've been surprised by some people's reaction to it. It generally comes up in some conversation where someone asks "what have you worked on that I might have heard of?" Occasionally they follow up with (paraphrasing) "how do you sleep at night?"

knuththetruth2• 8 years ago

Out of curiosity - was this because of their homophobia or something else? I’ve read they’ve been terrible about data security.

powvans3• 8 years ago

The former. I wondered if the comment might be misconstrued. These were cases of individuals revealing their prejudices.

austhrow7434• 8 years ago

Grindr the service isn't unethical but I recall a thing about them having a lot of third party tracking. Which given the nature of the service seems to me way worse than tracking elsewhere on the internet.

Know anything about that or the extent of it?

powvans3• 8 years ago

I don't know anything about the current architecture or third party trackers. It's been over five years since I did any work with Grindr.

I will say that when I worked on Grindr, Joel (CEO, founder) was adamant that we would not track location history. We only stored the most recent location we received from a user.

puzzle2• 8 years ago

You're not a current or former Google employee, are you? There's the legend of the engineer who was a Grindr user and helped them to scale their code (it ran on App Engine, at least at the time).

ender893• 8 years ago

I believe the correct response to that is "sandwiched between two burly gay men I met on grindr".

dschep2• 8 years ago

Well they did leak their users' HIV status[0]. That's pretty unethical IMO.

[0] https://www.vox.com/2018/4/2/17189078/grindr-hiv-status-data...

scott-smith_us7• 8 years ago

A few years back at my last job, I was approached by a senior guy on a product team asking me to game some tests so we could get our Windows certification.

I just kind of brushed him off at the time. I'm still sorry I didn't collect evidence and then report him. He was a real dirt bag.

armagon• 8 years ago

Its an entirely standard thing, but I feel it is unhappy knowing that my paycheque depends upon thousands of mobile game players watching advertising, and feel that it is ethically dubious that my job is to try to cram more ads down their throats.

Aeolun2• 8 years ago

It’s great. Just as long as you reward me for watching an ad as opposed to making them a forced part of the experience.

E.g. watching an ad to double my score/gems, sure. Making me watch an ad after every level before I can continue, hell no, that’s an instant uninstall.

Schwolop• 8 years ago

As a hypothetical since I'm working on a game that may use this, how would you feel about the following? For a multiplayer .io-style game, you get a score per level, and a cumulative score. The top few players by cumulative score are shown to everyone and celebrated, etc. If you ever get zero points in a level though, you'll lose your cumulative score - unless you watch a video ad.

Is that acceptable, or does it feel like blackmail?

(FWIW I'm discussing this with a lot of other gamedevs too, but since you brought it up I figure you might have a "different community" opinion worth my knowing!)

chris11• 8 years ago

I'd say that's better than P2W games with lootboxes that target whales. I think's basically gambling.

iamleppert2• 8 years ago

I created software that was used by call center agents to bid on “bathroom” break time slots and kept track of who was on break and actively punished those who didn’t follow the rules. It rewarded those that had higher performance and who took less breaks with higher priority. If an agent didn’t come back from their break a security guard would automatically be dispatched to find them. For the same company I also made software that reduced the same call agents to numbers and effectively automated the layoff/termination process. It would contact security with orders to have people escorted out, and had a sinister double verification process that would check to verify the agent was actually fired, or else the responsible security guard would be punished via the same point system. Everything was done via e-mail and would come from “System” and at the time used fancy HTML e-mail templates that looked official. I would frequently hear people talk about how they received a “System e-mail” with a chill in their voice, not knowing I was the one responsible. People who I ate lunch with sometimes didn’t even really know. Embedded in each e-mail was a count-down timer to create a sense of urgency to do whatever was being asked before a “punishment” was applied.

After an agent had been terminated, their punishment points would decay over time until such a time they reached zero (or another configurable threshold depending on how desperate the company was for warm bodies), at which time they would be sent an e-mail to their personal e-mail (which was collected during the application process), inviting them to “re-apply”. Being an early telephony company we also would send them a robo-call with the “good news”. This process was known as a “life-cycle” and it was common in certain labor markets for employees to have many such lifecycles. Another way employees could stave off automated termination was to work for unpaid overtime, which offered to reduce their point values per unit of overtime worked. Everything was tracked to second granularity thanks to deep integration with phone switches and the adoption of the open source Asterisk CTI.

This orwellian automation terrorized the poor employees who worked there for years, long after I left, before it was finally shut down by court order. I had designed it as a plug-in architecture and when it was shut down there were many additional features, orders, and punishment_types.

fao_4• 8 years ago

I have to ask, why did you choose to take the contract? Financial pressures? Or did you not feel that such a system is morally reprehensible?

Personally while I'm opposed to programmer certification, systems like these certainly make me wish such a thing existed.

fucking_tragedy2• 8 years ago

There will always be someone who can find a moral reason that such systems need to exist. Engineers build weapons, after all.

derefr2• 8 years ago

Personally, as both a writer and a programmer, I often consider implementing the systems that I’ve written dystopian fiction about. Not to create a dystopia, but for the same reason I write: to point one out, such that people can get incensed, laws can be made, etc.

To put this another way: the most efficient way we could have possibly found to get the use of nuclear arms in war globally banned, was to have someone use one. The Cold War would have been far riskier if the world hadn’t seen Hiroshima and Nagasaki—it would have been a stand-off to the use of weapons we would have as-yet had no understanding of the consequences of using. It probably would have ended with the use of hundreds of bombs, rather than just two.

It’s sort of the moral equivalent of a “work to rule” strike: the best way to get through the lesson that something is bad, is to stop pushing back against it and just let it happen for once.

hnzix2• 8 years ago

Ironically, there's currently a post on HN frontpage about malevolent personality traits: https://news.ycombinator.com/item?id=17685733

I would file this under 3. Moral Disengagement - A generalized cognitive orientation to the world that differentiates individuals' thinking in a way that powerfully affects unethical behavior.

iamleppert2• 8 years ago

I was just starting out in my career and was more pre-occupied with the task at hand to have enough mental headspace to contemplate the full picture of what was happening. The system itself was designed by traditional software means: trial and error, trying to see what worked and didn’t, usually trying to maximize some KPI at the company. There was also the thought that punishment and reward should be applied fairly and be “data driven”; take the bias and human factor out of decisions and implement performance management in a predicable, deterministic and transparent way.

The problems arose when people realized that the same controls and abilities to instill this equity and “fairness” provided the platform to enable wide scale exploitation in the other direction. Want more profit? Change a variable that was a single number whose action would cause great stress for many people, but would produce a desired result. The goals and metrics would always start out resonable but eventually would cross a certain point, and once they did, there was no going back to the way things were.

Draw your own conclusions to the similarities in this system to our modern day technical web triumphs.

ibudiallo• 8 years ago

hmmmm, you and I need to have a little talk...

Edit: Since I am getting downvoted, I will just add context -> https://idiallo.com/blog/when-a-machine-fired-me

I was on the other end of a similar system.

vanattab• 8 years ago

So your the one behind that story! Thanks for taking the time to write it I have always loved that story.

himlion• 8 years ago

I thought parent post was a clever reference to your post. On the other hand, somebody has to make these systems of course.

tcgv• 8 years ago

I read your post the other day and would definitely link it here if you hadn't done it already. The other side of the story xD

knuththetruth2• 8 years ago

This is honestly the most horrifying post in this thread.

nitrogen• 8 years ago

There's a decent (fictional) short story about systems like this: http://marshallbrain.com/manna1.htm

ForHackernews• 8 years ago

This isn't fiction anymore. Amazon uses systems essentially identical to this to manage their warehouse "pickers". Their performance is continuously tracked and they're retained or terminated based on those performance metrics.

hkai3• 8 years ago

That looks pale in comparison to the Chinese employee tracking app Dingding. And it's becoming crazy popular.

Your employer's mistake was working in the call center business, they should've sold your system instead.

brokenmachine5• 8 years ago

Since you mentioned it in this thread, you clearly are aware that such a system is morally "challenged". How did you rationalize it to yourself? Was it something that started innocuous and evolved to become worse, or were you aware of how insidious it was from the start?

TeMPOraL9• 8 years ago

Woah. That's just scary. Also: didn't know about the whole "life-cycle" thing before, is such re-use and re-termination of workers common in this industry?

I often say that telemarketing should be considered a less honourable occupation than prostitution (in the latter case, you have two people voluntarily exchanging value; in the former case, you have one person trying to scam the other). Now I'm beginning to suspect it also has worse working conditions.

stealthmodeclan2• 8 years ago

First i thought that this is scary but I've had many friends who told me that they they play games all day at their office and once boss called them in their cabin and they expected to be laid off but were given a small raise instead.

"I take lots of cigarette and bathroom breaks to fix my makeup/hair and Snapchat my friends. I can't see myself working hard. I am not a sheep". Those are the exact words.

This is a scene from a government organization in Romania.

Now, i am in the US and I've not witnessed it here but here i am in executive role so i hangout with different people.

I asked them why not do your job properly? They answered, if they are going to do their job then they'll most likely receive a promotion, raise and more responsibilities come with it. For them more money = more problem.

They told me that for them money does not matter and all they want is experiencing different cultures, traveling etc... and work has no place in it.

This is something I had never heard before!

They somehow managed to rationalize not performing their jobs.

dsego• 8 years ago

This is a I believe a common sentiment in post-communist countries, esp. for anyone working for the state/city/municipality. It's normal for people to take a one or two hour break to go shop for groceries, or even leave at noon if they don't feel like working longer. There is even a common saying in ex-yu countries: “They can never pay me so little that I can't do even less work.” (sorry for the bad translation).

somethingsimple• 8 years ago

I can relate. I work in the US by the way.

I don't slack off, but I feel like there's a position as a Software Engineer past which I wouldn't want to be promoted. I see folks in the higher levels and the stuff they have to deal with has zero appeal to me. My salary and bonus at my current level are already more than enough to sustain my lifestyle and save plenty for retirement - I don't need more.

A lot of people are attracted to the idea of "getting more responsibility", and they like the prestige/visibility that comes with a fancy (e.g. "Principal" or "Staff") title. Me, I just want to put in my hours solving problems and go home do something else.

rrcaptain2• 8 years ago

Not sure why you're acting like that's a bad thing. The idea we should live to work 40+ hour weeks isn't a good thing.

chrismcb3• 8 years ago

Isn't some of this illegal? Wishing OT for free sounds illegal. Some of the other items may also be illegal... Perhaps that is why it was shut down

RugnirViking• 8 years ago

Unpaid overtime is standard in nearly all salaried industries, unless you are getting paid by the the hour in the first place

golergka• 8 years ago

Why would you consider such a system unethical? As a customer constantly annoyed by laziness and incompetence of the low-level support employees, I can only thank you for working on such system.

ender893• 8 years ago

So basically it was inevitable that everyone who was hired would be fired by your robot?

gremlinsinc4• 8 years ago

This totally sounds like 'Manna' the book by the creator of HowStuffWorks.

craftyguy2• 8 years ago

I once used curl to continuously upvote a family member's art submission to some national contest. The contest site did no validation so continuously sending POSTs with was almost too easy to game it. They won and got a free trip across the country (among other things).

brokenmachine5• 8 years ago

Did the family member know you were doing it, or was it a "present"?

amingilani• 8 years ago

I may have created and taught others how to create phishing pages and in high school and then used those generic pages in spear-phishing campaigns. Also I may have come up with some really good growth-hacks to gather credentials which resulted in a some inappropriate messages sent by a kid to another that he denied while he was suspended. No idea who actually sent them because maybe the phishing group was too large.

I may have infected my classmates with RATs in school with another partner and uncovered a large number of class romances.

I may have been an asshole as a kid. I'm just glad I grew up.

alanbernstein• 8 years ago

I reviewed allegedly infringing code for plaintiffs who might be described as patent trolls.

puzzle2• 8 years ago

In high school, I got a summer job at this local accounting firm. I don't even remember what I was hired for —probably paperwork— but pretty soon I was doing some programming for them. The owner was rich, but cheap, so he asked me to write a simple invoicing tool for their smallest clients. That way, he avoided a costly upgrade for his existing software, at a fraction of the price. I knew I was being underpaid big time, so I would make a mental note of the bugs I'd find, but avoid fixing some of the minor ones. I did not plant deliberate ones. Invariably, when school started, they would call me to go in once or twice a year to fix something. I'd chat with the guys most of the afternoon, change the code over a few minutes, then collect my "tip". I didn't feel too guilty because the owner was paying me a pittance, but acted like he was showering me with millions and treating me very well. I was young, but not naive. I could and would have done a lot more if only he hadn't been so condescending. Plus, some of his business and clients sounded a bit sketchy, although I had no proof.

In another occasion, I cracked the copy protection on one of their applications. They had a full license, but the protection relied on a magic 5¼ floppy disk and their new machine only had a 3½ drive.

I promised myself I'd never work on accounting software again. Later, I ignored the owner's questions about what kind of internet businesses to invest in. He was dangling some of his money in front of me, but I didn't fall for it. Which was a good call, because a few years afterwards, he got in trouble for aiding his sketchy clients I mentioned above.

nodesocket• 8 years ago

The one example I am willing to share is in high school economics class there was a stock market simulation. The person with the highest portfolio balance at the end of the year received a substantial amount of extra credit.

First of all, this was 1999, and the market (tech-stocks) were in peak ridiculous bubble mode. The hack was that the software used to simulate trades and track portfolios used delayed quotes. So, I simply used real-time quotes looked for gains in a short period and bought held for a bit, then sold. Essentially I had a time machine. I think at the end of year my account had over $500 million in it. The teacher knew I was "cheating" but still gave me the extra credit along with another student who didn't "cheat". An extra perk is the cutest girls in that class constantly asked me how I had so much in my portfolio.

rootsudo2• 8 years ago

Not unethical, just information asymmetry and arbitrage.

pbhowmic• 8 years ago

I used to work for a company that used a provision in the tax code - I can't remember if it was a California state or US tax break - for training their employees. They used to count meetings as training sessions and would make attendees sign attendance sheets to present that as "proof of training".

xchip• 8 years ago

I used to crack games just for fun, in fact the fun was in cracking the game and not in actually playing the game.

nyxtom• 8 years ago

Ad retargeting analytics would be one. The ability to track even anonymous users in an attempt to “nudge” users towards purchase behavior felt especially wrong. I didn’t work at Facebook but this was definitely a selling point for their hiring team. The tough part about this is that most of the internet is funded by this single business model. Collect data and behavior about users and non users.

dawnerd• 8 years ago

I had to migrate a site for a well know fitness personality many years ago and their database contained plaintext passwords and! Credit card information. Didn’t bother to really fight it at the time. More reason to never give your credit information out if you don’t have to.

Also helped build a site that tricked google into ranking us higher.

gabcoh• 8 years ago

Not necessarily unethical but certainly annoying, reply all has an episode about the creation of the popup[https://www.gimletmedia.com/reply-all/3-i-didnt-mean-to-brea...] From the show notes: “Twenty years ago, Ethan Zuckerman did something terrible on the internet. And he's still living with the consequences. “

ryan-allen3• 8 years ago

It's not really unethical but in that vein: I made a program on the TI83 that you could punch numbers into in order to get results on an electronics exam (this was in high school).

I made it for fun, not really to cheat or anything, but once other students found out about it they asked for copies of it. Within a day or two the whole class had a copy of this program.

I didn't understand operator precedence, nor did I bother to test the program. Everyone used it in the exam and the whole class flunked due to BODMAS shenanigans.

curare2• 8 years ago

At a previous employer we used the data referenced in the question. We bought the "anonymised" telecom data from one of the big providers in the USA. We would then analyse that data to figure out where the phone spent 6-8 hours during the night to determine where the phone owner lived. Then we'd pull the USA consensus data(free!) so the system would know what demographic the user probably belongs to. We got a surprising amount of data from the consensus, we had things like ethnicity, income, age.

Then we'd loaded all this in google maps and let users of the app figure out what demographics frequent particular locations on the map. For example a use-case of this would be a coffee company figuring out where to open a new coffee shop.

overkalix• 8 years ago

Census

pc8613• 8 years ago

Is there anything even remotely unethical about this?

Compiling publicly available data with purchased/proprietary data is basically the foundation of competitive/market research, isn't it?

forgottenpass2• 8 years ago

Whether something is the catercorner of a business model has no bearing on if it is ethical or not.

curare2• 8 years ago

In my opinion the sale of phone location data is already unethical on it’s own.

The location data was pretty accurate too in suburban areas. And the provider in question was not very good at anonymising it either. On multiple occasions we could track individuals over a longer period of time. Which would shut down the entire project until it was fixed.

So the company did the right thing whenever the data was compromised. Probably because they were publicly traded and had a good name. I doubt scrappy startups would do the same.

netaustin4• 8 years ago

After Jared Kushner originally bought the New York Observer, I was hired to lead the tech team, which I did for a year and a half in house then for three more as a vendor. He asked me, out of band, to blackhole articles critical of his commercial real estate colleagues and I complied.

Rzor• 8 years ago

You should've used a throwaway.

pc8613• 8 years ago

The number of people who led that team for a year and a half as an employee and three years after as a vendor is probably sufficient to identify them regardless of the account used.

netaustin4• 8 years ago

I appreciate the sentiment, but I've been open about this on Twitter and to a team that wrote a profile of him in the wake of the election. That a newspaper publisher would participate in an administration that labels the press the enemy of the people is a total betrayal of the journalists and other media professionals who worked hard for him for years.

DavidJustin• 8 years ago

The way you handled this does not speak well of your character. You should have: 1. Preserved the articles in a safe place. 2. Resigned. 3. Given the articles to another publication and state what happened. What I see here is that you were concerned first about your own finances. That is what makes you look bad. Ethics first, finances second.

dragonwriter• 8 years ago

The way you handled this does not speak well of your character

Given the question asked at the head of the thread, any response for which that was not true would have to be viewed as a kind of humblebrag.

beltadurke• 8 years ago

Giving the articles to another publication would constitute unethical behavior as well though, considering he didn’t own the content and could not claim any authorship over it, though perhaps alerting authors or editorial staff could have spurred that result. And obviously a question about the most unethical thing a person in this field has done isn’t going to be something that speaks well of their character. I don’t think it speaks well of a person’s character to judge someone for the single most unethical thing they’ve done in their career.

organicpreneur• 8 years ago

Beaconhack.com

ConcernedCoder• 8 years ago

There was this Australian company that had this fly-by-night looking empty office near South Park, San Francisco... I'm serious, and not exaggerating, when I say it was a few bare metal folding chairs/tables bare walls, and way too much open space for the 1/2 dozen people working there...

In any case, the startup I worked for previous was split up and sold/aqui-hired out to two different companies, and myself and the technology I'd created, and the million+ email addresses we'd collected went to this one.

I went along with it because they were one of the few companies I knew of with access to the twitter fire hose feed, which interested me, and they had dept. of defense contacts - which ( in my mind ) legitimized their presence in the U.S.A. at the time.

Out of the many shady-feeling project, the one that made my skin crawl the most was an automated fuzzy matching system I was ordered to create, that tried its best to match users on Twitter to users on Facebook, using nothing beyond the normal publicly available meta data ( name, age, icon, the regular profile stuff ) and the followers/people followed on the twitter side, and friends and likes on the Facebook side.

It was surprisingly easy to match people, and felt more than a little wrong to me when I really thought about it... but the tech/challenge was just too fun to work on to routinely give it more than a perfunctory thought.

stevehiehn• 8 years ago

Is this a trap?

dabockster6• 8 years ago

Is this loss?

calabin• 8 years ago

During the Ashley Madison incident, a partner and I put up what was either the first or one of the first online tools for checking to see if a particular email address or phone number had been exposed.

I'm still not sure whether or not that was net good/bad. I'm sure that the tool has caused some real familial stress. We could fall back on the "well if not us someone else would have" but that's a cop-out.

Our site was checkashleymadison.com. Later on we got rid of the domain. We had a ton of interest from advertisers, but we thought it best not to try and make money off of the exposition of others. Overall we took in something like 1.2mm uniques over 24 hours. It was a pretty crazy day, and my first time speaking with the media. Looking back, I'm glad that I didn't say anything too dumb.

Originally we intended to stay anonymous, but I forgot to tell a The Hill reporter of that wish and my name was published. After that I spoke on the record to whatever journalists were still interested.

gjpolly• 8 years ago

Exposed private chat messages...

It was a small 30 person company with an overbearing founder.

We ran a chat program called Pandion to allow non-IT staff to quickly ask each other work questions.

The boss had already asked us in IT to set up journaling in Outlook so he was getting a copy of every email sent and received by his staff.

Next he turned his attention to Pandion and I was tasked with setting up a regular report containing all chat messages that were logged on the server.

I knew everyone in the company personally and didn't care to read their private messages...but the boss wanted to get a copy right away before it was announced to staff.

So I send a copy to him, containing the last few days of messages that had been sent.

Of course a couple of staff were dating. Apparently Glen* and Amy* used Pandion for personal messages to each other.

I'm sitting with the boss explaining how the staff don't know their messages are being reported on and we can start publishing the report after the next team meeting, but the boss wanted none of that...

So we start going through it together. One of the first messages is from Glen telling Amy that she's as tight as the seal on his lunchbox. The boss had a good sense of humor and we both pissed ourselves laughing, but it still goes against my values.

top_throwaway25• 8 years ago

Throwaway account.

In high school (2010-ish), I was on the student council so I had insider access of sorts to a lot of the inner workings of the school administration. One day, during a short meeting with them, the principal told us on the council that the IT department was installing wifi for personal device use. Since we had difficulties with getting school bonds passed by voters at the time, the wifi was supposed to enable us students to bring our laptops from home and use them in the classroom (since most classrooms only had 3-4 computers, with older schools only having 1-2 computers per classroom for staff use only). Naturally, we were all on board since it would enable us to finish our schoolwork without fighting over computer space.

Fast forward two months and I notice that the wifi seemingly hasn't been installed yet. I ask the principal and was told that it was supposed to be installed and working perfectly. So I did some digging on one of the school computers. This is where I found out how the school district's IT department submitted updates.

The IT department ran an old Novell Netware server for account login, Faronics Deep Freeze on the end user machines to protect against student abuse, and a Windows network share for unattended updates. Since the Windows Netware client cannot assign local Windows permissions (or it wasn't configured properly in my case), everything inside Windows was ran with admin privileges (you were logged into Netware but ran under a local admin user account in Windows). Since Deep Freeze reverted changes to the file system on reboot, the assumption was that the students could completely wreck the install all they wanted with a simple reboot being all that was needed to effectively reset the machines to the default configuration.

This strategy worked well, but there is a huge flaw. Because you had local admin rights, you had full access to whatever resources you wanted under Windows XP Professional (the OS of choice back then). This includes the ability to install software or games (we had some epic district-wide Halo CE LAN parties), see network information (MAC address, IP octet configuration, etc), and everything else you could do to a local computer. The only caveat is that whatever changes you made would be erased on reboot. I guess the assumption with this is that the average inner city high school student wouldn't have the technical expertise to know how to read this information, let alone access it. But, with me being gifted with tech skills at an early age, I could do some damage.

Back to the wifi story. I noticed in my digging that my Novell account credentials would let me into their update share. I was able to mount the share as a network drive and look through it. I saw everything from MS Office VLKs, the Faronics uninstaller, network diagrams, etc. I did have some ethics back then, so I didn't touch anything related to a license key. But I did find the wifi deployment timetable document.

It turns out that the IT department had already deployed the wifi to my school and was fully functional...for them only. They had made it as a hidden network only accessible to them for "maintenance purposes". (Keep in mind that most of the school and administration was under the impression that it was going to be for student use.) The timetable document also listed the wifi password for the hidden network. With that information and the MAC/IP pattern I swiped from one of the school machines, I was able to log onto the "maintenance" wifi with my own personal laptop. This made me the talk of the student body ironically, with even one of the assistant principals asking me for help because the IT department had stopped communicating with the administration regarding the rollout.

Anyways, I used my newfound wifi powers to do my work and prep for college. Never used any of the serials or anything, just wanted to stop fighting over computer use. Ended up keeping the timetable document on a thumb drive until graduation before sticking it in my desk for a few more years. When I moved to Seattle for work, I ended up tossing the drive into the ship canal under the Fremont Bridge. (If someone finds it, I'll buy them a beer.)

Anyways, that's my unethical story.

TL;DR: Hacked into a network share to get wifi access in high school because the IT department embezzled funds.

taitems• 8 years ago

Not going to incriminate myself with any of my own stories, but a friend did work for a phishing take down company that was paid per site they removed. Of course the people who sign off on these things are never that technical, so the company was paid a non-trivial amount (say $1,000) for taking down each subdomain.

Think, contact.bankna.me, support.bankna.me, aus.bankna.me, customer-support.bankna.me, login.bankna.me etc etc.

They would often take down the subdomain and leave the parent name intact so they could keep cutting off the individual heads of hydra, if you will.

beaugunderson• 8 years ago

I lied to the C-levels at a previous company about how hard it would be to monitor and log the instant messaging traffic of everyone at the office. Everyone was using AIM and there was no encryption, so it would have been trivially easy (I verified this, which was scary).

I then lied and told the CFO and CEO that it would be prohibitively hard to do and they dropped it. :P

stealthmodeclan2• 8 years ago

Alright, i know this guy from NYC - he would offer payment processing to companies who could not get payment processing in their own country.

Initially, everyone will be paid out on time and later he will refuse to pay holding 500-1M from each company.

He made 10s of millions doing that you'll be surprised that everyone threatened with a lawsuit but never reached the court.

Now, he has a lot of real estate in NYC.

skc• 8 years ago

I let a brash, know-it-all, developer shoot himself in the foot instead of pointing out that the things he was doing would lead to a catastrophic data loss.

I was pretty young so it's not something I would do today.

z0mb3e• 8 years ago

I used to help out at a bed company selling matresses in their WooCommerce store. The owner was obsessed with „metadata“ and SEO.

He regularely told me I should copy and paste the meta title and descriptions into a Word document (ugh) so he could edit on them. When he was done I was supposed to put them back in, manually of course.

Now, normally I‘d tell a client that such a task could be easily automated. However he was a very shitty boss and I was getting paid hourly.

So I simply built a crawler that analyzed every site and pulled its metadata, put it in an Excel table (I convinced him it was easier for me to copy/paste) and sent it to him via email. He then gave me the updated table, for which I simply wrote a script to execute some SQL queries to put them in.

This turned what what’s effectively 2 hours of work each time into 20-30 because of the number of pages.

One time I remember I forgot to update the metadata one of the pages. When he complained and I realized, I quickly ran the script and told him he‘d have to „refresh his cache“ or something. He never noticed any of this.

capevace• 8 years ago

I had one of those SEO obsessed bosses. They’re the worst since they never understand how SEO actually works and throw around buzzwords.

If he really was shitty otherwise too, good on you.

throwaway_0hjpo• 8 years ago

I wrote (copy pasted / edited) a cheat for an online game that was in beta, when I was around 13. I released it (with no anti cheat protection), probably got a few thousand cheaters banned...

I then sold the cheat source code to a forum of cheaters, who integrated it into their own offering and paid me a small royalty. The source code was pretty much copy pasted from a guide with minimal changes to work on the correct memory addresses.

crookintheyard• 8 years ago

Worked in a company making internet scams.

My first project was an 'X-Ray': for a fee user could upload a photo of person and see them naked. The website just applied a picture of naked body to the uploaded face. We collected all of the resulting pictures and displayed them in a slideshow on a TV in the office for laughs.

The big project was 'download anything'. We had an affiliate program where partners were driving traffic to us and received 70% of profit. All the traffic was coming with ?search=keyword URL parameter and our landing page looked like a file sharing website with search results for 'keyword'. It was 2012, downloading shit from file shares was a big thing these days. Depending on the USER_AGENT, the visitor downloaded keyword.exe or keywork.apk. On Windows, it was an 'installer' that asked user to send an SMS to premium number in order to 'activate the download'. On Android, it was an app that just sent the premium SMS by itself — easy money!

We had a lot of fun and profit doing that, and I left that job not because of guilt, but because I burned out. Only after I left I was able to look at it from a different perspective.

rjay925• 8 years ago

While working with a client as a contractor in US, I was told by him, that my Manager had promised to get PhD/MS with 5 to 10 years experience. I had 4 years experience after my after Bachelors from another country. The client appreciated my work and kept my contract as long as possible. In the three years that I worked, I saw 10 people come and go. It hurts me every time I think about it.

What hurts most is that it is still in a common practice in that company and industry.

throwaway3883• 8 years ago

I worked for a company, which had insiders at Google steal various data to improve their SEO. I don't know the details, but I think it may have involved some cute girls. I built systems to work with the stolen data to improve their SEO. They are one of the most popular websites on the internet.

southphillyman• 8 years ago

Give positive references for developers who I know are crap because they are nice guys and I feel sorry for them.

cartercole• 8 years ago

I built a toolbar ad network for about 200k users and would do inline ads on every page and replace all search results with ad api feeds

unclean_scholar• 8 years ago

Once I've developed a tool that replaced a couple of employees for a (client) company.

In another occasion, I was assigned to a project that I didn't find motivating at all, so my plan was to "slack off" and work on my own stuff as much as possible. The only question was how much did I have to work to make the management believe I was giving it my 100%. There was another member in the team, who was a great guy but an average dev, and I realized that I could easily make 2x more progress than him in the eyes of the managers and still have almost half of the day "free", so that is exactly what I did. Later I got a bonus for my "hard work".

But the one I regret the most is installing keyloggers on several computers in high school (msn era) and obtained passwords for most of my classmates. At least I was careful enough and didn't tell anyone at the time.

api• 8 years ago

I wrote a ton of IRC war bots and scripts back when I was a teenager including something called the "Sumo nick collider" and the textbox.irc script. The latter was a general client enhancement script but had tons of extensions for "war."

For you spring chickens "war" was exploiting the IRC protocol to take over channels, kill users, etc. The protocol was pretty vanilla back then and was vulnerable to a lot of those things. This was back in the 1990s.

This included inventing "DCC RAW" based "clonebot" code in the old Unix ircII client. I figured out you could just open a socket with the client so you could write a simple client script to create huge numbers of sock puppets. I'm not 100% sure but I think I was the first one to do this.

I learned a lot from that stuff but these days I wouldn't wreck a public volunteer chat network.

boomlinde• 8 years ago

On the IRC bot note, I have a petty-unethical story of how I made an IRC bot that would pick up movie titles, search for them on IMDB and respond with a randomly chosen spoiler marked trivia bullet.

My most benign bot simply played back the subtitles of Robocop in realtime on a loop.

adultSwim• 8 years ago

silence from our fellow engineers in the "defense" industry

d21d3q• 8 years ago

I was asked to generate fake data from renewable energy sources. Solar panels, wind turbines, heat pumps, all in EU project. Company needed to prove that estimations (about energy production provided in application) were correct in order not to return money. I was pulling data from weather api and "scaling it to power", and making monthly reports of energy balance (electricity, heat which was bought, produced, lost) Fun part was when guys from committee saw those reports, they told: "Finally somebody made right reports. Let us make a copy and show it to others as example" :)

gworley32• 8 years ago

I was a graduate student living off a stipend and working for the university teaching math and CS courses. It wasn't enough money, especially with my wife's medical bills, so I got desperate and...taught for ITT Tech.

If you've never had the displeasure of being a student or teacher at ITT Tech, I'd describe it as a cross between community college and vocational school but where everyone is pretending it's a 4-year college. It felt like a place where dreams go to die, and no where did I see that more in the way they set me up to teach classes.

Now, first I should say I have a lot of sympathy for my students there. They were generally folks who honestly wanted to make better lives for themselves and got duped by ITT Tech into thinking it was a place where they could do that. Those students are now stuck with a lot of crappy debt they can't easily get out of and also didn't learn much, because as I learned from teaching there, the goal was not really to teach anyone anything.

I taught two classes: software engineering principles and Linux system administration. I had not special qualifications to teach either of those classes, but they needed someone to teach them, I had an MS in CS, and I had some idea of what to do. The SE class consisted of two students and we'd meet for 4 hours every Saturday for 3 months. We'd sit together and read the textbook, then do some problem sets out of the textbook ("how would you design this system or organize this work?"). Nothing truly objectionable, just the same shit the passes for "education" in most school. I think I gave both of the students As at the end of the semester.

The Linux system administration class was another story. I had three students, although one showed up maybe 3 times all semester, and they had all in theory already taken a class teaching them Linux/Unix basics, but as became immediately apparent none of them had actually used Linux before, just read about it in a book. So began our awful semester of them pretending to learn and me increasingly transitioning from teaching to pretending to teach.

They started out needing to install Linux on their laptops. This was around 2010, so not quite as easy as today but already very easy (the worst case scenario was you failed to get hardware acceleration for graphics or something like that, not non-functional input devices). Yet somehow every week for the first month we had to reinstall Linux. I don't know what was happening in the week between classes, but somehow Linux disappeared from their computers and we had to go through it all over again. This obviously put us way behind.

Once we got Linux running on their computers we started to try to do some basic system admin stuff (there was a syllabus telling me what stuff they should be able to do by the end). I don't think we ever really made it past creating users and installing packages (is installing packages even still sys admin work?). They constantly got stuck on basic things, forgetting how to `ls` and `cd`. By the end of the semester I think they still couldn't reliably `sudo` on the first try.

I knew this was bad and had been talking to my supervisor about it, but he kept telling me it was fine just do my best and work with them where they were. When the end of the semester came I didn't know what to do about grades because they had tried but were just unprepared for the class. At university I would have failed them, but ITT Tech insisted I give them Cs. I was pretty unhappy about that whole situation but what could we do.

When they offered me classes for the next semester I declined. I didn't want to be part of a system that was all about pretending to teach people things while also charging them a bunch of money. But for one terrible semester I was complicit to a system of exploiting desperate folks (some of my students had been in prison and were trying to get their lives back together and giving up a lot to pay for classes to be there).

jrenouard• 8 years ago

I worked on dating websites. The codebase was awful but more importantly, 99.9% of female profiles were fake, poor guys were trying to get a date when in fact they were chatting with some other guy in Africa... It was really depressing doing a job that wasn't adding any value to the world and being part of a parasite economy. I had to this for financial reasons but left as soon as I could.

black_13• 8 years ago

Call centers are on a lower ring of hell.

Err0r404• 8 years ago

My boss asked me to log a user's credentials in cleartext so he can connect to his account and get confidential data... I resigned the next day after

golgoth3• 8 years ago

When I finished my studies I was sold as a trainer for Microsoft training When I was assigned a course, I had about 2 days to a week to discover the technology and prepare the course. Often I didn't even know the name of the technology I was supposed to be an expert on.

When you looked at the official conditions of the training, you had to have 10 years of experience just to have the right to follow it, I was supposed to have passed diplomas to have the right to line up. I finally realized that my company had to produce fake degrees with a fake resume or I must have been 10 years older developpers.

It is obvious afterwards that employees, or even managers of training centers were in the scheme, there is indeed in my country a law that obliges companies to spend money in training every year. The company was doing this scheme on a large scale, we were 40 The worst part was that most of my colleagues were younger trainees than me, only three or four of us were officially employed and had real diplomas, so we were sent to the most difficult cases.

The advice we received was to be aggressive with the students to prevent them from asking too many questions, to be impeccably dressed and to be "handsome". It was not easy to teach to 15 years older So that my classes were not too pathetic and to make a minimum illusion I often prepared my courses the day before until 5 o'clock in the morning.

The trainees who gave the training deemed easier were recruited on the line, preferably if they were foreign, they were sent to give a test training and if it went badly they were sent back on the spot without remuneration. I don't know how or why, but I did about nine months of this before I left.

Ask HN: What is the most unethical thing you've done as a programmer?

Related Stories