Hacker News Reader

Comment by horsawlarway | Hacker News Reader

Across basically every company I've worked for - this is normal. And many of those companies are not 3k+ employee tech companies. Think 10 to 100 engineers.

It's actually a requirement for many compliance certifications in the US - previously employed staff are not allowed access to your systems.

If you're in an office - you can wait until you grab the employee and put them in a conference room to fire them before cutting access (as long as security is there to escort them out afterwards). When everyone is remote - that is not an option.

ex: item number 1 for SOC 2 compliance is

----

Access controls

—logical and physical restrictions on assets to prevent access by unauthorized personnel.

----

When an employee is terminated - they are unauthorized personnel.

View on HN

I think it's more the dichotomy of companies asking for high levels of commitment, loyalty & trust, but offering none in return.

It's funny that they would fire people in this way, then turn around and ask the remaining folks to sign up for "working long (uncompensated) hours at high intensity".

They are trying to have it both ways.

I mean - no offense... - but if you still think corporate entities have any real loyalty you've clearly not been paying attention for a long time.

I've never seen that attitude last beyond the initial 50 or so employees at a startup, and it sure as fuck doesn't last past the "we're installing monitoring software on all your machines" stage.

Work is what you do to get paid - it's not your family. It's not your friend. Don't treat it like it is.

That doesn't mean don't take it seriously, or respect it - just understand that work is your family like a hooker is your girlfriend - it's only true until the money runs out.

I'm not sure if you're directing that at me. We're saying the same thing.

The only scenario where I see this being an even remotely reasonably request is if you think someone is a severe risk for harming your systems should they be laid off. In every large company I've worked for (including ones involving high security systems) the standard was that you'd give people a week notice, maybe two weeks of an impending layoff along with a decent chunk of severance. This way those people being laid off could do a knowledge transfer and ensure that their domain experience wasn't lost and that you maintain a good business relationship with your employees.

To me, the way y'all present it is not the norm. It's working for a company that clearly does not trust its employees and treats them poorly. If you find yourself working for those kind of places frequently then please realize that it is not the norm and you should not try and normalize it.

It's quite normal, unfortunately. Nobody trusts their employees in a $44 billion company, definitely not in the wake of a highly-televised hostile takeover. They have the MDM software, they intend to lay off the employees anyways... there's no wrongdoing here as far as I can see. This is just how they do things outside the startup sphere, it's not like the CEO is going to schedule you a final Zoom call and have their receptionists bring you a bouquet of roses.

> It's working for a company that clearly does not trust its employees and treats them poorly. If you find yourself working for those kind of places frequently then please realize that it is not the norm and you should not try and normalize it.

You keep coming back to this - but even in companies where they do trust the employees - legal compliance is not a joke. If you're doing anything at all with customers who are in any of the following businesses...

Healthcare

Banking

Gov

Finance

Law practice

etc...

Then you turn off access when you fire an employee. Period. You can like them all you want, in which case you might go grab drinks with them afterwards - but you don't fuck around with access to your systems, because you lose your compliance certifications, or you get breached, and you lose a bunch of fucking money, you lose your enterprise contracts, and you yourself likely get fired.

Yes, access controls are critically important for many companies in many domains. My employer operates under such operating procedures. It seems reasonable that if your software collects and stores user information, employee access to all systems should be tightly controlled, and "turned off" if an employee is fired, laid off, or quits.

This is a great way to quickly lose critical information from your engineers. The few companies that do follow what you recommend end up scrambling when a key infrastructure engineer leaves, they immediately cut access and realize that he was the only one who knew how to work certain parts of the system. If you're the kind of company that conducts exit inteviews (which are the majority of large tech organizations) then you're no longer going to get any valuable info out of them by burning bridges like this.

You're misunderstanding the difference between a voluntary exit and a firing.

This is not standard procedure for a voluntary exit at most companies. The employee puts in their two weeks, works the time, and exits. The assumption is good faith on both ends, because the employee has chosen to leave.

It absolutely is the standard procedure for GETTING FIRED. The other standard part of getting fired is that the company has already decided they no longer need your skills or expertise (excluding twitter's situation, where they decided poorly - according to the news).

If you're laying off 100 people - the odds that any one of them might do something silly is very low. But that chance * 100 is usually considered an unacceptable risk from a security standpoint. Multiply it by several thousand, and it's absolutely not ok to leave the keys to the kingdom with that many fired employees.

All it takes is one drunk employee holding a grudge and you get a really nasty mess on your hands. Not to mention legal hot water.

Reply on news.ycombinator.com