Readit News logoReadit News
evmar · 2 years ago
I made epitaphs! AMA
laurentlb · 2 years ago
The blog post mentions "Someone else who knew you had to add it", but this is not exact (or no longer exact). An employee can send an email to a special address with the content, and it will show up when they leave the company.

That's what I did. That said, I can't double-check to see if it worked. :)

Thanks for the tool, Evan!

evmar · 2 years ago
You are both right. Originally you could not email, and like the OP I kind of liked the ceremony of entrusting someone with a message to send from beyond the grave. But someone contributed the code to make the email work, likely after the OP's time.
kajecounterhack · 2 years ago
Laurent FYI it didn't work (FYI we interacted over the cider font size thing). I couldn't find you anywhere even though I know your ldap.
znpy · 2 years ago
In what company, if I may ask?
vicek22 · 2 years ago
It seems like Google from all the people who responded in this thread :)
umbauk · 2 years ago
Is it still going?

Were you ever made change it by HR?

I left 5 years ago. Loved that thing!

evmar · 2 years ago
It was still going at the time I left (~2y). Most of the work of keeping it alive had been done by others for the last decade, so I hope someone else is still carrying the torch.

We had the occasional HR interaction but to my recollection never anything nasty.

saagarjha · 2 years ago
It was there when I left several months ago, so I assume so. Or maybe I shouldn't, they started shuttering a lot of these kinds of things after layoffs.

Deleted Comment

JoachimSchipper · 2 years ago
Why did you make epithaps? Any interesting organizational or technical challenges you encountered on the way?
evmar · 2 years ago
Initially it was a combination of just for the fun of it (it's a small script, as OP described). Secondarily there was the feeling of "everyone is going to go work at [major competitor]" and I was curious whether I could collect the data to show it. (I never ended up looking into this, but maybe HR did.)

As a dumb script it was not designed to be especially flexible. One thing I remember needing to fix was that by its nature it was archiving old data and preserving it, which meant that it was accidentally deadnaming trans people. My recollection is this was a small code fix, but an interesting lesson in social consequences of oblivious software.

kajecounterhack · 2 years ago
Thanks for making epitaphs <3
bsimpson · 2 years ago
I don't know what to ask you in a public forum, but it's nice to see your name pop up!
simonw · 2 years ago
If you're going to run something like this, I thoroughly recommend using Git for it.

You can have your cron do something like this:

    curl https://internal.corp/employees.txt > employees.txt
    git add employees.txt
    git commit -m "Automated: $(date -u)" || exit 0
The || exit 0 should ensure no errors even if there is nothing to commit

Now you have a commit history of every change made to that source of information - just run "git log" to view it.

I run this kind of thing on scheduled GitHub Actions all the time, see https://simonwillison.net/2020/Oct/9/git-scraping/

svat · 2 years ago
I do something similar but instead of `|| exit 0` I use `--allow-empty` on the `git commit`. I don't mind the empty commits this creates, as they let me know that there was a successful automated run that happened to be empty, rather than having failed to run for whatever reason.
michaelcampbell · 2 years ago
Thanks for this, much more "intent revealing" than my (up to today) standard practice of `... || true` to keep my `set -e` from killing my script for this "error-but-not-really"
MarkSweep · 2 years ago
Maybe add a ‘| sort’ in there for determinism. But yeah, git is an underrated database for this type of small scale data.
hiAndrewQuinn · 2 years ago
I used your exact technique to start generating a diffable archive for the Finnish easy language news broadcast. It's been a huge help in gathering high quality comprehensible input for me, thanks!

https://github.com/hiAndrewQuinn/selkouutiset-scrape/

GauntletWizard · 2 years ago
I've been seriously considering using Git for all sorts of oft-changing-but-rarely-majorly data. Lists of books in my bookshelves.

The other problem is that I sorta want transactional-database features on top of these things. Git does this well. I also want fast indexing on parts. Git does not do this well. I am considering writing a "standard" for the dumping of sqlite to git, so that I can just delegate this out; Any transaction can be expressed as a git commit, and I can run both at once for both the durability and the reasonable indexing; The sqlite database can be re-created and reindexed whenever, and it also sorta works for backups...

Definitely just spinning my wheels, though. We'll see where databases take us next.

rrrrrrrrrrrryan · 2 years ago
> oft-changing-but-rarely-majorly data

I think you're referring to SCDs, and there are plenty of well-defined ways to track these within relational databases:

https://en.wikipedia.org/wiki/Slowly_changing_dimension

Why git?

ElectricalUnion · 2 years ago
Would fossil fit this bill?

Somewhat git-compatible, based on sqlite3.

jarofgreen · 2 years ago
In your git & sqlite setup, I'm not sure which way round you are thinking - which is the SSOT (Single Source Of Truth) and which is the handy cache.

I've been working on a tool that treats the git repo as the SSOT then lets you dump out all kinds of formats for data work including a sqlite DB. I haven't had as much time as I would like on it but it's at https://pypi.org/project/DataTig/

GauntletWizard · 2 years ago
If anyone is coming in late, I have discovered https://immudb.io/ , which claims to be a lot of what I'm looking for. Transactional SQL database, indexed, yet immutable data and verifiable chains of transactions.
rofrol · 2 years ago
itronitron · 2 years ago
A colleague of mine would do a sort of temporal-network analysis of this data to see which people either enjoyed working with (or for) each other or which did not, based on how people would switch groups over time.
cutemonster · 2 years ago
Did s/he use the analysis results for anything? (If you know)
jacquesm · 2 years ago
That's clever, thank you! I will definitely use this.
bandie91 · 2 years ago

  if git is-there-anything-to-commit; then git commit ...; fi

  'is-there-anything-to-commit' is aliased to '! [ -n "$(git status -s --porcelain --untracked-files=no)" ]'

mmsc · 2 years ago
I made a tool to track ldap like that [0]. LDAP is a treasure chest of info and great for stalking. for some reason i find it fascinating to see people leaving, and if possible, see how long they worked there for. seeing friends get fired via LDAP before they even knew about it was certainly interesting, too.

I noted in the readme..

    Know what's going on in your LDAP directory on-demand with Slack webhook integration.
    See new hires, leavers, and promotions as they appear in LDAP.
    Monitor when and what HR is doing.
    Detect unauthorized changes in LDAP.
    Monitor for accidentally leaked data.
    Detect when users are logging in and out of LDAP.

There's also LDAPmonitor[1] which is designed for Microsoft and Active Directory which does effectively the same thing.

[0]https://github.com/MegaManSec/LDAP-Monitoring-Watchdog

[1]https://github.com/p0dalirius/LDAPmonitor

jedberg · 2 years ago
Layoffs in the WFH era are weird. Back in the day you had a pretty good idea of who got laid off because you saw them walking out the door with a box of their stuff. You could go up to them and say, "hey let's meet at $local_watering_hole and hang out". You could swap contact info if you didn't already have it.

You could get closure.

Now, one day a bunch of people just stop replying to email. You have a to wait a while to figure out if they are actually gone or just busy. And if you're waiting on them for some output to work on your project, they may just never deliver and you won't know why for a while.

The company directory, if there is one, often still shows them for 60+ days because of the WARN act. And it seems most companies won't make a "layoff list".

It's really hard to get closure if they won't even tell you who got let go, and if they don't give the people a chance to say goodbye by cutting off their access before telling them they are laid off.

Aurornis · 2 years ago
Watching people’s accounts go into deactivated status in Slack with no goodbye is sad.

The most toxic boss I ever worked for would request access to former employee’s Slack accounts under the guise of looking for data to transition their job. Their accounts would periodically go green when he logged in as them. Spooky to see ex-coworker accounts go green and know the boss is scouring their private messages.

I know companies can get slack messages anyway, but seeing your boss do it in real time is extra creepy.

seer · 2 years ago
One company I worked for used to have an unofficial “ex-company” slack setup, where people would get invited to by others that have already left and were in there, it was kinda nice since you form bonds with people and suddenly they’re just gone. You might have not managed to connect with them in any other form. But you login to “ex-company” slack workspace and here they are - everyone that went through the company. I mean lots of people would stop responding after a while, but there was enough time “buffer” to allow people to connect with other means.
kunley · 2 years ago
Fortunately in Europe what the said boss did is illegal and this can end with a criminal prosecution.
economicalidea · 2 years ago
You can’t get private Slack messages easily if you don’t have direct access to the account. There is an audit feature on the Enterprise version that allows it, and you can appeal to slack to open the messages due to a crime or similar - but AFAIK on the normal plans you are out of luck of you want to read private messages as workspace owner.
trumbitta2 · 2 years ago
I think admins don't need to log into an account to see private messages. Was like that at two of my previous jobs.
earthnail · 2 years ago
Wow, that is creepy.
teeray · 2 years ago
> Their accounts would periodically go green when he logged in as them.

The new dystopia will be when an LLM steps in to reply like them.

washadjeffmad · 2 years ago
We tried at first, but we were so overwhelmed by the rate of deaths from the earliest moments of the pandemic that the org couldn't keep reporting them. It was a demoralizing effort for HR to try to put something, even a few words together for everyone, and it's left a lasting pallor where vibrant personal touches once were. People continue to vanish, and there's still no notice that, or how, they've moved on.

Our General Counsel and I met for the last time during the early months of the pandemic. Like most people during the shutdown, he hadn't seen anyone outside his immediate family or had a chance to tell a good story in a few months, which would have eventually killed him, anyway, and I got an earful as he unloaded all the work he was wrapping up. After, as lawyers excel at, he wrote a great letter to our CIO about it that led to probably my favorite exchange between us.

Six months later, someone called me to say they were headed to Legal because someone had died, and I was struck by an immediate sense of dread. I searched our website for any word, then our directory, and then for local obits and found nothing. Even the grapevine was silent, so I called his admin who pretty casually told me our GC had died six weeks prior.

Almost a year to the day later, the mechanisms caught up, and the org put out a "Remembering $generalCounselor". By then, we'd missed his funeral, his family had relocated, and many felt awkward trying to send condolences so late. Watching other's surprise, shame, and sadness wasn't reassuring, even if it told me I wasn't the only one.

We're not small, but we're personal, and each death has left a little void that we collectively haven't acknowledged or addressed. We still don't have a way to handle the losses and haven't talked about it. Having old saved contacts pop up after their extensions are reassigned is inevitably like a call from the grave. I try to keep in touch to keep track, but little by little, the connections are fading, and the memory and history of us with them.

michaelcampbell · 2 years ago
> rate of deaths from the earliest moments of the pandemic that the org couldn't keep reporting them

Truly sorry for your collective loss, but where/what industry did you work in where this was a significant number?

silisili · 2 years ago
It's one thing I miss from the work from office lifestyle - the more human connections. People stopping by your desk to chat about life, the joking - I'd never laughed so hard in my life. Closer connections in general, and being sad when people left, but happy when they were for greener pastures.

WFH feels so sterile and impersonal in comparison.

I've been WFH since 2015 or so, so this isn't a RTO endorsement, just reminiscing.

ZaoLahma · 2 years ago
This really highly depends on the people that you work with.

At a previous employment (a 100% WFH position) I had most of my colleagues in India, roughly 4 time zones away from my own so we almost never met in person, and we'd have personal chit chat sessions while working.

Then I've worked with people who weren't present even when you were sitting right next to them. They'd come into the office, say "morning", put on their noise cancelling head phones and be gone for the rest of the day (modern open space office life in a nut shell).

mynameisbob22 · 2 years ago
Until the pandemic, we would regularly eat lunch together somewhere. For years, this was a standard routine in my life. It was a perfect way to get a feeling what others were doing, what the problems were, how the general mood in the team was, what was going on in their lives. I invited everyone to my wedding during lunch. I told them I was becoming a father during lunch. 2 people told us they were leaving during lunch.

In the beginning of the pandemic, we even switched to cooking at the office kitchen. Now there are only 2 people left on the floor, and eating lunch has stopped completely. Most of my colleagues I only see 1 or 2 times a year (Christmas party and work stuff that requires physical attention).

I noticed that it is much harder now for people to integrate when they are new. There is no real forum left for beginners to ask dumb questions they would rather not see in some chat log.

jedberg · 2 years ago
I miss that too. Some of my best friends are former co-workers. Especially from when I was younger and we spent nearly every waking hour together either at work or at a bar after work.

I don't miss it enough to want to go back to an office though!

romanovcode · 2 years ago
As someone who has enough social interactions and friendships outside of work I am very happy with this attitude. My co-workers are not my friends and I'd like to keep it that way.

Indeed nowadays I have seen many articles publishing that it is even more prominent idea with Zoomers entering workforce and have a clear boundary between co-workers and personal outside-work friends. The companies actually do not like this because this means that those people have literally 0 loyalty to the company and only care for the money. Which is shocking, I know. \s

kristopolous · 2 years ago
The lockout always struck me as dumb and I didn't do it as a manager.

If I trusted them for the 3 years they worked for me, I can trust them for another week or two.

Tie up loose ends, take your time. We're all adults here.

I understand that under the worst circumstances bad things can happen but that's always the case.

at-fates-hands · 2 years ago
I worked at a large web dev company and for years they had this attitude.

Then one designer put in his two weeks and spent the majority of the time downloading all the site files for all of the sites the company had built over the two years he was there. We're talking hundreds of static sites where he took the all the design docs and static HTML/CSS/JS files one would need to recreate them somewhere else.

Instead of going after the guy legally, they passed and then instituted the same policy. You put in your two weeks? Nah, you're out the moment you hit send on that email. Manager alerts security, who then come over to your desk. You get your jacket and whatever you walked in with and get walked out. The one designer totally ruined the company from ever letting someone stay for their two weeks.

Dead Comment

namdnay · 2 years ago
This may be the only time I ever say this, but thank god for LinkedIn. At least you know you can always catch up with someone who has left
jedberg · 2 years ago
Assuming they have LinkedIn and you bothered to connect while they still worked with you. :)
jiehong · 2 years ago
In the company I knew, it’s usual for people to send an email telling others “hey, it’s my last day, thanks for all the memories. Here is my contact info if you want to.”

Others colleagues would also usually organise a virtual envelope with money inside to wish you farewell.

brnt · 2 years ago
We had biweekly team videocalls, so I just announced my last week in my last call.

I find it hard to imagine you have no such contact at all, or that you would say nothing in those meets. You are planning work every now and then, aren't you?

ZaoLahma · 2 years ago
In a large enough company, the experience will be exactly the same even if you do go to the office. It might take weeks or months before you have a reason to reach out and finally realize that you haven't seen someone around for quite a while. And "large enough" is surprisingly small.

For close colleagues leaving, WFH makes absolutely no difference though. Those you keep track of regardless.

ThrowawayR2 · 2 years ago
I regret to have had a recent opportunity to notice that MS Teams shows an empty status icon for deleted/disabled accounts. Their documentation describes it as "status unknown": https://learn.microsoft.com/en-us/microsoftteams/presence-ad...
01HNNWZ0MV43FF · 2 years ago
My family's chat server still shows "Offline" for the account of a deceased relative. Like yeah... they're pretty well offline.
picadores · 2 years ago
The user was disappeared
purrcat259 · 2 years ago
Yeah I actually asked for a few weeks ago when we experienced 10% cuts and I was told they won't share one because of privacy reasons...

But we were seeing the list of deactivated slack accounts crop up slowly anyway.

at-fates-hands · 2 years ago
I work at a large corporation. Most of the people have transitioned to WFH now.

At least five times I can say I had no idea someone had been laid off or sacked until weeks later. I just assumed they were on PTO or something, and then in the middle of a meeting, I'd say something like, "Yeah, where's James been, I haven't seen him online for a few weeks now." Then the manager would chime in and say they got laid off or let go several weeks ago and they were waiting to announce it to everybody.

Twice my director had a meeting with the team and forgot to include myself and two other devs to announce someone had been let go - which is scary AF when we're all on Teams wondering why they just randomly left us off the meeting, which then made us all paranoid AF for a few weeks.

The whole process with laying people off or people getting sacked has just been handled in such a ham handed way, it doesn't inspire confidence at all, and people are constantly looking over their shoulder when a team loses people and have to pick up the slack immediately.

wil421 · 2 years ago
Office layoffs are weird too. A friend worked for Oculus. One day they went to lunch and the manager muttered something quietly about the whole team being laid off then ran off. A team of like 10-15 people had to stand outside and wait for security to bring out their stuff. Sounds pretty awkward.

Another large company I worked for sent out random meeting with the CIO, if you got the meeting you were laid off. At least the CIO did it himself.

neilv · 2 years ago
I've seen a company during WFH let a laid off employee (who asked) keep their access for an hour, to post a goodbye message.

It's not good practice for all situations -- you need some trust, despite the stressful situation, when people tend to show character and weaknesses -- but in this case, it worked out.

The departing employee posted a message of encouragement to the remaining people.

Kind words and contact info were exchanged, etc.

eru · 2 years ago
You can get nearly the same result with less trust: let the employee draft a goodbye message and have the boss (or so) forward that to the other employees.
scarface_74 · 2 years ago
Surprisingly enough, as toxic as Amazon is, after I got Amazoned and made my choice to “leave Amazon and get a nice severance” instead of “try to work through the PIP and still get fired and only get a third of the severance amount”, they let me stay for a week to finish up a customer project. I worked in Professional Services.

I told them that I really wanted to finish the work for a customer (large state organization) because I liked the customer. They let me stay for a week.

Of course that was bullshit, I took the time to have back channel communications with the customer to see if they would hire me as an independent consultant after I left and to start interviewing.

I’m sure they would have. But I gor a full time offer less than two weeks later.

timeagain · 2 years ago
IMO their slack avatar/posts go gray within minutes of them being sacked.
jedberg · 2 years ago
At Amazon, when someone was laid off their Slack still worked for the 60 day WARN period. It was actually a problem because you would Slack them and get mad that they didn't reply. The only way to know for sure was to ask their manager, but you didn't want to do that because if they weren't laid off you didn't want to throw them under the bus!
sharkweek · 2 years ago
My org had a big cut last year but nobody would tell us how many people were laid off for some reason.

I happened to remember the total number of people who were in our org’s giant slack channel before the layoffs and thus was able to do some hardcore detective work subtracting the new number of people in the channel from the previous amount to get the answer…

Hamuko · 2 years ago
Yeah, whenever I want to find out if someone still works at the company, I just search them on Slack. If it has "(deactivated)" after their name, they're no longer employed here.
elgenie · 2 years ago
The attributes that would let one reliably eyeball a person who got fired doing their walk of shame also made for a soul-sucking workplace.

That "back in the day" algorithm required an office that emphasized butt-in-seat, lacked flexible working hours, and lacked both personal offices and multiple exit points.

bsimpson · 2 years ago
During layoffs session last year, the company I work for immediately removed people from the corporate directory, and then went to the guy who had made the unofficial facebook and made him hide them in his tool too. They still technically worked there during the WARN period, so they didn't have epitaphs either. That went over about at well as you'd expect.

This time around, the laid off people show up as on vacation. If you see a team of people all on PTO until the end of May, you can presume that team is donezo.

scarface_74 · 2 years ago
I worked at AWS in the Professional Services department and people got cutoff in the middle of customer conference calls during the first round of layoffs and then found out about their layoffs.
saagarjha · 2 years ago
The infuriating part is when they spin this as some sort of employee privacy move, as if the employee (now ex-employee? But not really, because of WARN) has no input in that decision.
_the_inflator · 2 years ago
The email sentiment is both true and somewhat strange.

Simply shut down, just like a service or API that got deprecated. It is a weird experience, if you happen to know these leaving people only by email.

hiremelocally · 2 years ago
This is just a natural consequence of WFH. Communications are work tasks are so isolated and transactional, there's no reason termination would be any different.
7thaccount · 2 years ago
I had an old boss with a Powershell script that auto-ran each morning and did a diff with the employee list in Outlook or something (can't remember what)to see who got terminated or left. I think it was the only sure fire way to know.
orangevelcro · 2 years ago
Also the language everyone uses to tip toe around saying people got laid off. Some employees 'were affected' or were 'part of the RIF' or whatever other acronym is currently popular.
Mountain_Skies · 2 years ago
On the first project where I was team lead one of my team members was laid off and nobody told me. I worked with her on Thursday, took a PTO on Friday, and on Monday around noon noticed she hadn't been in at all. I asked the guy who sat in the space next to her, and he told me she had been laid off on Friday. I had no idea there had been any layoffs as there wasn't an email sent out like in earlier rounds. Turned out she was the only person laid off. Really weird way of handling things.
saagarjha · 2 years ago
After going through my first layoff (not affected personally, I just saw people who were), I just started posting my personal contact information preemptively. I've seen others start to do the same. It's kind of depressing but I think it really helps to be able to reach out after the termination is done.
chiefalchemist · 2 years ago
When someone new comes on board, I make it a point to send a LinkedIn connection. While I'm no fan of LinkedIn per se, it's neutral enough that nearly all of those connections are accepted. If necessary, it then becomes a non-company channel for having safe (ish) discussions about the company.
burnerburnson · 2 years ago
I don't understand the secrecy about firing somehow. If I were an employer, I'd want my remaining employees to know that what the fired person did was unacceptable.
bombcar · 2 years ago
Companies very rarely do not want to open themselves to liability so they usually go for the blandest possible description, even laying off and paying unemployment for someone who should be fired for cause.
lazyasciiart · 2 years ago
There’s also Blind, but only if you’re on it before the layoff: you need access to your company email account to create an account.
Angostura · 2 years ago
At least it’s made LinkedIn useful for something
whywhywhywhy · 2 years ago
Was it ever really real anyway if you're just little faces or icons on a video call while you worked together.
javcasas · 2 years ago
I got fired from the office on a Friday evening when more than half the company already logged off.

What is the wonderful closure you get?

Anyway, welcome to the corporate world. It pretends to be personal, but it's business.

jedberg · 2 years ago
I'm sorry you had a bad experience, but most people get laid off Friday morning (it's the most common time).

> Anyway, welcome to the corporate world.

I've been in the corporate world for 27 years, and been through many layoffs (usually as a survivor, sometimes as a victim). The ones during WFH have all been worse.

tonnydourado · 2 years ago
> you saw them walking out the door with a box of their stuff

That's cool, I've never seen anyone that worked in a 90's movie before!

Seriously, though, is that a thing? Was it ever?

Aeolun · 2 years ago
I mean, I have a bunch of personal stuff in the office. On my last day in the office I’ll bring it all home because I need it until that time.

I can imagine myself bringing it all in a handy box if I were suddenly fired (which is impossible in my country of residence, but it’s about the idea)

drchickensalad · 2 years ago
...yes? That's why it's in movies
smugglerFlynn · 2 years ago
There are no more people in that process, just “resources” that you “let go”. Welcome to 2024.
htrp · 2 years ago
linkedin ?
simonw · 2 years ago
Love this bit:

"Incidentally, if someone gets mad about you running this sort of thing, you probably don't want to work there anyway. On the other hand, if you're able to build such tools without IT or similar getting "threatened" by it, then you might be somewhere that actually enjoys creating interesting and useful stuff. Treasure such places. They don't tend to last."

jijijijij · 2 years ago
> Incidentally, if someone gets mad about you running this sort of thing, you probably don't want to work there anyway.

If you do want to work there, though, maybe check the legal situation first...

I am almost certain, this counts as unauthorized processing of personal information. Just because you have access doesn't mean it's fair game to do whatever you like with it. Especially archiving, keeping a history or linking (external) data is not the intended use for such an interface. If you take the information home with you, e.g. on your work laptop, that may be a whole nother can of worms. May even count as business secrets you're exfiltrating.

At least in Europe, abusing such an interface likely would be illegal, certainly if you keep a copy/diff. Your employer may have to act against you, or become liable. Or they may use this misconduct later to conveniently terminate your contract (lol, especially, if you use your insights as leverage).

I presume the larger the network, the more likely this will get you in trouble. Conversely, collecting the data has little use otherwise.

How about you organize with your colleagues to voluntarily share employment information to gain collective leverage?

notyourwork · 2 years ago
A diff of the directory is abuse? That seems overly aggressive and I don’t see what that prevents.
Symbiote · 2 years ago
I wonder if this counts as personal data. It's a copy of everyone's name, job title and employment dates.

I can certainly see many European businesses would be wary of an employee keeping this list.

brailsafe · 2 years ago
If I read it correctly, they just dumped and diffed their uid, not all of that information.
htrp · 2 years ago
uids are definitely not pii
Traubenfuchs · 2 years ago
In central Europe, we have the complete company organigram in namely, so it can't be that bad.
athoscouto · 2 years ago
Are you referring to GDPR? Does it apply to employees too, or only customers?

Dead Comment

M2Ys4U · 2 years ago
This is definitely processing personal data.

What Rachel is describing is absolutely illegal under the GDPR.

malfist · 2 years ago
Amazon fired a guy that shared an LDAP query to find folks affected by a round of layoffs....after the layoff happened. So it's not like he was leaking information.
refulgentis · 2 years ago
I don't love it at all.

It's over-the-top posturing for posturing's sake.

A way to confirm this is to look for HN comments who posture the same. After the Overton window widening, they forget to hold back, and will openly say what we know: it's an abuse of the system that turns an outmoded address book into a gossip rag, to the surprise of the actual people involved.

Citations:

"First I just cared about which accounts got deactivated. Then I started tracking title changes, last name changes (people getting married), department sizes, company head count over time etc."

"LDAP's full of secrets. And to think that you can get nearly all of it with anonymous access. Team or department mergers before they were announced? Yep, I've caught those. Secret mailing lists for internal projects? Check who's a member and you can ferret out what's going on. Bonus if the list mail address gives some of it away."

"Lots of weird things depend on the LDAP tree being broadly accessible. It's just that it leaks more information than most people think."

"Monitor when and what HR is doing. Detect when users are logging in and out of LDAP."

mickeyp · 2 years ago
LDAP's full of secrets. It's a great way to keep tabs on what's going on in a company. And to think that you can get nearly all of it with anonymous access.

Team or department mergers before they were announced? Yep, I've caught those. Secret mailing lists for internal projects? Check who's a member and you can ferret out what's going on. Bonus if the list mail address gives some of it away.

`ldapsearch' is good if you know your way around LDAP. Apache LDAP Studio is a great UI tool if you just want to explore.

Everyone should know enough about LDAP to build a login service that binds against it for internal apps. You can exploit the groups the sys admins maintain to control permissions in your app. It's very powerful and an easy way to get up an running in no time.

throwawaaarrgh · 2 years ago
I'm still flabbergasted when a company lets me index their entire AD tree as a random (or, holy crap, anonymous) user. Very nice of them, but still.

It's also often the only way to get information that doesn't exist in an Intranet page, like, literally what teams are there in IT, where are their offices, who's somebody's manager, and of course, what distribution lists am I not on that some other user is on that's causing one of us to have issues accessing some internal company portal.

mickeyp · 2 years ago
It has to be public (or at least not too locked down) or things like Address Book in outlook would stop working. Lots of weird things depend on the LDAP tree being broadly accessible. It's just that it leaks more information than most people think.
SheinhardtWigCo · 2 years ago
> Everyone should know enough about LDAP to build a login service that binds against it for internal apps. You can exploit the groups the sys admins maintain to control permissions in your app. It's very powerful and an easy way to get up an running in no time.

Sure, if you want to be the next SolarWinds.

Dead Comment

doix · 2 years ago
It's amazing how many people came to the same idea independently. At my old gig I created "the sackinator" (getting sacked = getting fired). It was a cronjob that dumped the entire AD directory nightly and then a script to diff the output of any two days.

Since the data was dumped, you could always go back and do more analysis. First I just cared about which accounts got deactivated. Then I started tracking title changes, last name changes (people getting married), department sizes, company head count over time etc.

> Incidentally, if someone gets mad about you running this sort of thing, you probably don't want to work there anyway. On the other hand, if you're able to build such tools without IT or similar getting "threatened" by it, then you might be somewhere that actually enjoys creating interesting and useful stuff. Treasure such places. They don't tend to last.

Couldn't agree more.

jjkaczor · 2 years ago
Hahahahaha... So, I um have a very similar script that I manage for 'KTMJ' - it's not to find deactivated users, but to synchronize certain ldap attributes to another system. This organization is large enough (300k+ users) that typically, between the time that the script queries ldap, prepares the synchronization file, then actually performs the synchronization import which validates if each user still exists, there are already several hundred accounts that have been deactivated during that window and reported in an 'error' log file. (The actual synchronization and 'error' log file are outside of my direct control)

Why did I laugh maniacally?

Due to 'budget constraints' my contract is being terminated (they have just been through several rounds of layoffs, I was expecting this), my account will be one of the ones deactivated on the next monthly cycle - prior to that, I will have to handover the processing and expected 'deactivated' users 'error' logging behaviour to my replacements...