I mentioned the Bad News Hat at #enigma2022 and promised to tell the story when I had a few minutes.
This is the hat I pull out when I have to tell people something they won't like. I do it because earlier in my career a group of people literally cringed when they saw me. š§µ
Back in the day, I worked with a particular team who had what I called "incident season" which came right after... well, as far as I could tell, "bad decision season". They weren't all bad, but under pressure to launch this team launched some things which weren't solid. /2
I had to walk over and tell that team they had an incident which they needed to drop everything and fix so many times that they started literally flinching when they saw me, even if I wasn't coming to tell them anything bad!
This isn't great for a working relationship. /3
When I moved on to @humuinc, one of the first things I did was rewrite the incident handling procedures. I remembered how I was flinched at and didn't want to do that again.
So I wrote a hat into the incident procedures, so the incident commander wore a hat. /4
Something magic happened: the whole company flinched at the hat instead! Seriously, people were scared of the hat, but could separate that from the people wearing it.
Weird psychological hack, but it worked. I suggest something similar for everyone's incident procedures. /5
At @Twitter I don't use the hat for incidents, but I've jokingly pulled it out once or twice when I've needed to tell execs things they're probably not immediately thrilled to hear, as much as we all are aimed towards building great, respectful products and systems. /6
That "I'm sad my plan needs to adjust but I'm really happy you're telling me instead of finding out the hard way" feeling is real -- and one that's a good sign for privacy/security/abuse people to see in colleagues. But the š¤ doesn't hurt, unless they don't think it's funny. /7
Side note about the team which was generating a lot of incidents so many years ago: they had a leadership change and started focusing on code quality and privacy/security. They started shipping really excellent products and code which I happily use. So impressed by them. /end
ā¢ ā¢ ā¢
Missing some Tweet in this thread? You can try to
force a refresh
Non-cryptographers should be scared of crypto libraries. I'm not happy with that state (not every company has a friendly local cryptographer! or even an unfriendly one!), but that's sadly the state of things.
A story about my friend @yonatanzunger messing up, then suggestions.š§µ
Yonatan went off to work for @humuinc several years ago (though he's at @Twitter now) and, being a small startup at the time, there were unsurprisingly zero cryptographers.
So one day I get a message from him asking what crypto library he should use, to which I replied "WHY???"
The reason I replied with serious "oh no" in my heart was that people screw up using crypto libraries all the time. So I wanted to know what he wanted to do with said library.
And what he wanted to do was encrypt some data and put it in a cookie so users couldn't mess with it.