Lea Kissner Profile picture
Feb 15 ā€¢ 8 tweets ā€¢ 3 min read
I mentioned the Bad News Hat at #enigma2022 and promised to tell the story when I had a few minutes.

This is the hat I pull out when I have to tell people something they won't like. I do it because earlier in my career a group of people literally cringed when they saw me. šŸ§µ A dusty black hat with a spray of colorful feathers stuck in
Back in the day, I worked with a particular team who had what I called "incident season" which came right after... well, as far as I could tell, "bad decision season". They weren't all bad, but under pressure to launch this team launched some things which weren't solid. /2
I had to walk over and tell that team they had an incident which they needed to drop everything and fix so many times that they started literally flinching when they saw me, even if I wasn't coming to tell them anything bad!

This isn't great for a working relationship. /3
When I moved on to @humuinc, one of the first things I did was rewrite the incident handling procedures. I remembered how I was flinched at and didn't want to do that again.

So I wrote a hat into the incident procedures, so the incident commander wore a hat. /4
Something magic happened: the whole company flinched at the hat instead! Seriously, people were scared of the hat, but could separate that from the people wearing it.

Weird psychological hack, but it worked. I suggest something similar for everyone's incident procedures. /5
At @Twitter I don't use the hat for incidents, but I've jokingly pulled it out once or twice when I've needed to tell execs things they're probably not immediately thrilled to hear, as much as we all are aimed towards building great, respectful products and systems. /6
That "I'm sad my plan needs to adjust but I'm really happy you're telling me instead of finding out the hard way" feeling is real -- and one that's a good sign for privacy/security/abuse people to see in colleagues. But the šŸ¤  doesn't hurt, unless they don't think it's funny. /7
Side note about the team which was generating a lot of incidents so many years ago: they had a leadership change and started focusing on code quality and privacy/security. They started shipping really excellent products and code which I happily use. So impressed by them. /end

ā€¢ ā€¢ ā€¢

Missing some Tweet in this thread? You can try to force a refresh
怀

Keep Current with Lea Kissner

Lea Kissner Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @LeaKissner

Feb 2
Bob has clearly not understood the problem.

@senykam at #Enigma2022
"using marginalized groups as branding is a way to seem sincere"
Bob should work with people who actually understand the problem.
Read 18 tweets
Feb 2
Taint flow analysis to ensure data isn't going anywhere it shouldn't, like leaking location in Instagram at #Enigma2022 from Graham Bleaney
... and bug bounty to try to find out about data abuse, like an abuse bounty, including scraping
Read 6 tweets
Feb 1
Dr. Gus Andrews is up next at #enigma2022

It's all just information. They have different teams.
People try fact checking and AI/ML. A lot

But assumes facts and trust are at the center
How to get people on "team science"?

Concept of fact comes from 17th century
Read 22 tweets
Feb 1
@patrickgage is starting off his talk about COVID-19 misinformation with literal šŸ”„
Investigation through public opinion polling
Read 18 tweets
Feb 1
@C_C_Krebs is kicking off #enigma2022 with a look back at the excitement which was the 2020 presidential election. Chris Krebs speaking at #enigma2022
I can't live tweet because I busted my wrist and I'm one-handed but talk is already great.
So I can't manage the alt text here but @ram_ssk is live tweeting for real šŸ˜
Read 6 tweets
Jul 9, 2021
Non-cryptographers should be scared of crypto libraries. I'm not happy with that state (not every company has a friendly local cryptographer! or even an unfriendly one!), but that's sadly the state of things.

A story about my friend @yonatanzunger messing up, then suggestions.šŸ§µ
Yonatan went off to work for @humuinc several years ago (though he's at @Twitter now) and, being a small startup at the time, there were unsurprisingly zero cryptographers.

So one day I get a message from him asking what crypto library he should use, to which I replied "WHY???"
The reason I replied with serious "oh no" in my heart was that people screw up using crypto libraries all the time. So I wanted to know what he wanted to do with said library.

And what he wanted to do was encrypt some data and put it in a cookie so users couldn't mess with it.
Read 14 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

:(