Comment On LOGON.EXE

Yes I agree to more porn.

betlit:

errm.... is there some law requirement i don't understand or why do they display that policy every time you log in?

here in the company where I work (Switzerland) every employee signs an agreement (PAPER!) when hired and that's it...

No law, but lots of corporate lawyers and IT heads (aka damn fools) who think putting a bunch of crap on the screen and interfering with your workflow will somehow save everyone from floods, plagues, and locusts. I've tried never logging off, but when IT pushes Microsoft "updates," Windows7 has no qualms about hard-quitting all my apps regardless of unsaved work and forcing reboot. arrrggh

jay:

A couple of years ago I refinanced my house, and of course I had to sign this huge stack of papers. The loan officer was surprised that I actually read all the papers before signing them. She said most people just buzz through and sign them all. Like, wow. The biggest contract most people will ever sign in their lives, involving hundreds of thousands of dollars, and they'll sign it without even reading it?

I share in your amazement.

The last time I closed on a house, we asked for every paper that would be involved at the earliest opportunity. When we got the loan approval, we asked for the contract, etc.

A few days before the closing, my wife called the agent and asked for a complete copy of all the final paperwork to review. They were reluctant to give us that, so she told them "My husband is going to read every page of it. If you want to sit there and watch him read for a couple hours, that's ok with me."

They sent us the paperwork.

Calli Arcale:

There is no law requiring this sort of banner. This is born out of idiocy and concentrating primarily on satisfying the audit without thinking about what the purpose of the audit is. The audit becomes the end to quality, not the means.

Your comments about audits rings very true. However.....

The reason for the "Go to Jail Banner" on systems is simple. Back in the day when a system out of the box said

Welcome to node MaxWTF01, Please login
Username:

Some little punk got away with hacking a machine. He said, "But it said Welcome, how was I to know that was a private system?"

The end result is it is the same as a no trespassing sign. It will not keep away someone out to get you. It keeps them from claiming they didn't know they were on non-public property.

TFA:

Each time a user logged on, the DLLs were replaced. The plant management software depended on some of those DLLs- but expected a newer version than the versions corporate IT was deploying with each login.

Nah, gotta be fake. There are no industrial automation systems running on anything newer than XP, with most of them being a mix of OS/2, Win98, NT4, and 2000. No way they could be using newer versions of the DLLs.

Steve The Cynic:

And no, it isn't any harder to fire a CFO for gross misconduct than any other employee, especially in the country between Mexico and Canada. (It's more embarrassing, perhaps, but not more difficult.)

Mark Hurd is currently the ur-example of the fact that executives aren't immune to firing.

In many states you are allowed to sign the mortgage document and then backout up to 24-48 hours after signing for precisely this reason.

Oh THAT Brian:

We were waiting for the show when he got back - absolutely nothing happened! Not even a "Sorry about that" email.

He must have had some REALLY GOOD compromising pictures of someone!!

Management memories are short, unless they really have it in for someone. By the next day, they were already distracted by other fires. By the next week, most people probably wouldn't have noticed if he never returned. By the time he did, he probably got a "hey, don't do that again, ok?" if any manager even remembered at all, otherwise it was just his coworkers busting his balls over it.

Nite:

We do it here because it's on the list of things that the auditors (federal and state) want to see when they check us annually, and if it's not there we get dinged in the report and have to explain to the board of directors why we don't have it.

"It's a pointless waste of time" < "The Feds say do it"

At least where I work we can get away with just doing it every year at the start of the school year and that satisfies the auditors.

LonesomeProgrammer:

The real problem is the rediculous attitude of the CFO and the company buying his crap.

Because CFO had no way of rejecting a policy that is even against the law (sexual harrassment), he seems to be under the assumption that he has the right to violate it.

Interesting. I have never explicitly accepted the fact that it is against the law to murder anyone, therefore the next time I will murder anyone the Police ought to give me a sheet with "No more murdering. Accept/Reject?" and set me free in case I Accept or keep me in jail if I decide to Reject.

America: the place where the rule book reigns over common sense at all times.

There's a big difference between law and policy. It's probably not against the law to download porn onto corporate machines, but it's damned sure against the law.


I've worked on a system similar to this before, and I can tell you there's definitely a valid reason behind requiring EXPLICIT acceptance (a clear option to not accept the policy) instead of just IMPLICIT acceptance. It removes plausible deniability.


Also, not knowing something is wrong or against the law is in fact a valid defense, however not knowing that murder is wrong or against the law requires you to be found criminally insane.

Note that it being a legal defense doesn't mean you'll get away with it, but it does mean you COULD get away with it. Which is the point -- remove as much doubt as possible.

cellocgw:

betlit:

errm.... is there some law requirement i don't understand or why do they display that policy every time you log in?

here in the company where I work (Switzerland) every employee signs an agreement (PAPER!) when hired and that's it...

No law, but lots of corporate lawyers and IT heads (aka damn fools) who think putting a bunch of crap on the screen and interfering with your workflow will somehow save everyone from floods, plagues, and locusts.

The level of irony here is amazing if you think that's the purpose.

It's no different than miranda rights. It's not going to stop you from doing anything, it's just going to deny you the ability to say you didn't know you could/couldn't do it. And how many times do we hear of people getting off because they weren't read their miranda rights?

AN AMAZING CODER:

LonesomeProgrammer:

The real problem is the rediculous attitude of the CFO and the company buying his crap.

Because CFO had no way of rejecting a policy that is even against the law (sexual harrassment), he seems to be under the assumption that he has the right to violate it.

Interesting. I have never explicitly accepted the fact that it is against the law to murder anyone, therefore the next time I will murder anyone the Police ought to give me a sheet with "No more murdering. Accept/Reject?" and set me free in case I Accept or keep me in jail if I decide to Reject.

America: the place where the rule book reigns over common sense at all times.

There's a big difference between law and policy. It's probably not against the law to download porn onto corporate machines, but it's damned sure against the law.


I've worked on a system similar to this before, and I can tell you there's definitely a valid reason behind requiring EXPLICIT acceptance (a clear option to not accept the policy) instead of just IMPLICIT acceptance. It removes plausible deniability.


Also, not knowing something is wrong or against the law is in fact a valid defense, however not knowing that murder is wrong or against the law requires you to be found criminally insane.

Note that it being a legal defense doesn't mean you'll get away with it, but it does mean you COULD get away with it. Which is the point -- remove as much doubt as possible.

I can't tell if you just don't know the difference between "law" and "policy", if you're trolling, or if you really screwed up while writing your rant.

My impression is that the "AMAZING" in your name is pretty much similar to the "INCREDIBLE" in Paula Beans case.

EvilCodeMonkey:

I can't tell if you just don't know the difference between "law" and "policy", if you're trolling, or if you really screwed up while writing your rant.

My impression is that the "AMAZING" in your name is pretty much similar to the "INCREDIBLE" in Paula Beans case.

I hit send, then checked my post for trollisms and said NOOOOOOOOOOOOOOO! When I saw the aforementioned mistake :-(


OKAY :-(

The real WTF is that they needed DLL's (in system32!) to show a dialog with some text and two buttons

AN AMAZING CODER:

EvilCodeMonkey:

I can't tell if you just don't know the difference between "law" and "policy", if you're trolling, or if you really screwed up while writing your rant.

My impression is that the "AMAZING" in your name is pretty much similar to the "INCREDIBLE" in Paula Beans case.

I hit send, then checked my post for trollisms and said NOOOOOOOOOOOOOOO! When I saw the aforementioned mistake :-(


OKAY :-(

Muphry's Law, don't sweat it.

Nappy:

The real WTF is that they needed DLL's (in system32!) to show a dialog with some text and two buttons

It is completely possible if you implement your solution in VB5 or VB6.

Then again...

LonesomeProgrammer:

...therefore the next time I will murder anyone the Police ought to...

the NEXT time ?

monkeyPushButton:

At least where I work we can get away with just doing it every year at the start of the school year and that satisfies the auditors.

This reminds me of an anecdote about a village schoolmaster in England. Every year he dutifully filled out the standard form to send to the head office (Education Ministry?), which included a blank for the size of his schoolroom.
One year he decided not to fill in that blank, since they already knew the size from previous reports.
No go. The form was returned with the command that he fill it out completely.
So he did -- but with a size that was twice the actual number. He waited for them to catch the discrepancy and give him flak about it, but nothing happened; it was accepted.
In the next several years he doubled the size again, and again, and again, until the schoolroom (appeared to be) as big as St. Paul's Cathedral. No negative response from headquarters.
The next year, he reduced the s1ze to about 2 square meters. No negative response.
By then he had demonstrated that no person needed the information on the form; only the system did....

Silverhill:

monkeyPushButton:

At least where I work we can get away with just doing it every year at the start of the school year and that satisfies the auditors.

This reminds me of an anecdote about a village schoolmaster in England. Every year he dutifully filled out the standard form to send to the head office (Education Ministry?), which included a blank for the size of his schoolroom.
One year he decided not to fill in that blank, since they already knew the size from previous reports.
No go. The form was returned with the command that he fill it out completely.
So he did -- but with a size that was twice the actual number. He waited for them to catch the discrepancy and give him flak about it, but nothing happened; it was accepted.
In the next several years he doubled the size again, and again, and again, until the schoolroom appeared to be as big as St. Paul's Cathedral. No negative response from headquarters.
The next year, he reduced the size to about 2 square meters. No negative response.
By then he had demonstrated that no person needed the information on the form; only the system did....

I can see that ok. If they reject it then they don't need a computer because they won't work on it so reboot for the next employee that will accept the policy.

matthewr81:

When you live in a world of black and white, you will lose when the roulette ball hits green.

Or, indeed, red

WC:

A company gets to tell me just one time that my saving their arse was the wrong move. After that, I follow policy, even if it destroys the company.

Luckily, most companies aren't stupid enough to berate someone that saved them tons of money. And shutting the plant down for the weekend? That's expensive.

I have worked a LOT of places where arbitrary adherence to policy is far more important than keeping the lights on....

It's a lose-lose situation - if you do nothing and let it crash and burn then it's your fault because you're the techo who should be able to wave a magick wand (TM). If you fix the issue everyone jumps up and down about how there was no adherence to policy or procedure. I remember a (reasonably critical) system having some major issues, and the people I worked with insisted on 5 revisions of a document that explained to a third party contractor how to copy the files we had modified onto the production server. Apparently this particular TLA's technical experts need (simple) unix commands spelled out to them to guarantee that they execute them properly....

"All this because someone was caught with his pants on his ankles" ... and didn't know he was not supposed to?
And management says "Well, he wouldn't have if he knew he agreed not to, so just let him say he wants to so he disagrees with company policy." ?!?

TRWTF is not the technical issue (though that in itself is a bit funny). It's just that management decided to change the way the policies were displayed so people could actually reject them. What do they do then, spend their days looking at a rebooting computer?

Company policies is supposed something you agree to when you join (either that or you don't join). You sign a paper and agree not to do bad things. Being reminded of this on your computer is useless in my opinion, but it's not anything you should have the option to reject.

Steve The Cynic:

And no, it isn't any harder to fire a CFO for gross misconduct than any other employee, especially in the country between Mexico and Canada. (It's more embarrassing, perhaps, but not more difficult.)

I don't know that there's anything special about whichever country you're talking about, but the tricky part in removing senior staff tends to come when you try to find people to replace them.

If the damage to your company's reputation from whatever the CFO did isn't that great, it may not be worth the hassle.

WC:

Luckily, most companies aren't stupid enough to berate someone that saved them tons of money. And shutting the plant down for the weekend? That's expensive.

In this story, there were two people who were both willing and able to prevent the factory from being closed down all weekend.

foxyshadis:

TFA:

Each time a user logged on, the DLLs were replaced. The plant management software depended on some of those DLLs- but expected a newer version than the versions corporate IT was deploying with each login.

Nah, gotta be fake. There are no industrial automation systems running on anything newer than XP, with most of them being a mix of OS/2, Win98, NT4, and 2000. No way they could be using newer versions of the DLLs.

The events in the article gave me the impression that the client machines were running Windows 95 or 98, where it was common for random programs (or non-random ones) to overwrite system DLLs with older versions or wrong language versions etc.

Some industrial machines used to run on MS-DOS, and some of those systems could be jammed in with those hideous versions of Windows without the amount of rewriting they would need for the NT series. (This doesn't excuse the existence of those hideous versions of Windows. Anyone who needed MS-DOS should have stayed with MS-DOS.)

Oh THAT Brian:

We only lost about half the day.

We were waiting for the show when he got back - absolutely nothing happened! Not even a "Sorry about that" email.

He must have had some REALLY GOOD compromising pictures of someone!!

He had screenshots of the CFO's monitor.

Remy Porter:

<!-- Have you tried turning it on and off again? -->

You're right, that's a better way to do it than the IT Crowd's version. If we turn it on and see Vista boot, we should turn it off again, immediately. There's no need to run LOGON.EXE when the system is already corrupt.

Still happens today. One has to wonder about the purpose of the rules, when following them to the letter brings the company to its knees.

AN AMAZING CODER:

I've worked on a system similar to this before, and I can tell you there's definitely a valid reason behind requiring EXPLICIT acceptance (a clear option to not accept the policy) instead of just IMPLICIT acceptance. It removes plausible deniability.

"I didn't know I wasn't allowed to use company resources to download porn for my own amusement."

Pretty broad notion of what is plausible, there.

Smug Unix User:

Oops did the network cable get unplugged? Let me plug it back in after the script finishes. Great now I can replace LOGON.EXE with notepad.exe problem solved.

If it's properly enforced security policy, it'd mean most user are not member of local administrators group and you can't replace LOGON.EXE with anything.

(Domain policy files always execute under domain admin context)

Here in Germany it is called "Dienst nach Vorschrift"

jay:

WC:

A company gets to tell me just one time that my saving their arse was the wrong move. After that, I follow policy, even if it destroys the company.

Luckily, most companies aren't stupid enough to berate someone that saved them tons of money. And shutting the plant down for the weekend? That's expensive.

I had a prof in college who had previously worked for British Rail. He said that the union there -- and I don't know if this was that particular union's idea or something many of them do, I've never heard of it elsewhere, whatever -- he said the union there had a negotiating tactic they used when things got nasty that they called "to rule". When the company wouldn't agree to the union's demands, the union would retaliate by following ALL company policies to the letter. They would assign someone to go through the company's policy book looking for the dumbest, most counter-productive rules, and then they would insist on following them. Until management gave in.

It's particularly effective when the union members normally do extra stuff beyond the rules say they have to. Like teachers helping out keeping order in the school dining hall at lunch time. I went to school in the UK in the 1970s (and the US in the early 1980s, but that's another story), and the NUT's[*] extensive bouts of work-to-rule action meant that we had to bring in packed lunches from home two weeks out of three some years.

[*] NUT = National Union of Teachers. It has a singularly appropriate abbreviation, given that it has historically been dominated by the Loony Left.

I had to do this once for an assessment at TAFE. For some reason the GPO for this didn't work. So I made a cheap little visual basic script that had a small warning and an "Ok" and "Cancel" button.

Ok just caused the program to exit, Cancel ran shutdown /l /t 0
I don't see why these people couldn't have just done it in visual basic rather than having libraries etc. downloaded.

Steve The Cynic:

I went to school in the UK in the 1970s (and the US in the early 1980s, but that's another story), and the NUT's[*] extensive bouts of work-to-rule action meant that we had to bring in packed lunches from home two weeks out of three some years.

I went to school in the UK in the 1970s too, and I dont remember anything like that. Perhaps you lived in a really shitty area. Up north somewhere?

PiisAWheeL:

There's no place like ROOT# because I am the king of my castle!

Are you perhaps thinking of root#? (Remember Unix is case-sensitive.)

jay:

WC:

A company gets to tell me just one time that my saving their arse was the wrong move. After that, I follow policy, even if it destroys the company.

Luckily, most companies aren't stupid enough to berate someone that saved them tons of money. And shutting the plant down for the weekend? That's expensive.

I had a prof in college who had previously worked for British Rail. He said that the union there -- and I don't know if this was that particular union's idea or something many of them do, I've never heard of it elsewhere, whatever -- he said the union there had a negotiating tactic they used when things got nasty that they called "to rule". When the company wouldn't agree to the union's demands, the union would retaliate by following ALL company policies to the letter. They would assign someone to go through the company's policy book looking for the dumbest, most counter-productive rules, and then they would insist on following them. Until management gave in.

I've heard that referred to as a White Rebellion, as in, you're clearly in open rebellion, but you don't do anything "black" (obviously against the rules) or even anything that's a gray area; you stay completely within the "white" area of the rules, and use the rules against the boss.

Mark S.:

jay:

A couple of years ago I refinanced my house, and of course I had to sign this huge stack of papers. The loan officer was surprised that I actually read all the papers before signing them. She said most people just buzz through and sign them all. Like, wow. The biggest contract most people will ever sign in their lives, involving hundreds of thousands of dollars, and they'll sign it without even reading it?

I share in your amazement.

The last time I closed on a house, we asked for every paper that would be involved at the earliest opportunity. When we got the loan approval, we asked for the contract, etc.

A few days before the closing, my wife called the agent and asked for a complete copy of all the final paperwork to review. They were reluctant to give us that, so she told them "My husband is going to read every page of it. If you want to sit there and watch him read for a couple hours, that's ok with me."

They sent us the paperwork.

We didn't read it for ours. But that's because it's all in legalese, and the best person to read it and go over the documents and loan agreements was... a lawyer. So we had our lawyer go over the documents for us. Even the mortgage - there were some terms she had to find to ensure we had the right one. The lawyer arranged for all the site surveys and everything as well, plus checking with the title office, etc.

Yes, you can do it without using a lawyer, but if you've got one, the loan agreement is easily another document for review.

Brayden:

Ok just caused the program to exit, Cancel ran shutdown /l /t 0
I don't see why these people couldn't have just done it in visual basic rather than having libraries etc. downloaded.

Doing it in Visual Basic requires having libraries etc. downloaded.

hehe yes this is used by motormen (Train drivers) in mumbai. They call it work-to-rule agitation. This entails running the train to the slowest possible speed allowed by rule. Result is mega bottleneck train traffic and general frustration of travellers.

BlueBearr:

TRWTF is that the solution should have been to update the standard warning message to contain this sentence at the end:

By clicking OK and logging into this system, you indicate that you agree to and will abide by these policies. If you do not agree, do not log onto this system.

That's what I was thinking!
"But I didn't know I was agreeing to it!"
"well, it says it right there..."

>> is there some law requirement i don't understand ..

No, there's not. You understand everything just fine.

IT admins over here tend to go overboard with warnings etc that are properly handled by the HR department's paperwork.

foxyshadis:

TFA:

Each time a user logged on, the DLLs were replaced. The plant management software depended on some of those DLLs- but expected a newer version than the versions corporate IT was deploying with each login.

Nah, gotta be fake. There are no industrial automation systems running on anything newer than XP, with most of them being a mix of OS/2, Win98, NT4, and 2000. No way they could be using newer versions of the DLLs.

Steve The Cynic:

And no, it isn't any harder to fire a CFO for gross misconduct than any other employee, especially in the country between Mexico and Canada. (It's more embarrassing, perhaps, but not more difficult.)

Mark Hurd is currently the ur-example of the fact that executives aren't immune to firing.

Perhps they didn't have $50 million to give him when they "fired" him.

thanks for the trick - last refi, they wouldn't send us stuff, took an hour and a half

I have read, that in Britain, there are Gov't documents that need to be signed by people who don't have security clearance to read the documnet; you sign with your eyes averted, so you don't read the top secret stuff.

PS: our first close, I"m reading away and it says, title to this property is subject to a lien from Mrs...blah blah

so I asy, whoa !!
and all the lawyers and RE people look at me with that, christ, another newby expression on their faces, and one of the lawyers says, thats from 1923 , we can all initial it and move on...

I think the point is, that for us, we do this a couple of times in our lives, but for all the other people in the room, they do this weekly or more often, its no biggie, although one of my friends, a lawyer, says he has seen documents with the numbers wrong, so it does pay to check

here in the US, working to rule is a pretty common tactic
google
"union slowdown "working to rule""
and you will get a lot of hits

WC:

most companies aren't stupid enough to berate someone that saved them tons of money.

You have not had much work experience, have you?

Don't expect to get an MBA with your approach! People that save the company money are obviously clever, and represent a risk to their superiors. They are normally sacked first.

here in the company where I work (Switzerland) every employee signs an agreement (PAPER!) when hired and that's it...

But that's so.. NON-green! <shudder>

Fred:

If the user clicked “Reject”, the program also quit- after sending a shutdown /r /t 0 to the command line, forcing the computer to reboot.

... aaaaand after rebooting, what then? Why, another login and another appearance of the same dialog. In other words, an infinite loop. Why not simplify things a bit by ignoring the clicks on Reject?

For one thing, people who aren't good with computers need some sort of visible reaction to their action of clicking the button. Otherwise they'll assume they are free to click on the other button now because they clicked on the "reject" one first, and it would all go back to the original "ok" message.