TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Figure out who's leaving the company: dump, diff, repeat

688 点作者 l0b0超过 1 年前

67 条评论

evmar超过 1 年前
I made epitaphs! AMA
评论 #39313435 未加载
评论 #39313067 未加载
评论 #39312529 未加载
评论 #39312293 未加载
评论 #39312190 未加载
评论 #39312378 未加载
simonw超过 1 年前
If you&#x27;re going to run something like this, I thoroughly recommend using Git for it.<p>You can have your cron do something like this:<p><pre><code> curl https:&#x2F;&#x2F;internal.corp&#x2F;employees.txt &gt; employees.txt git add employees.txt git commit -m &quot;Automated: $(date -u)&quot; || exit 0 </code></pre> The || exit 0 should ensure no errors even if there is nothing to commit<p>Now you have a commit history of every change made to that source of information - just run &quot;git log&quot; to view it.<p>I run this kind of thing on scheduled GitHub Actions all the time, see <a href="https:&#x2F;&#x2F;simonwillison.net&#x2F;2020&#x2F;Oct&#x2F;9&#x2F;git-scraping&#x2F;" rel="nofollow">https:&#x2F;&#x2F;simonwillison.net&#x2F;2020&#x2F;Oct&#x2F;9&#x2F;git-scraping&#x2F;</a>
评论 #39311875 未加载
评论 #39311848 未加载
评论 #39311942 未加载
评论 #39311893 未加载
评论 #39311968 未加载
评论 #39311799 未加载
评论 #39329324 未加载
mmsc超过 1 年前
I made a tool to track ldap like that [0]. LDAP is a treasure chest of info and great for stalking. for some reason i find it fascinating to see people leaving, and if possible, see how long they worked there for. seeing friends get fired via LDAP before they even knew about it was certainly interesting, too.<p>I noted in the readme..<p><pre><code> Know what&#x27;s going on in your LDAP directory on-demand with Slack webhook integration. See new hires, leavers, and promotions as they appear in LDAP. Monitor when and what HR is doing. Detect unauthorized changes in LDAP. Monitor for accidentally leaked data. Detect when users are logging in and out of LDAP. </code></pre> There&#x27;s also LDAPmonitor[1] which is designed for Microsoft and Active Directory which does effectively the same thing.<p>[0]<a href="https:&#x2F;&#x2F;github.com&#x2F;MegaManSec&#x2F;LDAP-Monitoring-Watchdog">https:&#x2F;&#x2F;github.com&#x2F;MegaManSec&#x2F;LDAP-Monitoring-Watchdog</a><p>[1]<a href="https:&#x2F;&#x2F;github.com&#x2F;p0dalirius&#x2F;LDAPmonitor">https:&#x2F;&#x2F;github.com&#x2F;p0dalirius&#x2F;LDAPmonitor</a>
jedberg超过 1 年前
Layoffs in the WFH era are weird. Back in the day you had a pretty good idea of who got laid off because you saw them walking out the door with a box of their stuff. You could go up to them and say, &quot;hey let&#x27;s meet at $local_watering_hole and hang out&quot;. You could swap contact info if you didn&#x27;t already have it.<p>You could get closure.<p>Now, one day a bunch of people just stop replying to email. You have a to wait a while to figure out if they are actually gone or just busy. And if you&#x27;re waiting on them for some output to work on <i>your</i> project, they may just never deliver and you won&#x27;t know why for a while.<p>The company directory, if there is one, often still shows them for 60+ days because of the WARN act. And it seems most companies won&#x27;t make a &quot;layoff list&quot;.<p>It&#x27;s really hard to get closure if they won&#x27;t even tell you who got let go, and if they don&#x27;t give the people a chance to say goodbye by cutting off their access before telling them they are laid off.
评论 #39312100 未加载
评论 #39313384 未加载
评论 #39312122 未加载
评论 #39312185 未加载
评论 #39311992 未加载
评论 #39311846 未加载
评论 #39312041 未加载
评论 #39311902 未加载
评论 #39311863 未加载
评论 #39312188 未加载
评论 #39313543 未加载
评论 #39312314 未加载
评论 #39311806 未加载
评论 #39312133 未加载
评论 #39312312 未加载
评论 #39311849 未加载
评论 #39312045 未加载
评论 #39314391 未加载
评论 #39315180 未加载
评论 #39316843 未加载
评论 #39312728 未加载
评论 #39315300 未加载
评论 #39315005 未加载
评论 #39318776 未加载
评论 #39315423 未加载
评论 #39313793 未加载
评论 #39312687 未加载
评论 #39315461 未加载
评论 #39320526 未加载
评论 #39315800 未加载
simonw超过 1 年前
Love this bit:<p>&quot;Incidentally, if someone gets mad about you running this sort of thing, you probably don&#x27;t want to work there anyway. On the other hand, if you&#x27;re able to build such tools without IT or similar getting &quot;threatened&quot; by it, then you might be somewhere that actually enjoys creating interesting and useful stuff. Treasure such places. They don&#x27;t tend to last.&quot;
评论 #39314471 未加载
评论 #39312177 未加载
评论 #39315390 未加载
评论 #39316713 未加载
mickeyp超过 1 年前
LDAP&#x27;s full of secrets. It&#x27;s a great way to keep tabs on what&#x27;s going on in a company. And to think that you can get nearly all of it with anonymous access.<p>Team or department mergers before they were announced? Yep, I&#x27;ve caught those. Secret mailing lists for internal projects? Check who&#x27;s a member and you can ferret out what&#x27;s going on. Bonus if the list mail address gives some of it away.<p>`ldapsearch&#x27; is good if you know your way around LDAP. Apache LDAP Studio is a great UI tool if you just want to explore.<p>Everyone should know enough about LDAP to build a login service that binds against it for internal apps. You can exploit the groups the sys admins maintain to control permissions in your app. It&#x27;s very powerful and an easy way to get up an running in no time.
评论 #39311979 未加载
评论 #39313312 未加载
评论 #39312380 未加载
doix超过 1 年前
It&#x27;s amazing how many people came to the same idea independently. At my old gig I created &quot;the sackinator&quot; (getting sacked = getting fired). It was a cronjob that dumped the entire AD directory nightly and then a script to diff the output of any two days.<p>Since the data was dumped, you could always go back and do more analysis. First I just cared about which accounts got deactivated. Then I started tracking title changes, last name changes (people getting married), department sizes, company head count over time etc.<p>&gt; Incidentally, if someone gets mad about you running this sort of thing, you probably don&#x27;t want to work there anyway. On the other hand, if you&#x27;re able to build such tools without IT or similar getting &quot;threatened&quot; by it, then you might be somewhere that actually enjoys creating interesting and useful stuff. Treasure such places. They don&#x27;t tend to last.<p>Couldn&#x27;t agree more.
jjkaczor超过 1 年前
Hahahahaha... So, I um have a very similar script that I manage for &#x27;KTMJ&#x27; - it&#x27;s not to find deactivated users, but to synchronize certain ldap attributes to another system. This organization is large enough (300k+ users) that typically, between the time that the script queries ldap, prepares the synchronization file, then actually performs the synchronization import which validates if each user still exists, there are already several hundred accounts that have been deactivated during that window and reported in an &#x27;error&#x27; log file. (The actual synchronization and &#x27;error&#x27; log file are outside of my direct control)<p>Why did I laugh maniacally?<p>Due to &#x27;budget constraints&#x27; my contract is being terminated (they have just been through several rounds of layoffs, I was expecting this), my account will be one of the ones deactivated on the next monthly cycle - prior to that, I will have to handover the processing and expected &#x27;deactivated&#x27; users &#x27;error&#x27; logging behaviour to my replacements...
heads超过 1 年前
So negative! Where I work this tool is called “new-hires”. It uses a restricted read-only API key to our third-party people tool. It was given to me <i>by our People Director</i>. Sometimes there are lines beginning with - but the tool is named for the lines beginning with +.<p>new-hires is built on top of the “people” python module &#x2F; cli in our monorepo. That tool is so much more useful than just a way of diffing the org chart. Who is in what team, where are they, are they working today, is it time to celebrate their anniversary, etc. It also follows what I coin the “ZFS litmus test” for good CLI tools by providing -pH for parseable, headerless output.<p>Treasure such places indeed.
评论 #39312538 未加载
GIVEDADDYABYTE超过 1 年前
I tried to make one of these systems at my first job, but my manager expressly forbade me after hearing about it.<p>Later that company would go on to lay off 15% of software engineers in a day. The support team created tickets in the public issue tracker to decommission employee accounts, so a lot of people found out that way before anyone reached out for a meeting.
loneranger_11x超过 1 年前
&quot;Treasure such places. They don&#x27;t tend to last.&quot;<p>True true true. Especially if people are building quirky cool stuff in smaller orgs, its simultaneously a great place to work and has a higher extinction probability.
alpb超过 1 年前
The “epitaph” app that was mentioned is an internal Google web site. I always found it to be fascinating.
khalilravanna超过 1 年前
There was an automated tool like this someone built at Twitter. At first it was cool just to see who the most tenured people were. Then the layoffs happened and it became essential due to the absolute 0 communication happening thanks to the Cool New Management. I remember we used the count of people in one of the default Slack channels to keep track of how many people got the axe. Woof.
gpvos超过 1 年前
Is it common in the USA that employees just disappear without getting the chance to say goodbye to their colleagues? At most places I worked, people tended to send a goodbye email to everyone@company and got a chance to say personal goodbyes, even when there was a negative reason for them to leave.
评论 #39314250 未加载
评论 #39313682 未加载
joshstrange超过 1 年前
At my last company they had no system for letting us know if someone had been let go. At one point they laid off the VP of sales and it came up almost by accident in an all-company meeting (not a massive company, &lt;100 but &gt;50) and people were surprised he had been let go.<p>I was young, with nothing to lose (or rather just no self-preservation), and so I spoke up that the policy of saying nothing was silly and potentially very dangerous. If that VP, who I saw around regularly, had emailed me for a list of our clients I would have sent it to him, if he had been waiting at a door telling me he had forgot his keycard I would have let him in, etc. You could argue &quot;You should have always asked up the chain before doing that or refused to let him in on your keycard&quot;, but then I&#x27;d just shake my head at you. When a VP tells you to do something it&#x27;s not a great career move to throw up roadblocks, even if it&#x27;s company policy, in my experience.<p>Going forward the company agreed to send out bland, generic &quot;X is no longer with the company&quot; for &quot;legal&quot; reasons (as in they couldn&#x27;t say &quot;was fired&quot;, &quot;left of their own accord&quot;, etc). Which was better for sure. I never thought to scrape our company directory, that&#x27;s a clever way to do that for sure.
eddiezane超过 1 年前
Back when I was at DigitalOcean they were laying off&#x2F;firing people from the company but not announcing any departures. You&#x27;d just go to message someone and their Slack account was deactivated. This was over the course of several weeks. I built a Slack bot to post when accounts got deactivated and learned of some new departures well before those impacted actually did.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;eddiezane&#x2F;no-ghosties">https:&#x2F;&#x2F;github.com&#x2F;eddiezane&#x2F;no-ghosties</a>
评论 #39312769 未加载
0x500x79超过 1 年前
I worked at a company that had an internal website that showed all people, departments, teams, and had a filter you could use for new employees or employees that left. It was sort of a double edged sword: you had enough information to start asking questions about what it meant if a team member or coworker was on the list. What was more interesting is that it almost became ritual for some people to logon first thing in the morning and check the list, every morning.
omgbear超过 1 年前
A former company I was at was really weirdly tight-lipped about people leaving.<p>I&#x27;m sure totally unrelatedly, we got dinged a bunch on our SOC2 reports improper &quot;off-boarding&quot; and not removing access from terminated folks since no one knew to remove them.<p>Once we added quarterly SOC2 controls to make sure only employees had accounts it was always a shock to see who had to be removed.<p>I know the intent was to improve morale, but it had the opposite effect.
评论 #39315409 未加载
评论 #39315530 未加载
KingOfCoders超过 1 年前
In Germany it&#x27;s also a very good idea to monitor the &quot;Handelsregister&quot; (register of all companies) and see who currently is really the CEO, who can sign things etc. This shows early ripples in the force (e.g. founders on their way out, willfully or forced).
xmodem超过 1 年前
At one role our GitHub access was mediated by a CI job that would export users and groups from Google Workspaces and apply them to GitHub. The script would helpfully print a list of actions taken, and we had a general policy of CI logs being world-readable - and this job was no exception.<p>It was a useful way to keep tabs on any skulduggery that was going on.<p>Unrelated, but Confluence has very powerful support for email alerts on changes. These include notifications of deletions, and the email includes the diff of the deleted content. One thing I do at any org that uses confluence heavily is set up notification rules on some interesting spaces and check in from time to time.
Havoc超过 1 年前
Don’t think my employer would take too kindly to attempts to download bulk employee lists
评论 #39312677 未加载
throwawaaarrgh超过 1 年前
There&#x27;s a very common problem with systems that use SSO, where the 3rd parties that accept SSO logins cache the login information, sometimes indefinitely. A user can leave the company but their login placeholder account stays in the 3rd party, and active login sessions are maintained basically indefinitely. So you can leave the company and lose your AD account, but still access the 3rd party. As Rachel says it&#x27;s kind of a hard problem to solve (but not that hard).
评论 #39312254 未加载
评论 #39312078 未加载
randycupertino超过 1 年前
I once worked at a large bureaucratic org that tried to keep it secret when people left (if quit or were fired) because they thought departures were bad for morale. So it was just a big secret. Are they here any more, are they on PTO, are they out sick, who knows! Can&#x27;t talk about it. It caused way more gossip and bad morale than it would have just to be straightforward letting us know that so and so was gone.
tonnydourado超过 1 年前
I&#x27;m not sure I get this.<p>If it&#x27;s in my team&#x2F;department, I&#x27;ll know about it one way or another. If not ... Why would I care? People come and go, and if we&#x27;re friends outside of work, we&#x27;ll have other channels.<p>Besides that, most companies I worked at don&#x27;t even maintain the LDAP&#x2F;whatever properly. I&#x27;ve seen contacts from people that left&#x2F;were fired stay around for years.
评论 #39315112 未加载
评论 #39315722 未加载
marviel超过 1 年前
&gt; Incidentally, if someone gets mad about you running this sort of thing, you probably don&#x27;t want to work there anyway. On the other hand, if you&#x27;re able to build such tools without IT or similar getting &quot;threatened&quot; by it, then you might be somewhere that actually enjoys creating interesting and useful stuff. Treasure such places. They don&#x27;t tend to last.<p>too true
williamDafoe超过 1 年前
Epitaths is a Google thing. I had a friend at Qualcomm who wrote a script to sample the employee phonebook every morning before work so he&#x27;d know if he were laid off. We used &quot;ph&quot; from UIUC and the company strangely laid people off not by deleting them but instead by putting them into department 700, &quot;The laid-off department&quot;.<p>The web UI allowed elaborate queries so the first time there was a big layoff the ph web page almost went down because everyone was querying to find out who was laid off. Management got mad at this but they really shouldn&#x27;t have; its correct that you shouldn&#x27;t work someplace that tries to hide attrition no matter what the source!<p>My friend never got put into dept 700 because i recruited him into Google a few years later ...
tandle超过 1 年前
Speaking from the other side (the side that does the termination), as long as your IT team is actually good a simple ldap diff isn&#x27;t going to be enough.<p>Why? Because a good termination process is sensitive to there needing to be a communication about a termination that can happen well after the actual process of eliminating their access and telling them it&#x27;s their last day.<p>So a better termination process is something like:<p>1. Employee goes to a physical space (preferred) where they don&#x27;t have their work equipment or talk to their manager and&#x2F;or HR using something that isn&#x27;t work controlled (phone call, etc.).<p>2. A manual or scripted process executes that forces sign outs of all work things (computer, slack, google, whatever). Credentials get reset and not disabled. Perhaps someone can try to look for password reset metadata or other things that might indicate a departure, but it&#x27;s a lot harder than looking for disabled uids.<p>3. After the person leaves or has finished their conversation remotely, the team that works with this person gets a broader communication from someone to tell them about the departure. If the company is small enough, maybe there&#x27;s a broader communication to more people.<p>4. The rest of the termination process gets fired off that does disable accounts, etc.<p>Why don&#x27;t all IT departments do this? Well for a lot of reasons:<p>1. They don&#x27;t care, don&#x27;t have incentives, or haven&#x27;t been told by HR, etc. to care about handling the termination process in a more sensitive way.<p>2. For any sufficiently complex company, the number of edges cases of systems where you can&#x27;t force a logout or handle a password reset increase over time. It takes a lot of testing to make sure a process works because vendors have bugs all the time or unintended behavior.<p>3. The risk of poorly communicated terminations increase as the number of people that either perform or can troubleshoot the automated process to terminate increase. As others commented, you don&#x27;t want some ticketing system that is readable by a wide amount of people to see termination requests, so now how do you communicate a termination without too many people knowing about it?<p>Strangely enough, I think trying to achieve the most sensitive but automated process is good because it forces the company to communicate and acknowledge a departure before the full termination process fires off, but maybe I&#x27;m in the minority.
biosboiii超过 1 年前
Did this for a supermarket delivery company, they had an API that exposed their exact stock level for products, scraped the data every 30ish seconds, diffed and repeated :D There were some interesting orders for sure (cigarettes + soap + 1 beer)
mfkp超过 1 年前
Ha, I did this about 10-15 years ago at a prior company. The turnover was so high (especially in the sales staff) that there would be at least a handful of people mysteriously disappearing each week.<p>I automated a small newsletter called &quot;The Weekly Diff&quot; for a few close trusted coworkers and sent it out each Friday with a list of who&#x27;s new and who was missing from the company directory. And I kept a scraped database including phone numbers in case anyone wanted to reach out to anyone after they&#x27;d been removed.<p>Sometimes you make the best out of a failing company culture. Kept a lot of friends that way just by reaching out with some words of support :)
shermantanktop超过 1 年前
I’ve done this multiple times, and have two instances running right now which have been active for years. One is simple and watches a smaller org:<p>ldapsearch … &gt; new; diff old new &gt; updates; mail … &lt; updates<p>(On phone, pseudo code, definitely wrong)<p>The other is perhaps more interesting. I built a tool for a tool for a population of specialists in a large company. The tool requires ldap data synced in, and I capture the diffs. That sampling approach provides surprising insights into what’s active&#x2F;hot&#x2F;declining, even when the total size of the company would making tracking every employee change quite difficult.
MichaelMoser123超过 1 年前
I wrote a script that is looking at the git log of a git repository, it tries to sum up how many commits per author&#x2F;number of lines changed etc, when the author was active. This also gives some indication on the &#x27;turnover rate&#x27; or whatever. (I know lines changed and number of commits is a very bad indication, but it is some indication)<p><a href="https:&#x2F;&#x2F;github.com&#x2F;MoserMichael&#x2F;gittools&#x2F;blob&#x2F;main&#x2F;git-whoiswho.py">https:&#x2F;&#x2F;github.com&#x2F;MoserMichael&#x2F;gittools&#x2F;blob&#x2F;main&#x2F;git-whois...</a>
fredley超过 1 年前
I&#x27;m a WFH worker. My company is fully remote. They are really great at managing departures and make sure everyone&#x27;s aware and has a chance to say goodbye.<p>However I can&#x27;t shake this feeling that the mindset that got us from treating servers like pets to treating them like cattle is creeping into workforce planning, and the WFH movement is making it that much easier.<p>Why plan capacity when you can scale resources up and down on-demand on a whim? With the emotional and morale implications of letting people go hugely reduced it becomes easier to think like that.
评论 #39315078 未加载
SoftTalker超过 1 年前
&gt; Incidentally, if someone gets mad about you running this sort of thing, you probably don&#x27;t want to work there anyway.<p>Well that depends I guess. A lot of companies&#x2F;orgs have privacy policies that prohibit accessing services out of &quot;curiosity.&quot; I.e. if you&#x27;re working at a university it&#x27;s OK to access student information if you&#x27;re doing it for a specific work-authorized purpose but you can&#x27;t go casually looking at people&#x27;s information just to satisfy some personal interest.
rpigab超过 1 年前
This is a very fun thing to do, unfortunately where I work (France), the HR team send out weekly&#x2F;monthly emails with somes HR updates, and at the end the list of everyone who is hired (this includes conctractors), and everyone who leaves (resigned or fired), so it would not add any information to run LDAP searches and dumps&#x2F;diffs.<p>It&#x27;s always kinda stressful to open this email and find out if one colleague you liked has decided to leave, but most times, this colleague informed you before the email arrives.
Lance_ET_Compte超过 1 年前
I did this before. I ran a cron job once a day that counted the number of active entries in a particular file. It was neat to see the number bump up after an acquisition or drop after a layoff. It was neat to see the overall growth of the company I worked for.<p>I eventually decided that someone _might_ decide that, although freely available, in aggregate, this material could be _sensitive_. I stopped doing it. I deleted years of interesting data...
72f988bf超过 1 年前
Scanning, dumping, and diffing of active directory also helps seeing when people got promoted. (&quot;Software Engineer&quot; -&gt; &quot;Software Engineer II&quot; -&gt; &quot;Senior Software Engineer&quot; etc). Useful for figuring out stats on &quot;promotion velocity&quot; in one org vs other.<p>Wouldn&#x27;t work at &quot;a certain company&quot; if such company now made all their levels secret by default of course.
评论 #39312713 未加载
评论 #39311928 未加载
nickm12超过 1 年前
This is funny... I thought I was the only one who did this. I work in an org of over 1000 people and have found doing a programmatic dump of the org chart gives me insights I would never get from reading our status update. Often it is the only way I learn about colleagues who have left (and returned!) because not everyone sends goodbye messages or even has the opportunity to.
jwalton超过 1 年前
I was at a large company during the dot com bust. Someone added a world readable field (I assume by accident or because they didn’t realize we could all read it) to our LDAP called “Departure date”, which let you look up who was going to be laid off in the next few weeks. :&#x2F;
adityapurwa超过 1 年前
When I was working on a small sized startup. We used to write “obituaries” for people who resigned in a newspaper format. We would add some insider jokes as a side article and some parody ads about their new company on the page if the person resigned already found a new company.<p>IIRC, it started from my resignation. Then we kept doing it for future leavers
ben_w超过 1 年前
&gt; if you&#x27;re able to build such tools without IT or similar getting &quot;threatened&quot; by it, then you might be somewhere that actually enjoys creating interesting and useful stuff. Treasure such places. They don&#x27;t tend to last.<p>Advice I wish I&#x27;d been given before graduating, second only to &quot;get everything in writing&quot;.
tuananh超过 1 年前
I made sth similar to monitor my github followers list. it&#x27;s a simple script to use github api to get followers list &amp; diff each day.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;tuananh&#x2F;github-followers-watch&#x2F;">https:&#x2F;&#x2F;github.com&#x2F;tuananh&#x2F;github-followers-watch&#x2F;</a>
dghughes超过 1 年前
Adam Savage&#x27;s recent video said large companies don&#x27;t like to lay off big blocks of employees so they just do it in small batches over the year. They fire the last person who made any mistake.<p><a href="https:&#x2F;&#x2F;youtu.be&#x2F;CzjftlUQs4g?t=403" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;CzjftlUQs4g?t=403</a>
评论 #39315422 未加载
RajT88超过 1 年前
I do this for various reasons at my work.<p>To function in day to day tasks you need to be able to read stuff in AD. I have solved interesting problems this way like: How do I get access to X thing when the security groups are not documented? Find someone with access and recurse their MemberOf and diff your own.<p>I also have used it to find people leaving.
mkl95超过 1 年前
There&#x27;s data and there&#x27;s also the behavioral &#x2F; psychological stuff which is the bigger tell in my experience. Things like delivering half assed work despite having a good track record, and not caring about problems that need to be solved in the mid term.
评论 #39312337 未加载
adrianmonk超过 1 年前
I built this by accident once!<p>We had this internal web application. It had its own separate username&#x2F;password table. I was asked to make it so you could login with your regular password instead.<p>It wasn&#x27;t hard to solve the password part. I could make the web app consult the main system to verify your password at login. But... I couldn&#x27;t eliminate the web app&#x27;s user table entirely. It was too fundamental.<p>So I built a thing that ran periodically, got a list of users from both places, diffed the lists, and then did the required create&#x2F;update&#x2F;delete operations on the web app&#x27;s user table. Thus the web app&#x27;s user table mirrored the main login system.<p>I rolled this thing out and babysat it, keeping an eye on its log file. Naturally my code logged operations done on the user table. And I was like, &quot;Hey, this is telling me who is joining and leaving the company!&quot;<p>It even gave me a little additional info. The web app had certain roles and permissions, and these needed to correspond to organizational structure, which I got from the main login system. So if a user&#x27;s web app roles changed, it was a clue they may have switched teams or got promoted.<p>I felt like I needed to be a bit careful with this info. Not that I wasn&#x27;t allowed to have it, but I don&#x27;t think IT expected anyone to have a tool that would make it that easy to notice changes as they happen. Potentially, I could have known someone was fired before their manager told them or something like that.<p>TLDR: Tried to streamline operations, accidentally developed a signals intelligence capability.
pharmakom超过 1 年前
I once discovered that a very large org had AD configured in such a way that you could see “last seen at” timestamp for everyone profile in the company.<p>It would have been trivial to track everyone’s hours using this, which would likely have been unpopular.
lapcat超过 1 年前
Fun fact: back when I was a contractor for Apple many years ago (while Steve Jobs was CEO), I learned through their directory service that Steve Wozniack was still an employee and reported to then-CFO Peter Oppenheimer.
al_borland超过 1 年前
We used to use Sametime and I’d periodically search for “Deleted - “, which would show me everyone who was deleted over the past few months, before they fell out of the system.
cyclops1982超过 1 年前
For those wondering, by default, any user with an AAD account can query &#x2F;all&#x2F; users via the MS graph API.<p>The trick showed in the article can easily be done on AAD as well.
tonymet超过 1 年前
Just be aware that your company will be logging this behavior and it will seem suspicious. They can make a good case for termination with this evidence.
l0b0超过 1 年前
Now to figure out how the frig to implement this at $work.
评论 #39311572 未加载
chrsw超过 1 年前
The power of turning information into data that can be processed by relatively simple Unix commands and pipelines is still mind blowing to me.
drtz超过 1 年前
I&#x27;ve been using POSIX systems regularly for 25 years. Why have I never seen the comm command used before?
Foobar8568超过 1 年前
With Excel and Power Query, you have your own analysis tool...There is a direct connector to dump the full LDAP.
lulznews超过 1 年前
Hacking is fun but how is this useful?
评论 #39312344 未加载
评论 #39312464 未加载
phendrenad2超过 1 年前
I postulate that if your company uses LDAP, and you are here on HN, you&#x27;re going to be laid off within the next 12 months. The existence of LDAP at a company implies that the company is likely highly um &quot;mature&quot; and isn&#x27;t amenable to the kinds of hackers who have actual interest in the programming field.
irrational超过 1 年前
My company has 80,000+ employees. I have a feeling I&#x27;d be inundated with the churn.
codeulike超过 1 年前
Note that in Europe or UK downloading bulk employee lists would likely mean you are now handling &#x27;personal data&#x27; and so various GDPR rules kick in
sciencesama超过 1 年前
Is there a script to check the users from the windows graph !!??
ezekiel68超过 1 年前
The last two sentences of the article were worth the whole read.
unobatbayar超过 1 年前
Do you guys feel sad when your colleague leaves the company?
评论 #39314191 未加载
评论 #39315020 未加载
评论 #39313017 未加载
kylestlb超过 1 年前
doesn&#x27;t every HRIS have this? workday, et al... all have some sort of &quot;Leave Reason&quot; field which can be reported on &amp; aggregated
wwilim超过 1 年前
Unix hacker approach to corporate drama, I like it.
hardware2win超过 1 年前
Irc, cron, ldap, spying on other employees stuff<p>Yea, admins.
brunooliv超过 1 年前
I find this super weird and almost borderline invasion of privacy? I mean, a job is your professional life and you’re there to work, not go directly make friends or stalk people… I mean sure I’ve made a few people whom I’d call friends in previous jobs and current one too and I’d like to believe that we’d have enough confidence in the friendship to tell each other about quitting. But seeing that potential info about anyone feels very weird…
thrdbndndn超过 1 年前
&gt; uid (unix account name)<p>Is this a joke or for real?
评论 #39314035 未加载
评论 #39312717 未加载
评论 #39312575 未加载
Unfrozen0688超过 1 年前
Not a WFH thing. This is a USA thing!!<p>Edit: OP said &quot;Layoffs in the WFH era are weird&quot; Yes they are, but people here don&#x27;t suddenly go offline quite as weird is what I was trying to get at.<p>Here in Sweden if you are FTE there is usually a 1-3 month layoff period (upppsägningstid) where you work and get paid still. At the end of the period you leave.<p>People usually email the team and even the entire company with &quot;hey im leaving here is my info&quot;<p>Now people CAN get fired day of, but that has to be VERY grounded.<p>Again, Not a WFH thing. This is a USA thing!! I notice this time and time again where people complain about IT or WFH, but it&#x27;s just that you&#x27;re in the USA, land of the exploited.
评论 #39312591 未加载
评论 #39312156 未加载
评论 #39312361 未加载
评论 #39313035 未加载
评论 #39312439 未加载
评论 #39316559 未加载
评论 #39318992 未加载
评论 #39313857 未加载
评论 #39312645 未加载
评论 #39312298 未加载