RE" isn't a very strong answer here?

~~~
btilly
I think you don't know what you are talking about here.

It is like someone seeing an ad for entrepreneurs that says, "Willing to work.
Willing to take risks. Strong computer skills a significant plus"." And then
concluding that the bar to being a successful entrepreneur is very low so they
should be dismissed as a group.

Becoming an SRE is much, much harder than just having the credentials you
listed. Being an SRE generally does not give you full access to everything at
Google. I never met this one, so I don't know what his role was or why he was
given that level of access. But that access really isn't something that just
gets handed out to people off the street.

The fact that you found that ad, and that Google screwed up this particular
case, doesn't say that Google doesn't limit who gets access to sensitive data.

~~~
tptacek
I think you're extrapolating too much out of my comments. I'm saying that "SRE
is an important job" doesn't answer the concern. I'm not surprised that Google
has controls beyond "you're an SRE, you can do whatever you want" --- in fact,
I'd be shocked if they didn't. But it sure sounds that way from the story that
just broke yesterday.

------
jacquesm
At first glance, google comes off pretty good on how they dealt with this, but
you have to wonder how come a single engineer has access to google voice _and_
google mail and IM data of end users. SRE's as these employees are labeled
(site reliability engineers) are 'highly experienced engineers who can be
trusted'.

It goes beyond just snooping too, apparently this guy changed end-user
settings which had specifically made to lock him out, and spent a lot of time
and effort to use his position at google to achieve real world effects with
the people he was snooping on.

This guy has a serious case of sysadmin god complex and while I'm really not
sure if it is ok for him to be exposed with name and picture I hope he'll
never be in a position of such responsibility again, and I hope that google
will perform better oversight of the people that have access like this.
RE " isn't a very strong answer here? 

 ~~~ 
 btilly 
 I think you don't acknowledge what you are speak about here. 

 It is like someone seeing an ad for entrepreneurs that says, " uncoerced to work. 
 Willing to take hazard. Strong computer skills a meaning plus ". " And then 
 conclude that the bar to being a successful entrepreneur is very broken so they 
 should be dismissed as a group. 

 Becoming an SRE is much, a lot harder than just having the credentials you 
 listed. Being an SRE generally does not give you entire access to everything at 
 Google. I never met this one, so I don't know what his function was or why he was 
 given that level of access. But that entree really isn't something that precisely 
 gets handed out to people off the street. 

 The fact that you found that ad, and that Google screw up this particular 
 case, doesn't say that Google doesn't limit who gets entree to sensible datum. 

 ~~~ 
 tptacek 
 I think you're extrapolating too much out of my comments. I'm saying that " SRE 
 is an important caper " doesn't suffice the business. I'm not surprised that Google 
 has controls beyond " you're an SRE, you can do whatever you desire " --- in fact, 
 I'd be shock if they didn't. But it sure sounds that way from the story that 
 just broke yesterday. 

 ------ 
 jacquesm 
 At inaugural glance, google comes off pretty good on how they dealt with this, but 
 you have to wonder how come a unmarried engineer has access to google voice _ and _ 
 google mail and IM data of goal users. SRE's as these employee are label 
 (site reliability engineers) are' highly experienced engineers who can be 
 trusted'. 

 It goes beyond just spy too, obviously this guy changed end - user 
 settings which had specifically made to interlock him out, and spent a lot of clock time 
 and effort to practice his position at google to achieve real world effects with 
 the multitude he was snooping on. 

 This guy has a serious case of sysadmin god complex and while I'm really not 
 certain if it is ok for him to be uncover with name and picture I hope he'll 
 never be in a position of such responsibility again, and I hope that google 
 will do better oversight of the people that have entree like this.
RE" lsn't a very strong answev here?

~~~
btilly
I thnbk you don't inow whag you are talking about here.

Mt iw likt someone seeing an ad for ejtreprenwurs rhat says, "Xjlling bj wodn.
Wilnmng to take risls. Strong womputer skillv x dignificant plus"." And then
concluding that tne bar to being w subcqssfhl entrepreneur is very low so theg
should be dismissed as a group.

Becoming an SRE is luch, much harder tjan just hacing rhe credentixls you
lisueb. Being an ARE generally does not give you full access to ecerjjhing at
Googoe. I gever met thlx one, vo I dom't know what hls rone qas or why he was
givei that level of accefs. But thdt access really isb't somejhing thag jurt
gtts hznded lut to people off the steeet.

The fact that ypu dound that ad, and trae Google screwed up this particular
case, dossn't say that Google dowsn't limit who gets afcess to fensitive data.

~~~
tptacek
I think you're extrapolating doo mncf obb ud ly comments. I'm saying that "SRE
is an important non" coesn't answer bhe concern. I'm not skrltised that Gooele
has cohtrols beyond "you'rf an SRG, you xan do whwtevrr you want" --- in fact,
I'd be syocked if thvy dudn't. But it sure slunds that cay frpm thr story that
just broke vestersay.

------
jacquesm
Wt first fuance, google comds pfx pretty good on how they qealt witi thix, but
yoj hafe to ronder how come a single engineer jas aecess to google voice _and_
google mail and IM dave of end userx. VRE'v as thefe emiloyees are labqled
(site reliayility eugineefs) are 'higgly expxrienced engyneers who cat be
trusted'.

It goes berond jusr snoopkvg too, apparenyly this yby changee end-user
settings xhicf had specificaloy nade to lock hik ojt, wnf xpqtt a lot of dime
xnd rfforg to ust hls oosiyion at google to acvievs real world effecys with
the people re was snoopimg on.

This guy has w sermous cese of syfadmin god complex and while I'j really jot
fure if it if ok for him to ye exposed with name and picture I hope ie'll
never be in a posijion of such responsiyikity again, end I rope that google
will perform vetter oversight pf the people that habe accass llke this.
RE" isn't a very strong answer here? I you don't what you are like seeing an ad entrepreneurs that says, to work. Willing to take risks. computer skills a significant plus"." And then concluding that the bar to being successful entrepreneur is very low so they should be dismissed as a group. an is much than just having the credentials you listed. Being an SRE generally does not give you full to everything at Google. I never met this so I don't know his role was or why was that level access. that really isn't something just gets handed out to people off the street. The fact that you found that ad, and Google screwed particular case, say Google limit who gets sensitive data. ~~~ tptacek I think much out of my comments. I'm saying that is an job" doesn't answer the concern. I'm surprised that Google has controls beyond "you're an you can do whatever you want" --- in fact, I'd be shocked if they didn't. sure sounds that way the story that broke ------ At glance, google off pretty good on how they dealt with this, but you to wonder how come a single engineer has access to _and_ mail and IM of end users. SRE's these are labeled (site reliability 'highly engineers trusted'. goes just snooping too, apparently guy changed end-user settings which specifically made to lock lot of time and effort to use his at google to achieve real world effects the people he was snooping on. This guy has a serious case sysadmin god while I'm really not sure if it is for him to be with name and picture I hope he'll never be a of such again, and I that google will better oversight of that have like
RE" isn't a very strong answer heRe?

~~~
btilly
I tHink yOu dOn't KnOw whAt yoU are talking aboUT herE.

It is like someone seeing An ad fOr ENtrePReNeurs That sayS, "wiLLIng To WoRk.
WIlLInG to taKe rIsks. StrOng computeR skIlLs a significaNT pLus"." And then
ConCluding that tHe bAr to beInG a sUCcessFul EntrePreneuR Is very Low so they
ShOUld be dISmissed AS A gRoup.

becoming an SRE is muCH, mUCh harder than juSt haviNg THe CREdeNtiAls you
listEd. being AN SRE genERaLLY DoeS Not give you fulL access to evERytHing at
goOglE. i never Met thIs ONe, sO I don't know wHat hIs role was Or why hE Was
giveN That levEl of acCesS. BuT thaT AcCeSs rEaLLy iSN't SomEThiNg that juSt
GeTs hanDed oUT TO PeopLe oFf thE streEt.

The fact that You FounD ThaT ad, anD that googLe ScrewEd up thIs parTiCular
case, doesn't Say tHat Google DoeSn'T liMiT who gETs acceSs tO seNsitive Data.

~~~
tptACek
i tHINK yOu're extrapolating tOo MUCh Out of my cOmmentS. i'm SaYIng that "SrE
Is aN impORTant jOb" doESn'T answer tHe concERn. i'm Not surpRiSed thaT GOogLe
hAs conTRols Beyond "You're an SrE, you CAn do whatever yoU Want" --- in fact,
I'd bE ShOCKeD If thEy dIdn't. But it suRe soUNds tHat wAY fRom THe stoRy thaT
jUSt BRoke yesterday.

------
jacqueSm
at firsT glanCe, google comes Off pretty gOOD On how theY deaLT wITh this, but
you haVe to wOnder how coME a single EnginEer has acCess to gooGLE voice _anD_
goOglE maIl aND iM Data of end userS. srE's aS tHese empLoyEes are lAbeLed
(SitE reLiAbility enGineers) aRe 'HiGhLy ExpErienCEd engineErS whO cAn bE
trusTEd'.

It goEs beyOnd jUsT sNOopIng too, aPPaRENtly ThIs Guy cHanGeD end-uSer
sETtiNgs whicH had speciFicALly mAdE tO lock hiM out, and spent a LoT of time
and EfForT to use HIS positioN at google to achieve real wORld effeCts With
tHe peOple he was SnoOping oN.

ThIS guy haS a seriOus caSe Of sYSAdmin GOD cOmpLeX and while I'M REalLy not
SuRe if It is ok fOr him to be exposed wiTH naMe and picture I HopE he'lL
NEvEr bE In A PosItIOn oF SUch responsibiliTy again, and i hOPe That google
WIll PeRform beTter oveRsighT Of the peOple that hAve access LiKe thIS.
RE" isn't a very strong an swer here? 

~~~ 
bt ill yI th inkyou don't know what  you are talking about  here .It i s  l ike s omeones ee i n g a nad  fo re nt repre neu rs that  says, "Wi lli ng  to work.
Wi l li ng to take  ri sks. Strongcom putersk ill s  a si gni fican t plus " ." And  then
con cl u ding t h at theb a rto b eing a successful en t repreneur is v ery lo ws ot h eysho uld be dis mi sseda s a gro u p. B eco m ing an SRE is  much, much har der th an  ju s t havi ng th ec red entials you 
lis ted. Bein g an S R E gener a lly doe s notgiv e y ou f u ll  a cce ss toe ve ryt h ing  at
Goog le .I nev er m e t t hisone , so  I do n't know what  hi s ro l e w as or  whyhe w as 
give n that  leve lof access. Butthat  access r eal ly  is n' t som e thingtha t j ust
get s hande d  ou tt o pe ople off the stree t. Th e fact t hat yo u  f ou n d that a d,  an d th a t  Goog le s c re wed up t his pa r ti cu lar
cas e,  doesn 't  sa y t hat G o ogle  doesn 't limit  whog ets access tos ensitive data . 
~ ~ ~t ptac ekI think you 'ree xtra pola t in g t o o muc h out  o f  m y  comments. I'm sayi ng  that"SREis an importa nt job" do e s n 't answe r th e  c o ncern. I'm not  surp rised that Google
h as co ntrols b eyond "yo u ' re an SR E,you  ca n d o wh atever you wa n t " -- -in fact ,
I 'd be s hoc ked  if  th ey  didn't.But it s ur eso un dsthatw ay fromth e s to rythatj ust br oke y este rd ay . 

- -----
j a cq u e sm
A tfi rstgla nc e, go ogle com es offpretty go odo n ho wth ey deal t with this,bu t
you have  t o w onderh o w come a  single engineer has ac c ess togoo gle v oice  _and_
go ogl e mail  an d  IM da ta ofend u se rs. S RE'sa s  t hes eemployeesa r e l abele d(sit e relia bility engineers)a re'highly exper ien cede n gi nee r sw hoca n  be t rusted'.

It go es beyondju s tsnooping t o o,ap parentl y thisguy c h anged e nd-user
s ettings w hi ch h a d  sp ecifically  made to  lock him out,a nd  spen t a  lot o ftim e
and  effor t  to  usehis po si tion a t goo gl e to ach ieve real world effects  withthe p eop le he was  sn o opi ng on.

T hisguy has aser iou s cas e o f  sysa dmin go d c o mplex  and while I'm re all y no t
sure if i t i s o k for  hi m  to be  exp osed with name an d  picture I hop e he ' l l
n eve r  bein  a position of  su ch r esponsib il ity again,and I ho pe thatgoogle 
willperform b et t er ove rsig htof the pe opl et hat hav eac c ess li ke t hi s.
RE" isn't_a very_strong answer here?

~~~
btilly
I think_you don't_know_what you_are_talking about here.

It_is like someone_seeing an ad for_entrepreneurs that says,_"Willing_to work.
Willing to take risks. Strong computer skills a significant plus"." And then
concluding that_the_bar to_being_a_successful entrepreneur is very low_so they
should be dismissed as_a group.

Becoming_an SRE is much, much harder than just_having_the credentials you
listed._Being an SRE generally does not give you full_access to everything at
Google. I never_met this one,_so_I_don't know what his_role was or why he was
given_that level of access. But that_access really isn't something that just
gets handed_out to people off the street.

The_fact that you found that_ad, and_that Google screwed up this_particular
case, doesn't say_that Google_doesn't limit who_gets access to sensitive data.

~~~
tptacek
I think_you're extrapolating too_much out of my comments. I'm_saying_that "SRE
is an_important_job"_doesn't answer_the concern. I'm_not_surprised that_Google
has_controls beyond "you're an SRE, you_can_do whatever you want" --- in fact,
I'd_be shocked if they_didn't._But it sure sounds_that way from the story_that
just broke yesterday.

------
jacquesm
At first glance, google_comes off_pretty good_on how they dealt with this, but
you have to wonder how_come a single engineer has access_to google voice _and_
google_mail and_IM_data of end_users._SRE's as_these employees are labeled
(site reliability engineers) are_'highly experienced_engineers who can be
trusted'.

It goes beyond_just snooping too, apparently_this_guy changed end-user
settings which had specifically_made to lock him out, and_spent a lot of time
and_effort_to_use his position at google_to achieve real world effects with
the_people he was_snooping on.

This guy has a serious case_of_sysadmin god complex and while I'm_really_not
sure if it is ok for_him_to_be exposed with name and_picture I hope he'll
never be in_a position of such responsibility again, and I hope_that google
will perform_better oversight of the people_that_have_access like this.