96

I work for a startup where we have to frequently pitch to customers and investors. I'm the most senior developer in experience, but I did not want the lead role, so I could avoid most client meetings as I hate dealing with insane requests. My boss still brings me along anyway.

During pitches, they talk about how we are proactive about security because we know that users won't be. They then go into this story about how they "used [their] hashtable skills to create a frequency table of passwords and none of them looked very secure. "First of all, any decent junior developer can do a hashmap, so it is not the awesome skill they think it is and second, nobody should be able to see the passwords at all as passwords must be hashed and salted. I implemented that when I arrived, so the "password hashmap" can't be done anymore, but she keeps pretending like it was something done recently.

She has another anecdote about how "the software used to have a feature where our clients could just use SQL to do their data analysis, but security people (me) made them get rid of it." We developers call it SQL injection.

We are a startup that stores medical data and the CTO goes on about "world class security" (which we don't have, but I digress), so it alarms every technical person we pitch. You can visibly see the alarm in the eyes of the technical people. I have learned to stand in the back and mouth "I did not do that. I did not do that." The worst case was when one investor came to my LinkedIn a day later to yell at me for "trying to scam him with something out of PHP for Dummies."

Not one pitch has succeeded when she has used the anecdote and I have to deal with potential clients and investors asking me how the heck we can be so careless with medical data.

My boss doesn't believe that not hashing passwords is a serious issue that would cause investors to skip a company.

I've told my boss to stop as knowing user passwords indicates that our security is not anywhere near world class and she says the story "makes us seem scrappy and homey." Normally I would just leave it be as we have sufficient contracts to keep my job so further growth is not my problem, but I'm concerned for my own reputation.

Can you think of any other way to get my boss to stop this?

Improve this question
2
  • 1
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Neo
    May 15, 2020 at 12:02
  • 3
    You mouthing "I did not do that" during a sales meeting sounds horrible to me. Could you tell what you are trying to achieve?
    – guest
    May 17, 2020 at 8:23

9 Answers 9

Reset to default
147

You're the most senior developer, time to act like it. To stop playing charades in a meeting would be a good start.

If your boss is bringing you along, you need to bring your expertise to the table.

I can't believe how lucky you are that you have feedback from potential clients and investors. That should have been given to your boss as you received it. In any case, it's now time to compile a report containing ALL feedback you've received, along with your summary of where you think the issues lie. Present it to your boss.

I disagree with other answers that you need to find other anecdote. Good security means you shouldn't have stories to tell, it's that simple. You should be discussing security features. You should be discussing how you validate compliance. You should be discussing why you don't have any stories to tell.

If you can't convince your boss, with all due respect, your company doesn't deserve new clients. And the company probably doesn't deserve you. What do you think it going to happen when you uncover a large security flaw somewhere? Do you think your boss is going to trust your assessment and ensure it gets fixed. I don't think they would.

Improve this answer
9
  • 6
    OP admits that they don't actually have world class security, so these stories may be all they have.
    – Matthew Gaiser
    May 14, 2020 at 14:55
  • 10
    @MatthewGaiser Probably all the more reason to not talk about it then!
    – Gregory Currie
    May 14, 2020 at 14:56
  • 2
    This is the right answer. Right or wrong, the boss is paid the big bucks to make these decisions. If they cannot be convinced to make different decisions, that's on them. Either maneuver yourself into a position of greater responsibility where you can make the company look better, or find a new company, or put up with it. I completely understand the OP's concern about their own personal reputation but unfortunately that's the nature of working in a team. Basically, life's not fair. :(
    – Asteroids With Wings
    May 14, 2020 at 15:12
  • 7
    "What do you think it going to happen when you uncover a large security flaw somewhere?" -- Oh, let me take a stab at that one! The boss will blame the OP for not doing the job perfectly. This boss sounds like the type who wants credit for others' successes but isn't willing to stay invested in understanding those successes.
    – CynicallyNaive
    May 14, 2020 at 18:35
  • 13
    And yeah, mouthing anything in a meeting to contradict your boss is bad. Please stop that @Bellfunder. It won't help you look better to the audience. Follow up afterward (without airing dirty laundry) if you need to correct a major error of fact.
    – CynicallyNaive
    May 14, 2020 at 18:44
133

Not one pitch has succeeded when she has used the anecdote and I have to deal with potential clients and investors asking me how the heck we can be so careless with medical data.

Can you think of any other way to get my boss to stop this?

Compile some of the specific feedback you have received from potential clients and investors. Quote them exactly. Don't paraphrase.

Present these to your boss and indicate "This is why we should change our pitch".

Improve this answer
7
  • 17
    The OP doesn't say how often this happen, so to compile a collection may take a while. IMO even one should be enough, and then repeat each time it happens.
    – BЈовић
    May 14, 2020 at 11:12
  • 8
    They did say they specifically got an angry LinkedIn response - that alone is proof that they aren't coming off as 'scrappy', but rather' incompetent'.
    – Zibbobz
    May 14, 2020 at 13:00
  • 2
    @Zibbobz It's not technically "proof" but it is good prima facie evidence. Does the boss have one shred of empirical evidence, not just her own gut, that this is coming off well? If not, she needs to hush or at least be more strategic.
    – CynicallyNaive
    May 14, 2020 at 18:42
  • @CynicallyNaive I'd probably say that if the assertion was that clients are getting put off by certain behaviour, and then the client outright says they were put off by that behaviour, that's probably as close to proof as you're ever going to get.
    – Gregory Currie
    May 15, 2020 at 10:31
  • If I lose three deals, that’s enough. You don’t want to wait until you lose a dozen deals.
    – gnasher729
    May 16, 2020 at 9:15
56

"Scrappy and homey" is a good thing for a mom-and-pop store.. It is a very bad thing for a company required by law to have due diligence.

Make it simpler for her. This isn't that you have a difference of opinion on how good the story is. This is her telling potential customers about a time she broke the law. Under GDPR in the EU, both those stories indicate the company or a company employee committing an actual crime, for which she personally would be likely to be fined and barred from being a company director for some period.

What you're describing is literally criminal incompetence, because your company broke the law and the people in the company then were too dumb to know they were breaking the law. Not only that, if you're the senior developer then she is implying to potential customers that you are the one who's criminally incompetent. You should take a very fun view of this.

You say this is a startup. That probably means there aren't many people. I suggest you gather them all together, and tell them this in your position as the senior developer. Tell them all they're lucky they haven't yet been found out for what they did with people's data before, and they must never ever reveal this in future or every one of their careers personally could be ended by it, and the company certainly would be.

Improve this answer
10
  • 5
    You are exaggerating. Security risks are not a crime until an actual data leak occurs and incompetence is proven.
    – Jacques
    May 14, 2020 at 11:08
  • 26
    @jacques - not entirely correct. There are often regulatory frameworks/requirements that would make these risks criminal violations even without a data breach.
    – HomoTechsual
    May 14, 2020 at 12:11
  • 35
    @Jacques Certainly under GDPR in the EU, you are not correct. Exposing private information such as healthcare data in a way that other people can access without the person's permission is a crime in its own right, separate from the crime of actually accessing that data without the person's permission. In fact this is the pretty much the entire purpose of GDPR, to make a company responsible for its failures before people actually have their person data stolen. In driving terms, it's like being able to arrest someone for driving dangerously before they actually kill someone.
    – Graham
    May 14, 2020 at 12:24
  • 33
    Anyone that says "it's not a crime to insecurely handle medical data unless there's an actual breach and they prove incompetence" is someone that doesn't work with medical data. As someone who works with medical claims data, I can guarantee you: you can absolutely get fined up the wazoo even if there's no actual breach, let alone getting "proven incompetent." I can't imagine the boggled look an external auditor would have if you told them, "Oh, we don't hash our passwords. But it's okay - we haven't had a breach, so we're not in violation of any HIPAA laws."
    – Kevin
    May 14, 2020 at 15:39
  • 18
    @Jacques Read my previous comment. Creating the possibility of a data leak is a crime in its own right. Unless you've reduced that possibility to as low as reasonably practicable, you're committing a crime. If you haven't understood that, you haven't understood GDPR, and you certainly haven't had any involvement with any form of data security.
    – Graham
    May 14, 2020 at 17:58
17

Your best shot here is to come up with better stories for your boss to tell. She's not going to stop telling these stories on her own. I suggest you focus on making moves that improve the security of your app and make it easier for your clients to use it securely. Every time you make an improvement, brag about it to your boss. Word these updates in a way that will 1) impress her enough to repeat it and 2) make your company look smart when she repeats it. Eventually, you may find that she starts using these new, good stories instead of her old, bad ones.

Improve this answer
3
  • Make new anecdotes, and make em stick.
    – paulj
    May 14, 2020 at 19:53
  • I'm rather skeptical of this advice. The situation sounds like a dumb thing that gets stuck in a dumb person's mind. Dumb -- but simple, memorable, and a unique story because no one else goes around saying the same thing. To a crude storyteller, that's gold. Moreover the fact that OP has pushed back against it will actually make it even more memorable (see: backfire effect). The advice here seems like a very faint hope. Do you have experience of this tactic working?
    – Daniel R. Collins
    May 15, 2020 at 1:02
  • No, Not really. I think voting on this question has put the answers in roughly the correct order here, though. So I feel ok leaving this one up.
    – djohnson10
    May 15, 2020 at 17:26
5

Does your boss understand the technical side at all?

From the hashmap example and the casual acceptance of the SQL query form, I am guessing that your boss doesn't actually have a strong technical background. There is no competitive advantage to not hashing passwords from the beginning. Most frameworks build it in from the start.

The only reason for it ever to have been true is that your boss did not know it needed to be done.

I was part of a startup accelerator where tons of people learned to code to launch their startups. The code quality was terrible. The approaches were comical. But because the Udemy tutorials told them to hash their passwords, they did it. All but one company there had hashed passwords. Few knew why they were doing it, but they knew the best practice was to do so. Your boss probably never took that approach.

Same with the SQL form. Did your boss appreciate the power of SQL? I had to show this to a founder who had a similar thing. To them, SQL was nothing more than insert and select. They had never heard of drop and were quite alarmed when they found what it did.

"Password hashing" might just be technobabble to your boss. Does she understand that doing it prevents a hacker from logging into user accounts if the database is compromised? I would bet she doesn't.

Try explaining the consequences of not having these things.

Plain passwords == easy hacking.

SQL injection == some bad person can come and delete the database or steal all the information in the database.

Improve this answer
6
  • 7
    While I agree that, judging by OP's descriptions, OP's boss doesn't understand the technical details, she does appear to understand that they were (somehow) bad for security, which is why she's bragging that these issues were fixed. What she fails to realize is how basic these fixes were. It's like bragging about recently having started to lock your door to keep out intruders. (No idea how to explain that tactfully, though...)
    – Llewellyn
    May 14, 2020 at 20:30
  • 4
    With regards to SQL injection, forget "bad person". The real threat is a careless person who forgets the "where" clause on their update statement.
    – Mark
    May 14, 2020 at 20:49
  • 2
    +1 As a developer, technical knowledge is his strength and he should leverage that to the maximum ability
    – Anthony
    May 15, 2020 at 3:12
  • @Llewellyn those don't seem to be bragging about the issues being fixed. With the password frequency table, she is talking about addressing one security issue ( a human one) in a way that causes another (a technical one). The 2nd one is just her being irritated at a feature being removed.
    – Matthew Gaiser
    May 15, 2020 at 4:11
  • “We recently started locking our doors, so now we have world class security”. Potential customer thinks “what a bunch of clueless bozos”.
    – gnasher729
    May 15, 2020 at 12:13
2

If your boss is the company owner, tell her about the feedback you received, like the one saying you were trying to scam them. Tell her that she is telling anecdotes showing total incompetence. If she is not the company owner, tell whoever is above her that she kills sales.

Or you can pray that she pitches to a client who doesn’t just quietly go away with a sale lost, but tells her exactly why she lost the sale.

Improve this answer
2
  • 3
    I'm concerned that the OP's boss is one of these "you can't tell me what to do, I'll do just the opposite to show you who's boss" type people (e.g., backfire effect).
    – Daniel R. Collins
    May 15, 2020 at 1:06
  • In that case, we’ll have another startup turning into a failed startup.
    – gnasher729
    May 15, 2020 at 12:02
2

......so I could avoid most client meetings as I hate dealing with insane requests

You agree that the clients’ requests are absurd which means they are not technical.

Your CEO is also a non-technical person and uses technical terms or technologies to impress those above mentioned clients.

So let’s be honest here:

As long as you are dealing with these types of clients, you are fine. Try to learn how to deal with these clients instead of avoiding them.

However, if I were you I would have suggested my CEO to ask me to explain tech when it comes to technical stuff. Tell her: “This will sound more professional and I would be able to impress them more.”

Improve this answer
3
  • This. The boss is there for the overarching leadership, and should be passing the purely technical points over to OP. That gives some credulence and reason for being at the meetings. It demonstrates Team and delegation.
    – Criggie
    May 14, 2020 at 21:48
  • @Criggie exactly
    – Iman Nia
    May 15, 2020 at 8:19
  • But the OP said "... I did not want the lead role, so I could avoid most client meetings as I hate dealing with insane requests".
    – Peter Mortensen
    May 15, 2020 at 13:34
0

If your boss has to resort to anecdotes it probably means that they are not confident and do not know the details of your work or how to handle the situation effectively. Hence, they are trying to act in a situation which they find difficult themselves. My advice: change team if this is leading you feeling angry/frustrated. Changing another person is much more difficult than finding another job!

Improve this answer
3
  • 1
    There’s absolutely nothing wrong with anecdotes, and it’s probably the #1 tool in a salesperson’s repertoire. There’s something wrong with these specific anecdotes.
    – Konrad Rudolph
    May 15, 2020 at 10:38
  • I think it's important how anecdotes see used. They can be part of good mentorship but the tone and situation are likely to determine their success
    – Peter Dimmar
    May 15, 2020 at 10:54
  • Yes Kondrad I do think that anecdotes can be used in a constructive or destructive way depending on the intent.
    – Peter Dimmar
    May 16, 2020 at 6:51
0

You are there for your technical expertise so start saying it - the next time the boss launches into one of those anecdotes you reply to it "obviously not salting passwords was terrible, that's why those guys aren't here now and I am". Use it as an opportunity to show how things have developed. The boss gets to keep telling the story but you mitigate the impact. Hopefully the boss will learn from the reaction you get!

Improve this answer
5
  • So your suggestion is to contradict the boss during the meeting with the client?
    – guest
    May 17, 2020 at 8:19
  • Not contradict no, but finish the story, turn it around and make it about an improvement.
    – deep64blue
    May 18, 2020 at 15:50
  • But how do you mean? The boss tells the story and then you interrupt and say "no, obviously not salting was terrible"? Or how?
    – guest
    May 18, 2020 at 16:00
  • You waitit ill they finish their story then you add your comments, I don't see what's so difficult about this. What are you doing there if you're not going to interject or answer technical questions?
    – deep64blue
    May 19, 2020 at 12:42
  • Can you make clearer how this conversation should go? And I do think you are here to answer technical questions from the client, but I can't see howreplying "obviously not salting was terrible" can be said without contradicting the boss?
    – guest
    May 19, 2020 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .