123

I'm a software developer (at a small company with no government or military customers) and just out of fun left an easter egg in the code. The only way for a final customer to see it is if they press the same button 25 times, which is unlikely to happen. The easter egg itself just contains a small photo of myself and a variant of "All your base are belong to us"

If discovered, what are the likely consequences, either while I'm employed or after?

 

1
  • 2
    Comments are not for extended discussion; this conversation has been moved to chat.
    – Jane S
    Jun 9, 2016 at 21:26

10 Answers 10

186

If you are not absolutely certain that your team, your manager, and your company will chuckle at this, don't include an easter egg.

I have seen cases where developers were summarily dismissed for including an unauthorized easter egg. The problem is that, almost by definition, the easter egg was code that wasn't peer reviewed that was doing something that wasn't properly documented. If a developer can sneak in code that shows their own picture without any sort of review, the fear was that they could just as easily have inserted a back door that would let them compromise the system in the future. The company treated it just as it would have treated finding any sort of unauthorized code in production (which likely made reference checks for those developers rather problematic in the future).

Now, is it particularly likely that you'll be fired if you include an easter egg? It likely depends on the nature of the software-- companies producing medical or financial software are probably going to be a lot less amused than companies distributing a game. But even within a particular industry, there are going to be more straight-laced companies and more free-wheeling companies. It's possible that you'll just get told to knock it off. It's possible that management will lose confidence in your professionalism or that your team will think that you're being a self-aggrandizing jerk by singling yourself out over the team. It's possible that everyone will think it's hilarious.

Given the tremendous potential downside and the minimal upside, though, it doesn't make sense to take the risk. Either get formal approval to add it (which will presumably mean at least picking a more inclusive picture) or don't include it.

15
  • 94
    @Lilienthal: For example TDD makes it almost impossible to include them on a whim, because by the time you've finished writing the test to ensure it's there, you're already bored of the idea ;-) Jun 9, 2016 at 8:42
  • 27
    And since easter egg code is not vetted/tested properly, it could contain vulnerabilities - increasing the attack surface of the application.
    – user8036
    Jun 9, 2016 at 9:41
  • 99
    It should be noted that Easter eggs in modern games probably are reviewed, tested and approved.
    – OrangeDog
    Jun 9, 2016 at 10:55
  • 7
    @SteveJessop The downside there, however, is that you have to use TDD.
    – kirkpatt
    Jun 9, 2016 at 15:32
  • 7
    Regardless of whether it is technically fireable, it says to your company this guy is incredibly unprofessional and a massive liability. Word of it could get around to potential future employees. Imagine sitting in an interview for an awesome job in five years time and the interviewer says "So, Bob at SynergyLeverage told me about the easter egg you did - want to talk me through your thinking on that?". You're going to want to die. Jun 10, 2016 at 13:14
99

Easter eggs are company initiatives, not renegade initiatives. The reason they are hard for a company to do well is because so many employees go renegade about it and think it's a magical time to just stop exercising normal levels of caution and judgment. Don't do renegade things in your company, like, ever. I mean, there are exceptions, but this clearly isn't one of them.

Easter eggs:

  • should not confuse the user. Your does.
  • should not harm the user.
  • should not confuse the user as to whether the user is harmed. I can't stress this enough and half your users are going to think it's a virus.
  • Should be consistent with company voice. Yours almost certainly is not.
  • Should have buy-in from stakeholders. Yours does not. Customer service is going to take a while to trace this back to you and they're going to be annoyed when they do.
  • Should push the company culture forward in some meaningful way. "Not afraid to be quirky, but you can trust us with your data" is a trend in April Fool's day jokes right now. Yours does not fit in this category.
  • Should not be secretive. Just like no part of development should be secretive. It's not an exception just because you call it an easter egg.
  • Should follow normal review process and consist of quality code. Yours does not.
  • Should follow normal security review of all things. An attacker will 1) look for these things and 2) immediately realize it's the most poorly reviewed piece of code in the entire web page? Being an "easter egg" is not a form of security.

So now you need to fix it. This doesn't sound like a serious situation to me but you're likely to get in a lot more trouble in an ill-thought out attempt to cover your butt than to get the problem on track. Deal with this problem like you would have if someone else did it, and you're likely to look a lot better.

That possibly means escalating to your boss in case more damage control needs to be done (probably not), or possibly just getting an actual code review when you remove the offending code, just like you always get a code review when you remove any offending code.

5
  • 22
    I really like this. I think if the OP goes to the boss and says, "You know, I made a mistake. I thought this would be funny, but I no longer think so. I would like to remove this code." The OP will save face, remove any potential future embarrassment, and may even gain a little respect/trust.
    – Jeff.Clark
    Jun 9, 2016 at 17:13
  • 33
    "half your users are going to think it's a virus." This is the biggest problem. Your Easter egg is exactly what viruses look like in movies! (The original Jurassic Park is one memorable example).
    – user45590
    Jun 10, 2016 at 9:04
  • "Easter eggs are company initiatives, not renegade initiatives." Except for that that one in SimCopter. (Disclaimer: yes, the guy did lose his job, but the easter egg remained)
    – Pharap
    Jun 10, 2016 at 16:45
  • 2
    In other words, good easter eggs are a team effort.
    – user15729
    Jun 11, 2016 at 18:59
  • 1
    @fredsbend I'd like to think I said a lot more than that :P
    – user42272
    Nov 23, 2016 at 21:10
28

I'm a toddler and just out of fun left a scribble on the house. The only way for a parent to see it is if they look behind the cups in the cupboard, which is unlikely to happen. The easter egg itself just contains a small scribble of my name and a variant of "All your cups are belong to us"

The mentality is largely the same. You are adding graffiti to an object you do not own, without permission, and you believe that you won't be caught, so you should be ok, right?

The problem is that you don't have permission, and that this is a product which represents the company. When the easter egg is revealed, and it's not a matter of if, then there will be serious repercussions towards you. Just because you may be willing to be fired for it now doesn't mean that you'll appreciate the exposure if it comes to light in 3 years when you have another job with a security minded company.

Do not allow this product to be released to any customers with your digital graffiti. Take it out of the codebase, and hope no one else notices it.

4
  • 15
    "Digital graffiti." Love that expression.
    – brian_o
    Jun 9, 2016 at 18:49
  • I like the graffiti analogy, in regards to defacing other people's property. Sadly the analogy falls down when one considers that graffiti is sometimes ignored by police (despite being a criminal offence) because the perpetrator is famous. Maybe the OP could get away with it if they became famous first.
    – Pharap
    Jun 10, 2016 at 16:53
  • Not sure the point of the graffiti analogy... toddlers don't really have "mentalities" and even then "my parents would think it's funny, or I'm a kid so they let me get away with stuff (a la programmers are quirky and do quirky things)" would be pretty realistic mentalities. Really the analogy just makes the point that permission doesn't matter too much when you're just being yourself.
    – user42272
    Jun 13, 2016 at 5:46
  • @djechlin Perhaps I should use the phrase "Thought process" rather than mentality (which is pretty well defined, but perhaps you have a connotation that doesn't match the dictionary). Regardless, the analogy suggests that anyone who thinks their graffiti is ok on another person's product lacks empathy and accountability - two things toddlers don't learn until much older. It's essentially a selfish, childish act, and has no place in one's profession. If you obtain permission, go ahead, but if you're doing it secretly then you are no better than a vandal, no matter what justification you create.
    – Adam Davis
    Jun 13, 2016 at 14:38
17

Are you afraid of it being discovered? You left a clear way for them to track the Easter egg to its source by leaving a picture of yourself in the code, not to mention a technological thumbprint.

It would be prudent to remove the Easter egg. Even if you think it is unlikely to be discovered, you cannot guarantee it wouldn't.

But, you asked about consequences, so here are my thoughts.

  • Specifically, your supervisors might question your professionalism since you clearly (as mentioned in the comments by Steve Jessop, the proof now lives in the source control) were not working when you were paid to work when you wrote the Easter egg. It will impact their impression of you, which can follow you to your future jobs in references.
  • Your co-workers may also view the Easter egg negatively, especially if some projects are behind on delivery or resources and they could have used a few hours of your help to resolve the project.

On the other side, knowing my co-workers, you are bound to get a chuckle from your more light hearted co-workers for the Easter egg. Just don't expect management to find it as humorous.

7
  • Hi @Marion, thanks for your answer. I wasn't afraid of being discovered, but I told my brother about it and he asked if there could be consequences. So that got me thinking.
    – zundi
    Jun 9, 2016 at 5:38
  • 22
    "You left a clear way for them to track the Easter egg to its source by leaving a picture of yourself" -- so what you're saying is, change it to a picture of whoever sits next to you? More seriously it's source control that will establish authorship. Jun 9, 2016 at 8:44
  • 14
    I don't like the idea that doing something creative on the job is "goofing off" and costing the business money. Software Developers are not code-producing machines with a certain throughput per minute. Relaxing and "playing" around are important parts of my work day to keep me motivated, creative and keep a flexible mind. - If your manager was happy with your performance at the time, you used it right. - Bringing this play-around code into production is of course a problem.
    – Falco
    Jun 9, 2016 at 12:40
  • 5
    @SteveJessop: On the topic of source control, this is actually a serious additional liability the company could incur due to easter eggs. By putting content in the source control repository that may be derived from something under third-party copyright without a suitable permissive license, the copyright status of the whole source history going forward is tainted. This may affect licensing/selling the project to third parties or future attempts to open-source it. Removing the taint is an expensive history-editing operation that destroys all external revision references by changing hashes. Jun 9, 2016 at 17:07
  • 1
    I don't have a problem with goofing off while working or with Easter eggs in general. People need downtime or they burn out. But, as a friend of mine put it eloquently, now you left proof you weren't working.
    – Marion
    Jun 10, 2016 at 0:10
16

Easter eggs were cool 25 years ago. They're not cool anymore. Don't do it.

Installing unauthorised easter egg opens you to all kinds of unpleasant questions:

  • why were you working on personal stuff at work? You were paid for the time you've spent on that easer egg, weren't you?
  • why did you violate the coding rules and quality policies by introducing un-reviewed and untested code in the product? If that code is buggy, how do you plan to prove you didn't do that on purpose?
  • if your easter egg looks like a backdoor to a security expert, how will you prove it's not? Are you ready to pay for an independent security assessment?

IANAL, but many aspects of your actions could easily constitute a sackable offence, or worse.

7
  • 13
    "10 years ago"? More like 25 years. Now get offa my lawn you young punks. Jun 9, 2016 at 14:13
  • 16
    @CarlWitthoft All done, grandpa. Can I go play outside? Jun 9, 2016 at 15:14
  • Easter eggs been in software a lot longer than 25 years ago. 25 years ago was the 90s, while some of the best easter eggs been out in the 70s and 80s.
    – Dan
    Jun 9, 2016 at 18:18
  • @Dan but back in the 90s they were still kind of cool. Back then the OP could easily put his photo in a software product and get away with it. Jun 9, 2016 at 21:26
  • 2
    Yeah guys they're totally not cool anymore! Lameo's!
    – Insane
    Jun 10, 2016 at 8:26
7

If you work at Microsoft, you will be fired once this is discovered.

If you work for a company which provides software to any government, or with any government contractor, your company could lose its contract now and be forever banned from further dealings with said customer.

Easter eggs are undocumented features that have never been tested or analyzed to ensure that they are not security holes, and therefore are unacceptable risks to many customers. They are not funny. They are not cute.

If you want to have a funny user interface element that gives credits to team members, write a web page. Don't put undocumented, untested, unverified features in user-accessible code. The customer will quite reasonably ask what other undocumented secret features that subvert their security measures that employees of your company have added to their software.

1
  • 3
    "Don't put undocumented, untested, unverified features in user-accessible code." - I reckon that would be more than half of all the code out there :)
    – tymtam
    Jun 22, 2016 at 23:00
6

Best case, you have a chuckle. Worst case, you have a chuckle until HR gives you your papers. It's your decision how much you value a chuckle.

Consequences after you left: Worst case, your old company sues you. If this happens in the USA, you can get sued for any reason whatsoever. And the best possible result of being sued is that you pay your legal expenses, which won't be cheap. Again, it's your decision how much you value a chuckle.

But look at it in a positive way. Maybe the guys at your company have a sense of humour. So HR will have a chuckle while they give you your papers, and the company's lawyer has a chuckle while he sues you. That's certainly worth it.

Did I forget to mention that this is a very, very bad idea? If you want an easter egg in your company's software, suggest it the product manager.

4
  • 25
    "you can get sued for any reason whatsoever" -- so either never take any action (because you can be sued for it), or else completely ignore the issue (because you can get sued for eating breakfast anyway, might as well implement an easter egg). An analysis in terms of the risk of being sued is only useful if you actually assess the risk of being sued. Jun 9, 2016 at 8:45
  • 7
    Sorry, but being sued does not necessarily mean that you end up having to pay legal expenses. If a judge rules that the employer's suit is frivolous or trifling, she might force them to pay your costs.
    – jwg
    Jun 9, 2016 at 12:34
  • 5
    "If this happens in the USA, you can get sued for any reason whatsoever" -- despite popular believe, in many European countries, and I believe pretty much everywhere in the world, you can sue anybody for anything - whether this won't get dismissed by the judge is the another thing though, but "freedom of suing" is not USA-specific
    – M4ks
    Jun 9, 2016 at 13:55
  • 1
    Nothing about this answer is topic-specific. The question could have just been "help, I introduced a bug in software at work".
    – user42272
    Jun 9, 2016 at 14:35
3

There will be three main factors here:

  • The prevailing culture of your employer (are they cool & groovy or straight-laced and serious?)
  • The likely attitude of customers / impact - if this code is running a nuclear submarine, the customer is likely to take a very dim view. If this is a fart app, no-one's gonna mind.
  • The nature of the easter egg: Could it cause offence, alarm, upset, make an unwary customer or user think there's a problem, stop the software working, etc..?

If you'd be entirely happy to be called into the CEO's office to explain it, or for it to appear on your CV for evermore, then go for it. If you'd feel embarrassed to explain it to a room full of colleagues/customers then best leave it out.

You also need to be really damn sure that there's absolutely no way it could possibly interfere with the function of the software - as Pratchett's law states: "Million to one chances happen nine times out of ten"

My personal view is don't put your name or a photo of your dumb face in there, that sort of thing is likely to be as embarrassing in 5 years' time as your baby photos, and smacks of vanity rather than fun. There's some well documented (and well-loved) easter eggs that print out developer team credits and fun little messages, but just sticking yourself in there seems a bit narcissistic.

1
  • 3
    If you could be absolutely sure on your own, just anyway, then the entire industry could just do away with code reviews and encourage people to be absolutely sure before making changes.
    – user42272
    Jun 9, 2016 at 14:32
2

I would consider the possibility that somebody who hits the same button 25 times maybe isn't having a great experience, either with their computer or your software.

Maybe they think that your software has frozen, maybe their computer is running slowly or playing up, maybe their kayboard/mouse is having issues, maybe they are just having a really bad day and take their frustration out on your software.

Either way, if that is the case, and a picture of you shows up along with some silly meme, it's not going to end well for you!

1
  • 3
    Another common case: I've had times when something falls on my keyboard and many events are triggered. If that button has focus, the edge case may manifest quite readily. I am sure other people have seen "StickyKeys" or "Dictation Assistant" type features that are sometimes locked on held down or >3n shift key presses by accident while typing quickly or playing a game. I do think Easter Eggs can be well done, but they are like animation - they need to have a purpose. Reward the user for poking around eclectic features, delight, don't jarringly surprise type deal. Jun 12, 2016 at 23:37
1

Several good answers, no point repeating what's been said, let me just add:

As others have noted, if management finds out about your Easter egg, depending on the personality of the managers and corporate culture, they may chuckle and compliment you on your cleverness, or they may fire you for making unauthorized changes to the software, or anywhere in between.

BUT ... if it turns out that there's a bug in your Easter egg that causes something bad to happen, like it creates a security vulnerability or a customer loses data, the laughter is going to come to an abrupt end. Odds are that you just did a quick test of the Easter egg, and presumably never told the QA department about it so they haven't tested it at all.

Someone on here said to consider the best case and worst case from your personal point of view: You get a chuckle for a few minutes versus they fire you. Consider best case and worst case from the customer's point of view. Best case: they find the Easter egg and get a little chuckle. Worst case: they find the Easter egg and then the software fails. The probability that the customer will say, "Oh, I lost all my accounts receivable for the last six months, but that sure was amusing to see a picture of the programmer and a funny message. It was worth it." ... odds of that are pretty much zero. And if the result is that the patient whose life support system this software is controlling died, or two trains collided because you introduced a bug in the traffic control system, etc.

Hey, I've gotten in trouble for making unauthorized changes to software that really did improve the functionality.

Yes, I've put Easter eggs in software myself. I wouldn't do it again without clearing it with management.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .