[lhorie]

Github 2FA has been part of the first-day training/laptop setup for a while now (I joined in may) and there's security-related training in place as well. I was told there are also scanners in place now that check repos, gists, etc for secrets for exactly this type of mistake.

One snippet of the email the article didn't mention was that Sullivan's firing happened pretty much right after Dara learned of the breach and an investigation was conducted. It definitely inspires more confidence in leadership seeing that the CEO will not tolerate unethical behavior.

[msh]

Uber will not tolerate unethical behavior, you got to be joking!?!?

[lhorie]

I think many people don't realize this, but the majority of the leadership team from like a year or two ago is now gone, including Travis.

Also, Uber has been hiring a lot of new people - the ratio of new people vs old timers is really high. I'm obviously just one anecdata point, but I believe new hires (and a lot of old timers) want Uber to be an ethical company, and many have joined the company specifically to tackle that challenge. One great example that comes to mind was when one board member made a sexist remark on an all-hands meeting a few months ago and by the end of that same day, Liane Hornsey (who had just joined as the new head of HR) had him give up his seat.

There's a big push towards trying to make things right, with the holden report, the 180 days of change campaign, the implementation of new training courses, anonymous complaint hotline for employees, etc. And the unspoken message right now is pretty clear: inappropriate conduct _will_ get you fired, even if you are the head of your org.

Obviously there's still a lot of work to be done, but I think we're at least in the right track now.

[tonystubblebine]

I really like how your description gets at these policies creating a tipping point in the culture. Hearing about any one individually always sounded like a bandaid, but hearing about them together and then how you and other employees react to them is very encouraging. Good luck to you and the rest of the company.

[drawnwren]

This is good for Uber and their employees in the short term, but I can't help but think it's bad for their ideals in the long run. There are a lot of scenarios that look very bad for Uber economically and it would be a shame for a culture shift to coincide with the realization of one of them.

[lhorie]

Honestly, I find that a lot of economic discussions on the media are highly speculative (and dissonant to what I've seen circulated internally), and things get just downright sensationalist on some topics, so I've been taking news about Uber with a large grain of salt.

> it would be a shame for a culture shift to coincide with the realization of one of them

I think everyone at Uber has at least some idea about the P&L situation, but there's no doubt in people's minds that we need to drop the go-fast-and-dubiously culture and embrace a do-things-properly culture. If anything, I think it's more likely that a major crisis would continue to drive home that idea.

[brianpan]

I think the commenter meant the new CEO will not tolerate unethical behavior.

[ibmthrowaway218]

The new CEO will not tolerate new unethical behaviour.

Hopefully he will also slowly eradicate the existing unethical behaviour.

[katastic]

The new CEO will fix everything just like the last 3 GM CEO's changed their corporate culture and stopped them from making cars that kill teenagers...

... crap. My kids won't be buying a GM car.

[pc86]

The downvotes are likely because you're taking an Uber thread veering it off to GM's management and your children, neither of which have any relevance here.

[katastic]

Except for the CEO being changed and having a toxic corporate culture that didn't change and produced the same deadly car across CEO's after promising change but did nothing different--including not stopping production of a deadly vehicle.

I probably should have spoonfed the readers more. They grew up in a world that doesn't need critical thinking anymore so it's probably too much to ask for their brains to activate while reading on a website and have them put distinct ideas together to form a grander one.

Must. Downvote. Comments full of facts but from people I dislike. Must.... errooorrrrroooorrrrrr. 505.

It's okay. Every time I see downvotes here, I know I said something great but I just pissed someone in power off. I'm used to being a minority oppressed by a majority in power. It's no big deal. The system just builds people like that these days.

[WillReplyfFood]

Americano Saviour Complex at work: Someone will come, a stranger in our midst, and will make the problems go away. Preferably with a gun and a swoard.

Its always a person, its never a institution, or organisation, never a boring measurement like bureacratic oversight or well made laws.

[perfmode]

its possible and even likely that this happened post hack.

[lhorie]

True, I just wanted to shed some light into the current state of affairs in here.

[slackingoff2017]

Found the newest marketing hire...

[igorgue]

Hah, setting the example himself I remember him yelling / and cursing at an Uber driver in NYC, very ethical.

Good luck and I hope you're doing it for the money, cause nobody should buy the "Uber is an ethical company" bs.

[lhorie]

Dara Khosrowshahi is the CEO now, not Travis Kalanick... Maybe catch up on the facts before reaching for the pitchforks? :)

[sebleon]

Ha, the trouble is that pitchforks are more fun than facts.

[sAbakumoff]

Are you using Github Enterprise? Is it available from outside of the uber network?

[lhorie]

We primarily use private phabricator and gitolite instances for internal stuff, but we also have OSS things in regular public GH repos. We do have a few private GH repos, but AFAIK, you're not supposed to version control internal stuff on GH, and there's no real reason to use a private GH repo, except for legal review prior to open sourcing.

I don't have any context on why someone would have put production secrets in a GH repo. If it had happened in my team, I would definitely have sounded the alarm at code review.

[johnhenry]

Just curious, are you speaking as an Uber employee

[lhorie]

Well, I am one, but the things I say here are my individual opinions and observations. I just think that as an insider I get some insights that you'd normally not get from the media, and I figured I'd share them.

[ggggtez]

I'll believe it when they stop having stories like this every few months. They had over a year to report the breach, and they paid hush money instead. Typical Uber

[lhorie]

> They had over a year to report the breach, and they paid hush money instead.

Yeah, I'm totally with you there. Not cool :(