[exfascist]

They should have just removed the password. Default passwords are braindead. Default users really aren't that bad.

Fun anecdote: I used to log into people's Pis in college and show them that they needed to change the password. People don't react nicely to that.

[ape4]

Yeah, the BBC article referenced in that article is titled "Huge fines and a ban on default passwords in new UK law" https://www.bbc.com/news/technology-59400762

[op00to]

At my company pre-COVID if you left your pc unlocked, you’d get your nickname changed in chat to a specific code word so everyone knew you messed up.

[hoherd]

Send pictures of goats to goats@

Change their desktop picture to My Little Pony. (Some folks just left it.)

On macOS, put this into cron `5 */2 * * * sleep $$((RANDOM % 7200 )) ; creepily_say_random_words.sh` :

    #!/usr/bin/env bash

    words=$(awk 'BEGIN {srand()} !/^$/ { if (rand() <= .000015) print $0}' /usr/share/dict/words)
    echo "${words}"
    for voice in junior ralph whisper; do
        say -r 70 -v "${voice}" "${words}" &
    done

I was talking about this kind of thing with a US Santa Cruz researcher and she said they changed the default runlevel to 6.

[BLKNSLVR]

I thought you'd left the off the 'e' at the end goats, but no, you weren't that vicious, which is probably a good thing.

[doubled112]

Just when I think I've repressed these memories from back in the day, here we are.

[hprotagonist]

hey when life gives you lemons, know what you do? throw a party!

[0des]

Put a spin on it and have some meat at your party

[rollcat]

> Change their desktop picture to My Little Pony.

We've been doing this with pictures of Mariusz Pudzianowski (a Polish weightlifter), most people learned to set up their screen lockers pretty quickly. Definitely more effective than spamming people with reminders about security policy. Fun times.

[vmception]

Goats or Goatse?

If the former, we have different colleagues

[therein]

This is exactly what was done at LinkedIn back in the day.

[speed_spread]

Our trick was to use the unlocked account to message everyone on the general slack channel that we would bring donuts the next morning. The account owner was expected to commit to that.

[dividedbyzero]

What a great trick. You make an (effectively) inconsequential oversight, now you have to work for free for hours to days (pizza and drinks for 50-ish people was the worst I've seen), that's so clever. The best part has always been when they try to harass people into complying, especially the low-paid people with kids. /s

I'm glad I haven't worked at a place that had such informal "policies" in a while. There have been a few attempts by twenty-something engineers with no commitments to establish such rules, but the culture wasn't that toxic, so they (politely) got told to shut up, and that was that. People's desktop background still get changed sometimes, but respecting people's boundaries goes a long way to make work bearable for everyone. And even with desktop background pranks, if in the slightest bit unsure, communicate beforehand and accept a "no". And don't do what one guy at another company did and use a homophobic meme right before their victim's demo call with an important customer, or you deserve everything that happens afterwards.

[Wilya]

It is not an inconsequential oversight. Most people will at least have sessions open to internal/private systems, sometimes sensitive credentials. And part of the teams will go see clients with their company laptops. You absolutely do not want people to be careless about leaving their computers unlocked.

[dividedbyzero]

Hence the "(effectively)" in front of inconsequential. This isn't something that will definitely and automatically result in a lot of damage, it usually won't cause any damage at all (especially if people work on desktop machines in an office that opens to a small number of badges). It may be a vector for a critical breach if enough stars align, and there happens to be an attacker nearby that is motivated, capable and willing to take the risk, and the machine is completely unobserved for long enough, but for most people, that's going to be pretty rare. Setting a short non-overridable screensaver delay is still a good idea, and screen locking should be part of security trainings and all that. It's one possible vector for deep penetration and should be treated accordingly.

But if you're effectively harassing people out of a part of their salary, I'd expect the reason to be something truly overridingly critical, and in all settings where I've seen this sort of rule instituted, it was far from that – and if it were, why would you resort to bottom-up hazing to control that risk? That disincentivizes actually improving security (by giving people another pretext to depend on uncompromised user machines), oversights absolutely will still happen and any damage that actually does occur will be hidden and conceiled even harder, since now you've created an emotional link to public shaming and people respond to that viscerally.

[Cpoll]

> But if you're effectively harassing people out of a part of their salary

Don't you mean (effectively) harassing?

[speed_spread]

It was a grassroots honor thing, a game between willing participants. It was not a policy nor was it enforced. Not bringing in donuts would not penalize you in any way. There was no harassment, if you didn't manifest interest you wouldn't be picked on or left out of other (social|professional) activities. I honestly feel there was nothing toxic in the slightest in the practice, just good clean office fun.

Also, nothing was said about having to bring donuts for _everybody_. A single box of a dozen fresh assorted donuts left on the kitchen counter would do it. You'd then announce donuts to be available on a first come first serve on the same Slack channel and leave the hungriest ones fend for themselves in the hallways.

[op00to]

I enjoy bringing in bagels or donuts or whatever for my coworkers. It's a small expense that gets you huge benefits!

[LBJsPNS]

Damn, I'm glad I don't have to work with you.

[sdoering]

I remember a colleague had every document and a lot of stuff she was working on littered on her desktop. Nearly every little bit of desktop real estate was occupied.

Once, when again she left for lunch without locking her computer, a colleague of ours got up, made a Screenshot of her desktop, put everything on her desktop into the download folder and replaced the background with the screenshot. When she returned from lunch she was very quickly irritated that her computer had stopped working, as she could no longer click any of her files and programs.

It was a blast. And she never let her computer unlocked again.

[pid-1]

In mine we use to install a browser extension that changed all pics to Nicholas Cage pics. Users stormed in IT believing they were hacked. Fun times.

[jszymborski]

At my old workplace, it was called being "Donut'ed". You'd email or message "donuts" from the victim's computer, and they were meant to bring in donuts that week.

[nfriedly]

We do something similar only it's posting pictures of ponies to slack.

I also heard of one other company where the tradition was to send an email out to the rest of the company offering to bring in donuts.

[makeitdouble]

The mail thing was a long tradition, until HR stepped in to explain that technically it fitted under taking over a coworker's machine and mail account, and was off bound (e.g. clicking the wrong popup, or auto-completing the mail to the wrong address would turn the joke into more complicated things)

[Sparkle-san]

We would change your background to a picture of David Hasselhoff.

[hotpotamus]

We called it getting Hoffed. I assume it was a speedo picture.

[behringer]

These are all great ideas until one of your coworkers does something nefarious and claims they were just putting a silly nickname if they get caught;)

[hotpotamus]

These are a soft hazing ritual to remind you of good security practice to prevent anything nefarious from happening.

[leavenotracks]

Rotating their desktops by 90/180/270 degrees, and watching them trying to fix- priceless.

[qbasic_forever]

The pi is meant to be setup to a TV or monitor with a keyboard and mouse for a full interactive login. You need some way for a human to type in authentication.

[sokoloff]

Of the 20 or RPis I’ve used over the years, I think only my first one ever got plugged into a keyboard and display. All the others were setup with ssh only.

[exfascist]

If there's no password login doesn't prompt for one (you immediately get a shell after entering the user name) and ssh won't let you login. Removing the password is the correct default for interactive login on GNU/Linux unless you set up PAM.

[nonsince]

Yeah default users are fine, but the basic architecture of Linux (and, to my knowledge, all operating systems) means that there’s no meaningful way to create a user without creating a password, so you can’t have a default user without a default password.

[twic]

On the contrary - when you create a user using useradd, it initially has no password, and so cannot log in.

[jbaczuk]

prob similar to finding out you came to class without pants