A Positive Experience

A fair proportion of my posts over the last few years have been negative, covering technical issues or, latterly, employment disputes. In one in particular, I mentioned a new job in passing. I feel it’s time to expand on this, and describe why I feel that my new employer is the best place I’ve worked in so far.

The company itself is very small – some half-dozen people – and based in an office near to my own home. When I say “office”, I actually mean “purpose-built office over the MD’s garage at the end of his garden”, not “pokey serviced office with impersonal staff hanging around”. And “near”? My journey in to work takes me 7 minutes. As the crow flies, it’s a little over 450 metres.

The first thing that struck me when I arrived for my interview was the pool table in the middle of the room. I queried it at the time, as far too often these are mere decoration and last a few weeks; no, this was regularly used when one or two people in the team need 5 minutes time out. My past month bears this out, barely a day goes by without 3 or 4 games happening during an afternoon.

Things only got better on my first day. It’s standard practise (and, probably not appreciated enough) for a developer to be given a fast PC and two widescreen monitors, but this PC also came with my favourite accessory (which i’d noticed during interview and had made an appreciative comment about), a Microsoft Natural Keyboard 4000. As keyboards go I’m no connesseur (i cant even spell the word), but I’ve been a fan of this series since the first model.

Day two turned out to be pizza day, so the MD headed off to Costco, asking on the way out what my favourite snack happened to be. An hour later he returned, laden with pizza, big bags of coffee beans (for the office grinder, naturally), energy drinks for the non-coffee drinker, and a big box of Snickers to add to the piles of nuts, diet coke, crisps and Twix bars that my new colleagues variously favour.

There is work in amongst all of this, of course. As a .net developer my experience outside the Microsoft world is limited, but since starting I’ve been exposed to PHP and Yii, vast amounts of Grails, and even set up a Jenkins server to automate builds and rollout of C# REST services. But whatever problem I face, there is an existing team of developers able to help as I learn my way around.

In summary? It may have been a tough year getting here, but at last I’m somewhere that I think I belong,

Now, if you’ll excuse me, I have to get some sleep. The MD has arranged a karting session for tomorrow afternoon.

The Story Continues. Unfortunately.

This blog was never meant to be about my personal life. It was intended to give my views on technology and security issues, and how businesses within those sectors operate. However, events have conspired against me and it appears that what is foremost in my mind is not the Lumia 800 in my pocket, nor the iPad 3 I’m writing this on, but the much more complex subject of employment law.

At the end of my last post, I was just starting a week away from the office, on garden leave, before starting my new job. All was good, I was able to get some work done around the house (while making sure I kept myself available for work if called), and the sun even decided to shine. One week later, my final pay packet came through.

£600 short.

Taking advice from ACAS, I wrote to the directors reminding them that I was entitled to be paid up until the end of the month, and giving them a fortnight to react. With no response, I contacted ACAS again and took up their offer of their conciliation service, which attempts to resolve disputes through amicable means. Three weeks in, there has been no success (that I’m aware of at the time of writing), no payslips, no P45 and most importantly no payment.

In the past month, I’ve learnt a number of things about my former employer. Rather than admit to his own mistakes, my former colleagues were told that I was dismissed. And earlier today I had a phone call from a recruiter friend who’d come across my CV as it was a few months ago, and was calling me to ask if I’d gone out of my mind; I am far from the only former employee to have had a negative experience there, with tales including constantly late pay and all leave being cancelled at the last minute (including holidays booked and paid for months in advance).

I’ve also spent quite a bit of time reading up on employment law:

• I left with 2.5 days leave outstanding, but due to the distribution
  of bank holidays in the UK I am entitled to the pay for 3.5; I was 3 months into a calendar year containing 8 holidays and, with only one having passed I was entitled to be paid for one other.
• A company must give notice if they require holidays to be taken as part of garden leave. Needless to say, this notice has not been given.
• The concept of “unfair dismissal” does not exist until an employee has been working in a company for at least 2 years. In my case this does not apply as I had resigned, but even then notice periods still apply.
• Even when an employee is dismissed for gross misconduct, they are still entitled to be paid for the outstanding leave. There are literally no circumstances where is it legal to withhold pay in this manner.

In summary: my former employer has no right, whatever they may have decided to believe about the circumstances of my departure, to withhold around £1,000 of owed pay. It’s not a route I ever wanted to take, but unless there is a significant development tomorrow I will be forced to take them to an employment tribunal.

Update: Despite having tried to get hold of the directors of my former employer multiple times over the past few weeks, ACAS have been unable to talk to anyone capable of resolving this situation amicably. Their own rules do not permit them to identify themselves (except to the people they are wanting to talk to) as being from ACAS, but if you are ever left a message by someone “needing to talk about an urgent HR matter” and “not a sales call”, it’s a fair bet there’s trouble ahead.

So, notice to restore full pay has been given and ignored. ACAS conciliation service has, through no fault of ACAS’s, failed. Its now time to fill in ET1, and start the process officially. Wish me luck!

Resigned

In March 2012, whilst searching for a new job following the disappointment of ABCD, I was introduced to a company local to me. Research and interviews followed, and my instincts screamed out at me that these guys knew what they were doing, they were technical from the ground up with a business advisor who was generally recognised as an expert in his field.

This post is not about them; it is possible that the above may be the last thing I write about them. This post is about leaving ABCD.

I knew that resigning from ABCD would be a harrowing experience. Not emotionally, no: but because four months into the job I still wasn’t sure who my line manager was and thus who would handle any HR issues. Details like these are normally spelt out in detail within terms of employment documents, but I had yet to receive mine; indeed, the only details of the job I did have in writing (either paper or email) were my salary, holiday entitlement and the hours I was expected to work.

Notice period? No, that’s not there. Under UK statute – and, rest assured, I even telephoned ACAS to confirm – the minimum notice period an employee is required to give is just one week if no other time period is given. I wanted out of the company, I was far from being an essential employee in my eyes, and the sooner I could leave the better. The only project I had outstanding had barely a day’s work left on it, so even on moral grounds there was no reason to worry: I’d be saving the company three weeks of paying a salary to someone who everyone would know didn’t want to be there.

I decided that one certain individual, who had been responsible for my recruitment, was the most likely candidate, and addressed my resignation letter to him giving a final date of a week and a half away, to round it off nicely on a Friday. The letter was signed, left on his desk, and opened at 11am the next morning to much surprise and a little consternation; I was warned that the MD may take the “one weeks notice” element quite badly.

Various conversations happened that day, including one with the MD which went surprisingly well. He countered the offer with a promise of an immediate 5% pay rise, slightly shorter working hours and a chance to move to an architectural role and oversee changes to the whole project management process in order to increase efficiency. Had these suggestions been made several months before they may have been of interest, but they were too late now and, having been given 24 hours to consider, I was called into a chat between him and another member of the management team.

The chat they were having was positive; indeed, I was singled out for praise over the work that I’d been doing that was directly influencing clients into buying into the company. It started going downhill quite quickly though; the following is paraphrased but based on notes made about 10 minutes after the events in question. “OP” is the other person in the meeting, who I don’t wish to identify even obliquely.

Me: “I have decided, and I will be going with the other company”
MD: “Ok, I think you’re making a really bad decision.”
OP: “So do I.”
MD: “I think you’re making a really bad choice and you’ll end up regretting it.”
Me: “Yes, but that’s my decision.”
MD: (sigh) “Ok, that’s your choice, but at least we’ve got you for four weeks.”
Me: “No, I’m on one week’s notice”

A slight pause …

MD: “No, you’re on four weeks notice. That’s standard.”
Me: “I haven’t had anything saying I was on four week’s notice, and statutory is one week.”
MD: “OP, what did the offer letter say?”
OP: “I’m sure it would have said notice period on it.”
Me: “It didn’t. I’ve checked.”

At this point, the MD stopped and simply stared at me. I suspect he was trying to get me to back down, but this was one of those moments where rights needed to be asserted and I would not have put myself in this position had I not been 100% certain of my legal position.

A second or two later, with neither of us giving an inch, he played the only card he had left.

MD: “That is low, and you are the lowest. Get out. Get out now. Go and clear your desk. OP, you will escort him out of the building.”

I sat, slightly shocked for a moment that he could turn so cold, and at such speed, then stood up and walked out. Neither the OP nor I talked whilst I cleared my desk and removed my books, and said a brief goodbye to those left behind. As we walked to my car, he tried to say something and I suggested – nicely, he was himself quite shocked – that we wait until we were out of both sight and sound of the office, to avoid him being seen to do anything to raise the MD’s ire even further.

I was glad to go home, to enjoy a bit of time with my family and to work on my house, knowing that the decision I had made had just been justified even more than I’d even suspected possible. The OP, who I now know to also be job hunting, had to return; resigned to the fact that his life was just that little bit more hellish than before.

Maybe I was a bit hasty …

In October 2011, I accepted a job at a company I previosly referred to as ABCD. I had a number of reasons for accepting the job, not least of which was that ABCD were in the business of selling software to “big business”, and as a result had a vast number of three- and four-letter initialisations with the odd acronym thrown in. As a move from a company whose business model and management I had ceased to believe in, it seemed like the ideal opportunity to add a few useful phrases to my otherwise “small business”-focussed CV.

Of course, dreams can sometimes turn into nightmares. Rather than the model of ruthless efficiency that I expected, I was shocked to discover the number of areas in which ABCD could have performed so much better. In my four months at ABCD little changed, and for reasons that will be explained in a later post if change does happen it will not be by my hand. A few typical examples:

Source Control

ABCD use Microsoft TFS, in itself not a minus point. Unfortunately, at the point of initial setup it was misconfigured such that to edit code a developer must branch from the “tested” tree back into “development”, update all the version numbers, change permissions, and then perform their edits. Once fully tested, code is then branched back into “tested” with a new version number and the “development” tree cleared again.

Project Structure

The entire system contains some 50 to 100 individual Visual Studio projects, some of which are merely business classes to support a single UI project. No solution files are used (due to the paths to the projects constantly changing), therefore a developer typically has 3 or 4 instances of Visual Studio running.

Project Management

All work is managed through a central bug database, where a developer is assigned a “bug number” to work on (whether it is for a bug or a new feature). Through daily timesheets, which are emailed to the management team, progress is updated until the work is ready for “unit testing” – a document written by the developers that runs through a few basic tests of functionality that is then uploaded into the bug database to indicate that system testing can commence.

…

I could easily write a dozen more points, but all of these are issues that are put up with. People faced with situations like this can generally be divided into three separate groups:

• Those who are aware of the issues, and choose to do nothing;
• Those who are aware of the issues, and try to change them; and,
• Those who are unaware of the issues.

I try to be the second of these, however the most I feel I’ve been able to do is turn a few of the “unawares” into “aware but choose to do nothing”.

A company generally gives an employee three months to prove themselves before they are made a permanent member of staff. I’m a firm believer in the converse also being true: an employee should give an employer three months, in order to show that they are a company that the employee wishes to stay with. In my case, ABCD was sadly not a company I wished to stay with, and so in late February 2012 I updated my CV and returned to the agencies, cap in hand, hoping that mistakes such as this are lessons to be learnt from and not repeated.

Why Microsoft.VisualBasic should be buried

A friend of mine, who I hope won’t object to me recounting this anecdote, was recently posed the following interview question:

What would you change about the .NET framework?

To me, the answer was simple: I would deprecate the Microsoft.VisualBasic namespace with immediate effect, and phase it out entirely by the time version 5 of the framework was rolled out. It is a relic of a language that ceased to be ‘current’ 10 years ago, yet is still being actively used; even this week I have seen code, recently written to run under .net 3.5, actively using methods from it.

To understand the reason for it existing, it is worthwhile looking back to when .net was introduced. Microsoft was targetting two separate groups of developers: those coding in C or C++, for whom it developed C#, and those moving forward from Visual Basic 6. For this latter group, they included a number of VB6 commands, using them as wrappers around the .net equivalents; these were placed within the Microsoft.VisualBasic namespace, with it being automatically included as a referenced namespace in all new VB.net projects. As Microsoft go on to say in their page about Visual Basic .NET internals,

An important goal for Visual Basic .NET was to retain as much backward compatibility as possible, while providing more power and flexibility for the developer. This was accomplished by providing “helper” methods such as Rnd (which is a static method on an imported class) and intrinsic language features, such as CInt, to provide functionality identical to that of Visual Basic 6.

Unfortunately, not all VB6 developers embraced the object models available, and as a result far too many developers are still using the constructs such as CInt() as shortcuts to the .net equivalents. Those developers presumably assume that CInt(number) is equivalent to int32.parse(number) both in functionality. Nothing can be further from the truth; from the same page:

While there are a few specific methods that don’t provide the same performance characteristics as Visual Basic 6, you can fully expect that a Visual Basic .NET application will significantly outperform its Visual Basic 6 counterpart.

Our simple CInt() function performs a wide variety of options, covering parsing, boundary checking and rounding. Using it leads to inefficient code and, more importantly in my mind, developers who are unskilled in the wider concepts of OO within the framework.

Microsoft.VisualBasic is a relic, and deserves to be buried.

Lockdown

One of the nice things about being in a senior position within a small company is that, every so often, you come across a situation that happens so rarely that no documentation nor process exists, and it’s entirely your responsibility to work out from scratch what needs to be done.

Being the most experienced within the company on our infrastructure and security, it fell to me to write the procedure for ensuring that any individual leaving the company is locked out as securely as possible. As I write this, less than a day away from leaving my job at Acme, the person leaving the company – the person who needs to be locked out – is myself.

The standard technical parts are easy enough: change all admin passwords, change every single password in the Password Database (Yes, it will take a while. Yes, I did advise against it. No, I can’t help. Because then you’d have to tell me the new passwords!). But two major unknowns exist; one legal, one social.

Legal Lockdown

The legal part is relatively simple: make it clear to the soon-to-be-ex employee (STBEE) that they are no longer entitled to access the company’s systems by spelling out, in as much detail as required, that their access is revoked to:

• Any company system
• Any system run by the company on behalf of a client
• Any system run by a client whose access has previously been a privileged right of the company

except for those rights granted to any other anonymous or generic individual; this allows, for example, a STBEE to visit a former client’s website, but not to use any security credentials on that site that may have been supplied as a part of their employment.

It may be advantageous to get the STBEE to sign a document agreeing to the above, just to ensure their understanding is complete.

Social Networking

The social part is where the rabbit hole opens, and specifically social engineering. A company can spend all its time locking an individual out, but there is always the risk (depending upon the nature of the departure) of the user contacting third parties claiming to be acting on behalf of the company.

• How do you protect against a email being sent to your hosting provider, designed to match the style of your infrastructure manager but cancelling a client’s service?
• How can you stop a rogue employee contacting the IT department of your biggest client and creating a new account that acts as their backdoor?

The only chance that a company has to counter this is to make sure that the other usage of social is taken into account: communication.

• Ensure that all employees, clients and suppliers are aware that the individual is no longer an employee.
• Ask that any supplier always confirm any out-of-the-ordinary request, either by email or phone.
• Ensure that any change to any configuration or payment is fully understood.

It’s not perfect; time after time, social engineering has been shown to be one of the most dangerous types of hacking in existence and at the same time the most difficult to protect against. But through communication there is still at least a chance.

My Legacy

In July 2004, I was offered a development job by a start-up firm I will refer to as ‘ABCD’. I was sorely tempted at the time, however ABCD were undergoing a round of funding at the time and they couldn’t guarantee when I could actually start.

In August 2004, I was offered another development job, this time by a three-year-old firm I will refer to as ‘Acme’. Acme had a small team of developers already, were offering me the same salary as ABCD, and would let me start work as soon as internal issues (relating to the individual I was succeeding) were resolved.

In September 2004, I took a job working for Acme. A Delphi-based software house, the managing director was astute enough to realise that they were blindly following a dead platform, and I was tasked with leading the company’s development forwards. Within a fortnight, all the developers were on a course to assist them with transitioning to VB.net, and my work had begun.

Since then, I pride myself on the way that I’ve pushed the development within the company forward:

• The code was overhauled completely, migrating to VB.net where possible or providing (with a view to eventually ending) support for clients using existing Delphi software.
• As each new version of Visual Studio was released, it was evaluated and software slowly migrated onto it for continuing support.
• Where possible, applications were migrated to the latest version of the .NET framework itself, and to updated versions of SQL Server to take advantage of newer features.
• Seeing the potential drop in support for VB.net both from Microsoft and the community in general, I started learning C# in my own time and within a week was easily able to convince the MD that, for the benefit of future recruitment and support, all new projects should be written in C#.
• Spotted the advantages of object-based database models, and as soon as was viable dropped our database layer in favour of Microsoft’s own Entity Framework, giving us access to toolsets including LINQ.
• Saw the ease in which MVC allowed the splitting up between development and user interface work, and (having rejected the original asp.net MVC and MVC2) evaluated then adopted MVC3 for all future work.
• Kept track of best-practises, and whilst never dictating rigid development standards still ensured that all code would be written in a manner familiar to any other team member.
• Continuously educated the ever-changing development team about key aspects such as software security and encryption.

A year ago, a new member of staff joined the company. Claiming to have prior experience in development, he assumed the role of project manager whilst claiming a job title giving him overall responsibility for IT and Operations. It is this individual that I refered to in my previous posts of the Security Moron.

Within a week, he had sent around his former employer’s Development Standards document with a recommendation that we adopt it; not only was this document related to his former employer’s business but it also explicitly ruled out processes and procedures that we had adopted and were actively using, whilst making further recommendations that were nonsensible in our type of business.

Since that time, his input into development, albeit not as a developer but as an operations manager, have increased as his failings as a project manager have became apparent. I have already documented his failings related to security, but when it comes to development he required that certain processes become self-contained modules of work, with little understanding of how these could work in practise or of the downsides associated with them.

His plans for a ‘central audit module’ bore no relation to reality and thus when one was implemented to his requirements it was so non-specific that any output required further work, whilst the ‘security module’ written to his specification actually managed to increase development time considerably and leave code significantly less maintainable that if we had done without.

The one project that he was placed in sole responsibility for from start to finish is generally regarded as a flop; well over budget and currently on the verge of cancellation due to incomplete requirements (that I had been assured many months ago were “100% complete”). Today, we have been given notice by a client that I personally have serviced since my first day that they were taking development in-house after a year of incompetent support under his care.

Furthermore, the company as a whole is following a business model that I specifically recommend against in my previous post ‘Unsupportable Success‘; the managing director is willing to take on any work involving a support contract with no consideration as to who provides the support or even the hours that the contract covers.

A month ago, I was approached by a recruitment agency; a client of theirs were hiring and I may be a good fit for a role they are filling. Persuing this further, it turned out that the client were none other than ABCD (although the agency were unaware of my previous contact, and ABCD themselves had changed so significantly that my offer was a documented, but otherwise unmemorable, blip in their past). The interview went well – so well that, half-way home I received a call from the agency asking me to turn around and return for a second interview that same evening.

As of yesterday, it is now public knowledge within Acme that I have accepted an offer from ABCD. Within an hour, I was excluded from the ‘development team strategy’ meeting, and from now on the development within the company will be pushed forward by the Security Moron.

I had hopes, one day, that when I left Acme I would leave some sort of legacy, in that someone else would take over and push the development team forward in the way I have: my team contains a number of people, each of whom could easily fulfill that role. It is a standing joke within the team that everything the Moron suggests is prefixed with ‘in my old company…’, and the weakness in his technical skills are obvious to all. But with him assuming charge of development, any change will be despite, rather than because, of him.

I no longer have faith that the company will progress. I no longer believe in Acme. I will miss the people here, but I will not miss the company.