Hacker News new | past | comments | ask | show | jobs | submit login
[flagged] I will NEVER add such a privacy breaking a**hole feature (github.com/kimai)
106 points by ta_9390 9 months ago | hide | past | favorite | 44 comments



I didn’t quite understand the context so I looked into the Timedoctor software they mention. Timedoctor can be configured to periodically take a screenshot of your user’s (/employee’s) screen, so the boss can look back at what they were doing every e.g. 3 minutes over the course of the time they logged. They also offer continuous screen recording. https://support.timedoctor.com/knowledge/the-screencasts-scr...


I love how unapologetic the response is. Calling it what is, how it’s abused, and by whom.


I intentionally use screenshotting time-tracking software because it's nice to not have to worry about trusting my clients: screenshots add one more layer of legal proof that I'm actually working if they ever try to stiff me on payments.


Who controls the data? Are the screenshots sent automatically to the employer?

How do you handle the sensitive information (api keys, user personal data) that can be displayed in the screenshots?


I used to use the Upwork tracker a lot which sends the screenshots to a third party (Upwork) where both parties could view (or remove) the screenshots. Having some kind of trusted third party or paper trail (if sending by e.g. email) seems necessary to prove any potentially-produced-later screenshots were in fact created at the time of work.

It might be different for others, but for most sensitive data I'm privy to on a job (api keys, their users' personal data), my employer could or should already have access to all of that. I've removed the occasional screenshot that had a personal dev tool key or similar though. Typically all this should be covered by a contract with a client though; they shouldn't just be stealing API keys and whatnot from your screenshots...


> most sensitive data I'm privy to on a job (api keys, their users' personal data), my employer could or should already have access to all of that

It’s about storage though.

It’s one thing if your employer can access the data from an encrypted database with carefully managed access - and another to also keep it in a random screenshot in a third party time tracking tool.

There are also regulations and requirements, for example about deletion of personal data.


IMO, storage is an implementation detail that should be handled up the chain (by your tool or third-party service), rather than by you.

In the Upwork example, screenshots are already encrypted and only accessible behind authenticated flows in their site/app; can be deleted manually (e.g. after you've been paid and don't need them for liability reasons); and automatically delete after some period of time otherwise (6mo or 1 year IIRC).

There are probably plenty of other time-tracking tools that give you more fine-tuned control over the privacy of your screenshots if you want that, but I can't imagine it's something most freelancers want to spend much time on.


Ha I got started on the freelancer websites like Upwork where you have to install spyware that takes a screenshot every 10 minutes. Kind of depressing way to work but it did get me started with freelancing.


I'm sorry. hope you heal before start inflicting it on others.


I quickly moved to more trusting clients thankfully, and have never considered doing this to people working with or for me. :)


The most interesting part of this tool is that it has enterprise features and it’s still free. I mean why. You’re producing a product to handle large amounts of money and you don’t want a cut?


They offer a hosted version so they’re making money, even if they could earn more if they wanted.


Usually means they're getting paid in other ways.


Yeah really sounds like it ::eye roll:: https://www.kimai.org/en/about.html

Seems like it is just a one person project with donations and a paid SaaS tier if you don't want to role your own.


He should have added it but with a shutter sound and a screen flash for every shot taken.


And any station that can be monitored by boss station, can monitor boss station too.

Sure here you go, screen shots, live monitor, recording, audio too...but everyone gets it the same.


I’d prefer if every “screenshot” was generating an image with a terminal window with code from some random open source project. Bonus points for a matrix color scheme and some hexadecimal strings.


They have a great code of conduct as well: "Don't be an ass!"


He's not wrong and tracking your employees like that is actually illegal in Switzerland and probably other places as well.

In fact if you install security cameras in your work place they can not be used to track employees.

You are permitted to gather overall metrics over all employees but you can't track individuals. There are exceptions but only for very specific instances.

If you don't trust your employees to do the work then what guarantee do you have that they do their work well? This is how you end up with door hinges meant for the front ending up installed in the rear. Zero trust means their is zero incentive for the employee to give a shit about doing their job right.


Switzerland laws don't have an overall prohibition expressed that directly. Moreover the videosurveillance and system surveillance are treated separately even if some common laws apply.

The intent of the surveillance and the communication to employees is more relevant thant the technical means.

> In short, a surveillance system is prohibited if it is intended solely or primarily to monitor the actual behaviour of employees. However, the same system will not be prohibited if it is used for on legitimate reasons, such as ensuring safety or enabling the organisation or planning of work. However, the system chosen must be proportionate to the aim pursued and the employees must be informed in advance

https://www.edoeb.admin.ch/edoeb/en/home/datenschutz/arbeit_...


In Switzerland it is forbidden to have a dashcam or a video camera recording public spaces.

Last spring in Ireland we rented a cottage and then we discovered a video camera and could view some footage of us cluelessly strolling around the cottage. I had mixed feelings about that. Of course it's not a video camera inside, only the outside.


[flagged]


If you can't tell that your employees are actually doing work without one of these tools then what are you paying them for?

What computer job has no externally visible sign of work being done except "looks busy?"


And if people are resting and vesting, even if it’s not a pay issue, there’s definitely a culture issue in the company.

You also need good examples from leadership, good recognition of good work, good ways to provide both positive and negative feedback, good roadmap planning, choose the “right” things to work on that are both intellectually challenging and provide good value for customers, have good engineering processes in place that minimize gatekeepers and pedantic bikeshedding…

Not to say any of that is easy. Just that the natural consequence of getting too much of it wrong is that people just mentally check out.


I'm on a non-tech-related Vancouver discord server, and I can name 10 people on there who work in tech and actively try to do the least they can get away with at jobs, or work multiple jobs secretly, etc. and not one of them complains about money. You can no-true-Corporationsman it if you want but there are a lot of people who are naturally actively shady like that.


Doing the least you can at work is also called "meeting expectations." Why are you going above and beyond to create value you won't capture?

If someone is willing to pay you a lot for not doing much and is happy with your output then what's the issue? People working multiple jobs is typically a sign of hard work. They could be playing Xbox instead but they chose more work. Spinning working on things that no one asked you to do to fill the free time can't be better for you or the economy than doing useful work somewhere else.

Like yeah sure it's probably a violation of your employment contract or whatever but ignoring the rules is practically the west coast hacker spirit. And ethically I have no issue with it at all. You can pay for hours or output, when I meet my output goals the excess hours are mine back.

Folks will unironically joke "the reward for hard work is more work," put zero additional thought into it, work hard and wake up 10 years later burnt out, getting 2% raises, with their job consuming their whole lives.


I am kinda tiring of seeing this rationalization. Don't you see, it's on the company to fire you if your productivity is low! Feel free to do nothing or as little as possible! That's such trash.

If you're in software and are being honest you know we are not being paid for our output. Where are you working where the understanding is that if you get assigned a task for the week and finish it in one hour, it is common knowledge between you and your management chain that you have the rest of the week off and the CEO says "nice, see ya!"? Where your team says the same and doesn't look at you sideways? No, we aren't being paid for output, we are being paid for being as productive as we can (sustainably) for the generally accepted hours (9-5 or whatever your company says), and continually improving our skills. There is a general extreme difficulty to measure and track and enforce that (because as we all know, estimation is hard and shit happens) which is where trust comes in and why companies are so vulnerable to people working less and lying about it -- it's super difficult to verify.


> it's on the company to fire you if your productivity is low

That's not what I'm saying at all, I'm saying that if your company is happy with your level of output and it's in line with the rest of your teammates then why would they fire you? On principal? I absolutely work 20-25 hour weeks most weeks and I just got the highest marks on my performance review, a bonus for it, and a promotion last year. Why in god's name would I work harder? What could I possibly gain by setting the bar higher for myself? My employer is extremely happy with the value/$ they get out of me and I'm extremely happy with the work life balance it affords me.

And my team doesn't look at me sideways, folks duck out early afternoon all the time. My department doesn't even schedule meetings after 3pm because people will be gone. And I can't speak for other teams but my direct manager has a rule to not even bother putting in PTO if it's less than two consecutive days off. And my work bestie does 2-3 hours of away-from-desk charity work during the day and he's our resident 10x developer. I realize where I work is essentially a unicorn of sanity that actually believes in work smarter not harder but it's hard to look at other workplaces and say we're the crazy ones.

You are nonetheless right that it's an informal policy that our CTO/CEO look the other way on but it's hard to argue that it isn't incredible for retention.


Wanted to chime back in to say I agree with you here and on your previous reply.

I should’ve been clearer but I was talking about if the resting/vesting is endemic. Yes, there are always going to be people who will skate by as easily as possible. Hard to avoid completely in a gold rush, but I do believe that a company with better culture can suss it out better.

I do think there’s a limit to how much more work should be taken on once you finish planned tasks, but that doesn’t mean you shouldn’t do anything either. People saying that are, like you said, just rationalizing their own lazy/exploitative attitude.

It’s perfectly reasonable to expect someone to try to get ahead, and keep a company as competitive as possible, if they’re able to finish tasks faster and still staying within a healthy set of working hours. Nobody is asking for 80 hour weeks here. 20 is just unreasonable as 80 when you’re making a ”full time“ tech salary.

If you’re vesting, it’s in your best interests to stay competitive. Otherwise you’re riding on your coworkers’ coattails. All while probably complaining about the ultracapitalism of the C-suite. They’d step into their shoes in a heartbeat.


>I do think there’s a limit to how much more work should be taken on once you finish planned tasks, but that doesn’t mean you shouldn’t do anything either. People saying that are, like you said, just rationalizing their own lazy/exploitative attitude.

You can call it rationalizing and exploitative, I can call it tit for tat on a skewed power dynamic. I've never been rewarded and have in fact been punished for taking the initiative, so I learned to just lay low. I'm laid off either way, what's the point?

>if they’re able to finish tasks faster and still staying within a healthy set of working hours.

spoiler: it's never a healthy set of hours. You're describing a just world and I've seen those same 80 hours workers laid off after draining themselves dry as well. Loyalty isn't rewarded.

>Nobody is asking for 80 hour weeks here. 20 is just unreasonable as 80 when you’re making a ”full time“ tech salary.

if you want hours, pay hourly. It won't fix the issue here, but the whole point of salary is that you trust workers to be available in working hours and get assigned tasks done, not have a but in a seat for X hours a day. If someone finishes in 20 hours I don't see why they are "rewarded" with twice the work for not twice the pay. You can increase their workload if you want in the next meeting, but well: that's a good "reward" huh?

>If you’re vesting, it’s in your best interests to stay competitive. Otherwise you’re riding on your coworkers’ coattails.

I'm much closer to someone working 80 hours than a vester, to my dismay. But as a hot take: not every software company needs top engineers. If you can coast and make widgets for 20-30 years, that's fine. Not everyone is going to have the same passion for their career. But passion doesn't correlate with productivity, that myth needs to die.


> the whole point of salary is that you trust workers to be available in working hours and get assigned tasks done

This is becoming a popular framing but I see no reason it should be accepted as ground truth. If you’re paid a full time salary, you can be reasonably expected to actually do work, full time.

> If someone finishes in 20 hours I don't see why they are "rewarded" with twice the work for not twice the pay.

Because you already signed a contract saying you’d get paid X on a full time basis. Maybe try adding a doubling clause to get to 40 hours per week and see how it’s received.

I’m not even opposed to taking down weeks. I do that. Sometimes life gets in the way, someone’s you feel less motivated. I’m not talking about sick/PTO, I’m acknowledging that nobody can fire on all cylinders all the time. I also have weeks where I am on fire and get a lot done because I just want to.

But it seems to me that if this happens:

> You can increase their workload if you want in the next meeting

You’d be upset, or deceitful, in order to maintain your half-time effort always and forever, which I don’t think is ok. Someone above mentioned working second jobs, which yes, is working hard, I’ve done it, but if it’s being hidden from someone that thinks you’re working full time, that’s not ok. In fact it distorts market expectations with invisible parameters. It makes it worse for everyone else.

It sounds like your work situation sucks right now, I get that, I’ve worked bad jobs. But I think you would be wrong to carry such a cynical and jaded mindset into a place that actually respects you and wants to work together. Granted those are very hard to find, and in any company of more than like 20 people you are guaranteed to run into an asshole and the best you can hope for is to find a little oasis of a team within. Just don’t take advantage of that team if you’re ever lucky enough to find it.


>but I see no reason it should be accepted as ground truth.

Even if you ignore the moral reasons, it's for logistical reasons I just explained. I don't know why it's expected that your best workers will do their best work while being paid the same as "good" workers. Companies promote/bonus less and can layoff at any time, so there's in fact negative incentive for the best workers to do their best. They will either coast at some point or get snatched up by someone else (another aspect which companies accept for asinine HR reasons. Again, no retention budget, healthy hiring budget).

>Because you already signed a contract saying you’d get paid X on a full time basis.

No, I signed a contract saying I'd be paid X bi-monthly/fortnightly with expected working hours and some arbitrary standard of performing well. I can dig out my contract if you want the exact wording, but there's no expectation of "hours worked" on a salaried position. That's the whole benefit of salary; if I need a shorter day/day off I don't get dinged for hours not worked.

>You’d be upset, or deceitful, in order to maintain your half-time effort always and forever, which I don’t think is ok.

And I'd be upset to get more responsibilities for the same pay. I just see it as tit for tat. If companies incentived best workers somehow (i don't care how, encouraging days off when expected tasks are finished, small bonuses taken into account in review. Anything that doesn't try to put down other workers at the same time) then I'd sympathize more. But as I said that retention mindset has been slipping.

>Someone above mentioned working second jobs, which yes, is working hard, I’ve done it, but if it’s being hidden from someone that thinks you’re working full time, that’s not ok.

Depends on the working hours. Moonlighting =/= having a second job. I have some nightly freelance work I do after hours and that should not be looked at by my employees because it's no longer their time.

I don't approve of overlapping jobs in the same time slot (and frankly, that'd be a disaster to try in my industry) but I also don't think it's the most absolute evil strategy if you can choose more lax (likely non-tech) companies. I've even thought about two part time jobs myself, but tech part time seems extremely rare, for the extremely in demand.

>It sounds like your work situation sucks right now, I get that, I’ve worked bad jobs.

Well, I was laid off twice in 8 months, out of a job for 7 months (3 by choice) until I grabbed a part time role by complete luck, and am still looking for a full time job in a shitty market where 80% of my recruiter calls don't even get to a hiring manager, likely because I'm in that weird "between 5-10 years experience" in a market where large studios are on hiring freezes and small new scrappy studios want someone with a little more experiene than me (or Idk, maybe a lot. Maybe there's more 15-20 YOE out in the deep than I expect).

By this point I'm just thinking about taking some blue collar job and riding this year out because I'm so tired of interview calls going nowhere. I can frame the part time work to cover my gap so that's not an issue. So yes, to say I'm extremely biased is an understatement.

But I'll have you know that all my ire comes from management and above. I've loved pretty much every team I worked with in the day to day, and I've been blessed in that regard to have minimal (employee) office politics given my industry stories. Which is why I describe myself closer to a "80 hour work weeker" (note: I never actually worked 80 hours in a week. More around 65 at worst) to a coaster. I don't want to let my team down and I'm not some hotshot SWE that can do that work in 20 hours anyway.


>I can name 10 people on there who work in tech and actively try to do the least they can get away with at jobs

so, "doing their job?". They aren't paid nor incentivized to put 100% into work.

>or work multiple jobs secretly

if there's no moonlighting clause, I don't see the issue. The company doesn't control what I do outside of work.

>If you're in software and are being honest you know we are not being paid for our output.

it's not a software issue, it's a "salaried worker" issue. And that's part of the issue. If you get your work done in 60 hours a week, no one bats an eye (and sotware has specific exemptions from overtime pay). If you get it done in 20, you just get 20 more hours of work. You are not relieved for overtime, but are still expected to give 40 hours of work for being "too fast". The structure is flawed unless your company has a profit sharing program or something (90% of workers are too insignifigant in company impact for most stock options to matter).

>No, we aren't being paid for output, we are being paid for being as productive as we can (sustainably) for the generally accepted hours (9-5 or whatever your company says), and continually improving our skills.

If I wasn't laid off every 2-3 years, I may actually believe that. But it's become clear these days that the company does not care about growth nor retention. If I'm kicked out in a few years regardless of performance, what's the point? They are just draining my time and labor and giving nothing extra in return for "excellent performance". They may even punish me for it.

You get what you pay for. And some things matter more than raw salary. Companies can complain about "trust" all they want, but they sure as hell burned their trust with me. It's a two-way street. if you want my full productivity, incentivize it instead of punishing me for doing exactly what you asked to do.


All software development? You can work at 25% pace and get away with it at most places. Sandbag, attend lots of meetings, be "blocked" by things often, etc. It's not about literally producing nothing, it's about working from 11-2 (or whatever, depends on what these people try to get away with)


Middle management.


I don't agree with it myself...

... but more often than you would hope any maintenance work is considered like this. System maintenance, codebase maintenance. Even some sorts of support too.


Maybe start corporate-friendly fork


So is this like a remote administration tool then? Since I'm assuming you'd want to trigger the screenshot remotely from a central server that manages kimai clients.


"Kimai is a free and open-source project time-tracker."


Yeah I noticed that, which is why I'm confused about this screenshot feature being invasive. Unless it's remotely managed, it would only be screenshots taken by you, and stored by you, in your time tracker.


Things don't need to be remotely managed for the user to lack control. The client software could take periodic screenshots during tracked time which are sent along when the user reports their tracked time.


That would make it centrally managed. Unless the user can override this configuration, we're talking about remote administration. Either through this tool, or through some other tool that deploys it and ensures the user cannot change it.

Kudos to the developer for standing their ground, but if we're talking about a remotely managed client computer then I don't think there's much the user can do to protect their privacy.


It sounds like adding this feature would turn the software into something you consider remotely administered.


I'm interpreting it more like this is a standalone locally managed program, the user would like a screenshot feature in it.

But if you add remote management around it then this screenshot feature can be invasive, but then again so is the management software that prevents the end user from changing the config.

So the way I see it, the developer is getting upset over something they'd be unable to control.


It is not a standalone program. It's a hosted service.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: