2026-08-16, by Anthony “chovy” Ettinger.
How this was written:drafted with an AI assistant from my own notes,
then edited by me.
Somebody dropped a post in one of those IT humor groups —this one— and the comments turned into a wall of 90s office war stories. Some of them were genuinely
funny. Not meme-funny. Funny like you were there and your stomach dropped a little because you
remembered doing it.
So here’s mine, and then the argument underneath it, because I think we threw out something
useful when we cleaned all this up.
The classics were donuts — you have generously volunteered to buy them for the entire
floor tomorrow — and heartfelt announcements of a new personal passion you’d like everyone to
know about. The medium was the joke. It went out under your name, with your signature, into an
archive, in front of everyone whose respect you were actively trying to earn.
Nobody wrote a policy. Nobody ran a training. You got burned exactly once, and for the rest of
your career you hit the lock shortcut on the way out of your chair like it was a tic. I still do
it. I’ve done it in my own house, alone, walking to the kitchen.
Think about the security training you actually get now. It’s an annual slide deck with a quiz at
the end, and the quiz has a retry button, and everyone clicks through it in seven minutes on the
last day of the quarter while on a call. The threat is abstract. The consequence is a checkbox. The
feedback loop is twelve months long and lands on a compliance dashboard nobody reads.
Now compare the burn. Feedback in under an hour. Delivered by the exact peer group whose opinion
you care about most. Zero real damage — nobody moved money, nobody exfiltrated anything —
but a perfectly accurate simulation of what an unlocked machineis: a stranger sending mail
as you, to people who will believe it, and you have no way to prove you didn’t.
That’s the whole lesson of identity and impersonation, taught in one lunch, for free, and it
stuck for twenty years. The modern replacement is an MDM policy that locks your screen after sixty
seconds. Which is better engineering and worse teaching. The machine now protects you from a thing
you never learned to be afraid of, and the moment you’re on a device the policy doesn’t cover,
you’re the same idiot you were in 1999.
The screen-lock burn was just the enforcement arm. The broader genre, from memory and from that
thread:
And around all of it: the server in the closet you could touch, the sysadmin with a pager, the CD
binder in the desk drawer, deploys that were an FTP client dragging files onto prod, and
“webmaster” as a real job title on a real business card. Somebody’s whole job was the
hit counter.
Plenty of it was bad and I’m not interested in pretending otherwise.