Leave your screen unlocked, meet developers@paypal.com — Chovy's Blog

Leave your screen unlocked, meet developers@paypal.com

2026-08-16, by Anthony “chovy” Ettinger.

How this was written: drafted with an AI assistant from my own notes,<br>then edited by me.

The thread

Somebody dropped a post in one of those IT humor groups —<br>this one<br>— and the comments turned into a wall of 90s office war stories. Some of them were genuinely<br>funny. Not meme-funny. Funny like you were there and your stomach dropped a little because you<br>remembered doing it.

So here's mine, and then the argument underneath it, because I think we threw out something<br>useful when we cleaned all this up.

Leave your screen unlocked, meet the mailing list

The rule at PayPal was simple and unwritten. Walk away from your desk at lunch without locking<br>your workstation, and by the time you got back, an email had gone out from your account to<br>developers@paypal.com. Every engineer in the building. From you. About whatever your<br>colleagues decided you felt strongly about that day.

The classics were donuts — you have generously volunteered to buy them for the entire<br>floor tomorrow — and heartfelt announcements of a new personal passion you'd like everyone to<br>know about. The medium was the joke. It went out under your name, with your signature, into an<br>archive, in front of everyone whose respect you were actively trying to earn.

Nobody wrote a policy. Nobody ran a training. You got burned exactly once, and for the rest of<br>your career you hit the lock shortcut on the way out of your chair like it was a tic. I still do<br>it. I've done it in my own house, alone, walking to the kitchen.

Why that worked better than your compliance module

Think about the security training you actually get now. It's an annual slide deck with a quiz at<br>the end, and the quiz has a retry button, and everyone clicks through it in seven minutes on the<br>last day of the quarter while on a call. The threat is abstract. The consequence is a checkbox. The<br>feedback loop is twelve months long and lands on a compliance dashboard nobody reads.

Now compare the burn. Feedback in under an hour. Delivered by the exact peer group whose opinion<br>you care about most. Zero real damage — nobody moved money, nobody exfiltrated anything —<br>but a perfectly accurate simulation of what an unlocked machine is: a stranger sending mail<br>as you, to people who will believe it, and you have no way to prove you didn't.

That's the whole lesson of identity and impersonation, taught in one lunch, for free, and it<br>stuck for twenty years. The modern replacement is an MDM policy that locks your screen after sixty<br>seconds. Which is better engineering and worse teaching. The machine now protects you from a thing<br>you never learned to be afraid of, and the moment you're on a device the policy doesn't cover,<br>you're the same idiot you were in 1999.

The rest of the taxonomy

The screen-lock burn was just the enforcement arm. The broader genre, from memory and from that<br>thread:

The mouse ball. Pop the ring, pocket the ball, replace the ring. The mouse<br>looks perfect and does nothing. Later this became a strip of tape over the optical sensor, which<br>is the same joke with worse ergonomics.

Screenshot the desktop, set it as the wallpaper, hide the real icons. Watch<br>someone double-click a picture of their own hard drive for four minutes. Still, I think, the most<br>elegant one ever invented.

Rearranging keycaps on the machine of anyone who claimed they could touch<br>type. It was always fine. They could.

Tin foil. The entire cube. Chair, monitor, stapler, phone, plant. This took<br>four people and a weekend and cost about eleven dollars.

Call forwarding. Desk phone forwarded to the desk phone next to it, or on a<br>bad day, to reception.

Quake at 2am over the office network, because the T1 line and the machines<br>were sitting there doing nothing and you were on hour fifteen anyway.

After Dark flying toasters as the ambient background of an entire industry.<br>A screensaver you paid money for. Genuinely.

And around all of it: the server in the closet you could touch, the sysadmin with a pager, the CD<br>binder in the desk drawer, deploys that were an FTP client dragging files onto prod, and<br>&ldquo;webmaster&rdquo; as a real job title on a real business card. Somebody's whole job was the<br>hit counter.

What I'm not going to romanticize

Plenty of it was bad and I'm not interested in pretending otherwise.

A lot of &ldquo;pranks&rdquo; were hazing with better PR, and they landed hardest on whoever was<br>already the only one of something in the room. The all-night culture was sold as passion and was<br>mostly just unpaid overtime with a foosball table depreciating in the corner. The stock options were<br>confetti — I've written about<br>who actually didn't get any — and in 2001 the Aeron chairs got<br>auctioned off while everyone found out what &ldquo;at will&rdquo; means. The office was designed so<br>you'd never leave, and a lot of people didn't,...