Incredible story briefly detailed in NYT’s “Did One Guy Just Stop a Huge Cyberattack?” by Kevin Roose:

In the cybersecurity world, a database engineer inadvertently finding a backdoor in a core Linux feature is a little like a bakery worker who smells a freshly baked loaf of bread, senses something is off and correctly deduces that someone has tampered with the entire global yeast supply. It’s the kind of intuition that requires years of experience and obsessive attention to detail, plus a healthy dose of luck.

This could have been an unmitigated disaster. So much of the world’s infrastructure relies on random individuals being generally good or exceptionally thoughtful, in this case, the diligence of some dude who describes himself as a “private person who just sits in front of the computer and hacks on code.”

But, on the darker side: Given the seemingly miraculous nature of this catch, what are the odds there aren’t other backdoors already in place in our key systems?

From last year’s “Nutrition Science’s Most Preposterous Result” by David Merritt Johns in The Atlantic (“Studies show a mysterious health benefit to ice cream. Scientists don’t want to talk about it.”):

In 2004, the English epidemiologist Michael Marmot wrote, “Scientific findings do not fall on blank minds that get made up as a result. Science engages with busy minds that have strong views about how things are and ought to be.” Marmot was writing about how politicians deal with scientific evidence—always concluding that the latest data supported their existing views—but he acknowledged that scientists weren’t so different.

The ice-cream saga shows how this plays out in practice. Many stories can be told about any given scientific inquiry, and choosing one is a messy, value-laden process. A scientist may worry over how their story fits with common sense, and whether they have sufficient evidence to back it up. They may also worry that it poses a threat to public health, or to their credibility. If there’s a lesson to be drawn from the parable of the diet world’s most inconvenient truth, it’s that scientific knowledge is itself a packaged good. The data, whatever they show, are just ingredients.

The data are just ingredients.

The gaming company Valve started in 1996, became initially successful with the award-winning game Half-Life, even more famous for the early multiplayer mods/games Team Fortress and Counter-Strike, expanded to change videogame distribution with the Steam store/platform, made the innovative/beloved genre-bending puzzle shooter Portal, and even recently released the powerful handheld gaming device, the Steam Deck.

But in addition to (or perhaps, enabling) all that commercial success, they have an unusually flat organizational structure.

We could summarize the approach as: hire great people and don’t stop them from doing great work. At Valve, employees themselves choose what to work on and how to be valuable.

So, from–of all things–the Valve new employee handbook from 2012:

On Choosing the Right (and Right Amount of) Work

What about all the things that I’m not getting done? It’s natural in this kind of environment to constantly feel like you’re failing because for every one task you decide to work on, there will be dozens that aren’t getting your attention. Trust us, this is normal. Nobody expects you to devote time to every opportunity that comes your way. Instead, we want you to learn how to choose the most important work to do.

While people occasionally choose to push themselves to work some extra hours at times when something big is going out the door, for the most part working overtime for extended periods indicates a fundamental failure in planning or communication.

What a revelation: Working too much is a failure. Focus, flexibility, and rest are important.

If the work can’t done in a reasonable amount of time, then there is a problem somewhere in the process from the conception to scope to plan to execution.

Imagine the typical modern doctor charting at home on a routine basis after a full clinic day: this is an unadulterated system failure.

Dovetailing with Productivity is a Trap, this type of overwork often suggests that we are trying (or being forced) to do too many things. After all, good care is inefficient (also discussed here and here).

And while it’s not feasible in all work settings, at least for ourselves we can learn focus and self-accountability through the Basis of No.

On Failure

What if I screw up? Nobody has ever been fired at Valve for making a mistake. It wouldn’t make sense for us to operate that way. Providing the freedom to fail is an important trait of the company— we couldn’t expect so much of individuals if we also penalized people for errors. Even expensive mistakes, or ones which result in a very public failure, are genuinely looked at as opportunities to learn. We can always repair the mistake or make up for it. Screwing up is a great way to find out that your assumptions were wrong or that your model of the world was a little bit off. As long as you update your model and move forward with a better picture, you’re doing it right. Look for ways to test your beliefs. Never be afraid to run an experiment or to collect more data. It helps to make predictions and anticipate nasty outcomes. Ask yourself “what would I expect to see if I’m right?” Ask yourself “what would I expect to see if I’m wrong?” Then ask yourself “what do I see?” If something totally unexpected happens, try to figure out why. There are still some bad ways to fail. Repeating the same mistake over and over is one. Not listening to customers or peers before or after a failure is another. Never ignore the evidence; particularly when it says you’re wrong.

I like that Valve made a new employee handbook like this. How many jobs in healthcare have expectations and culture so baked in (and that anyone would actually read or believe)?

Cognitive bias is universal, but how you deal with it varies.  I don’t know if their culture of failure acceptance and learning works in real life as it does on paper, but something tells me people are more generous in this setting than the finger-pointing that our typical internal reporting and medical malpractice so often devolve into.

For reference on how not to create a culture of accountability and improvement: Simple Sabotage.

Growth is not a Purpose

We are all stewards of our long-term relationship with our customers. They watch us, sometimes very publicly, make mistakes. Sometimes they get angry with us. But because we always have their best interests at heart, there’s faith that we’re going to make things better, and that if we’ve screwed up today, it wasn’t because we were trying to take advantage of anyone.

We do not have a growth goal. We intend to continue hiring the best people as fast as we can, and to continue scaling up our business as fast as we can, given our existing staff. Fortunately, we don’t have to make growth decisions based on any external pressures—only our own business goals. And we’re always free to temper those goals with the long-term vision for our success as a company. Ultimately, we win by keeping the hiring bar very high.

The need for growth–growth as an intrinsic good, growth at all costs–has clearly ruined a lot of things. Compromising quality for growth poisons the well and destroys culture. It’s a short-term play that fundamentally changes organizations in ways that are often irreversible.

In healthcare, an old academic medical center turned into a sprawling regional healthcare network is almost unrecognizable. But there are so many other examples. The question we often forget to ask is: is this decision really good for patients?

In some ways, hiring lower-powered people is a natural response to having so much work to get done. In these conditions, hiring someone who is at least capable seems (in the short term) to be smarter than not hiring anyone at all. But that’s actually a huge mistake.

The typical business argument is: When you take a group of A-caliber people and hire a bunch of Bs, the non-stars don’t rise to the level of the old status quo, they inevitably drag the caliber down, bit by bit, hire by hire. If the argument that Bs hire Cs is true, then it’s no surprise that growth often results in dilution to the point of unrecognizability.

Steve Jobs, as collected in Make Something Great:

There’s a lot of management techniques. I’m sure you study a lot of management techniques. When I was younger, it was management by objective. It’s all a crock. They’re all after-the-fact management techniques: “You’ve failed, and I know that because we are going out of business tomorrow.” All after the fact. “You’ve ruined this department; all the good people have left. So now I’m firing you.” “You’ve accomplished none of your objectives.” It doesn’t work.

And a really smart guy I met a long time ago who used to teach at Disney University—Walt Disney recruited him to run Disney University, actually—he told me about his point of view, which I’ve remembered to this day. He called it management by values. What that means is you find people that want the same things you want, and then just get the hell out of their way.

The way I describe it is, let’s say we’re all going to take a trip together. The first thing is to figure out where we all want to go. The worst thing is if we all decide we want to go to different places. You can never manage it. [Pointing] You want to go to New Orleans. You want to go somewhere else. I want to go to San Francisco. You want to go to San Diego.

It doesn’t work. Right?

But if we all want to go to San Diego, that’s the key. Then we can argue about how to get there. [Pointing] You think it’s better to walk. You think it’s better to take a plane. You think it’s better to take a train. We’ll figure that [part] out. Because if I say, “I want to take a train to San Diego,” and somebody goes, “That’s really stupid! It will take three days! We can fly and be there in an hour,” I’ll go, “Oh. OK.” Because, actually, I want to go to San Diego. So if I can get there in an hour [flying], I’ll ditch my idea about the train.

That’s what management by values is. It’s finding people with passion that want to go to San Diego—who want to go to the same place you want to go to! Right? That’s the key.

When I think about culture as it pertains to medicine, and how large institutions falter, academic departments implode, and even smaller groups struggle, I think so much of it boils down to this:

There is no management technique to consistently make a group of people want to go to the same place after the fact.

Many management techniques and leadership styles can spoil a great enterprise, but perhaps none can craft one from an unformed mass of individuals, especially not the model of the business suit directing an army of practitioners.

The American Dialect Society chose their 2023 word of the year: enshittification.

From its coiner, Cory Doctorow:

Here is how platforms die: first, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die. I call this enshittification.

Think every social social media company, Google, Amazon, etc.

I first discovered Cory Doctorow eons ago via his unique science fiction novel set in Disneyland, Down and Out in the Magic Kingdom (which he somewhat famously simultaneously traditionally published commercially and also released for free in 2003 under a Creative Commons license, and which has been available for free ever since).

In unrelated news, Doctorow had a nice linkpost and summary of private equity and hospices last year.