logoalt Hacker News

GuB-4206/17/20251 replyview on HN

And also a focus on security. Security people don't want to find anything unexpected in the code they run, and easter eggs are by nature unexpected, sometimes even well hidden.

I remember at some point, a contractor for a big company added an undocumented easter egg to the code they delivered, it was fairly innocuous, something like playing music when a special key combination is entered, and yet, it was treated like a security breach, as if it was a backdoor. I don't know if people got fired for it, but it is very possible.

This is a public API, so at least, it is documented, but even then I am sure that some very unfun security auditor will only see this as an increased attack surface.

Security may be necessary, but damn, it sucks! (not just for easter eggs)


Replies

spcebar06/17/2025

Oh man. Early in my career I was working a job I didn't like and doing work that was by necessity incredibly hacky and tedious—not an interesting challenge, just a grinding one. It involved overwriting template files that weren't supposed to be overwritten and essentially writing multiple versions of the same code in multiple places because the system was so kludgey.

This project stretched on and on with brutally painstaking iteration, long hours, fires happening with other clients, etc, etc, long story short, I sort of lost my mind and left an Easter egg comment in the code in a state of minor madness.

Years after I had left the job, I got a message from a former coworker that said "Do you know anything about MOOL?"

I said I didn't know anything about something called MOOL, and he said, the client had found a long diatribe about a bovine god named MOOL in an obscure template file deep in the codebase, and I said, "ah, yeah, that was probably me."

The head of IT for the former client had found the code and gotten in touch with my coworker and said, "I assume this isn't a security breach, but I also don't know what the hell it is." He thankfully had a sense of humor about it, and it ended up being a nice opportunity to catch up. Pretty much the best possible outcome.

Now adays I would never do that, after experiencing real security breaches and dealing with that nightmare. But it was fun knowing A. My ancient horrible code was still in production and B. The comment I had left, which I'd forgotten about, and probably assumed no one would ever read, had been found like a flag in the moon or at least a time capsule.