If a company is not even willing to have a real person speak to you at the start of the recruitment process, what does that say about them? Or about the legitimacy of that job posting? Or about the people you would be working with if you did get hired?
Regardless if you get an offer or not, you will invest a significant amount of finite time in each interview cycle and if you do get an offer, you'll be investing even more time into that company.
So no matter who you are, protect your time and remember that interviewing is always a 2-way street.
Are you familiar with the concept of a recruitment funnel? It is not financially worth it to personally talk with every single person that applies to a company.
Well then it's not financially worth it to have a job, because every company does this because if they didn't they'd need to triple in size with recruiters.
Something must be wrong with this logic because it clearly is financially worth it to have a job.
> Well then it's not financially worth it to have a job, because every company does this because if they didn't they'd need to triple in size with recruiters.
Every company does not do this. I always refuse tasks like this unless I've talked to a human before hand, as unless the company has invested a little effort, then I won't invest any effort.
After you've filtered down the resumes, if it's not financially worth it to put a human on the phone for the initial screen, that means you don't value the people you hire.
And if the cost to do that initial screen is almost zero, it also means that you may not even have a job opening and are just testing the waters.
out of the list under "Before you start with the test, you might be suspicious about the following:" there is only one that is important:
only interact with people using an official email address.
the rest can be used as yellow/red flags, but simply asking for confirmation via an official email address will thwart the vast majority of scams (including other ones, like someone claiming to be from Intuit calling about your QuickBooks or whatever).
I have seen official company recruiters operate exclusively through Gmail or whatever. Third party headhunters may not have anything tied to the sponsoring company.
It is a decent rule, but one which is immediately thwarted by companies going out of their way to constantly look illegitimate.
not OP, but because I've looked for a job previously and have experiences with recruiters like that which ended up at a legitimate offer at the companies they claimed to represent?
> only interact with people using an official email address.
And then google whether the domain is associated with phishing attempts. i've been targeted several times recently by folks with "official" email addresses but whose domains are (per google) strongly associated with phishing.
> simply asking for confirmation via an official email address
There are some smart new scammers who now create a lookalike domain which either redirects to the original or shows a fake corporate portal. How could a random interviewee know whether john at strinlaicorp.com is real or john.s at strinlai.net is fake?
I get enough legit and illegitimate ones every week on LinkedIn that it's become really easy to tell the difference. Hard to pinpoint in a comment because it's mostly a gut feeling. But, in rough order:
1. Look at the person's LinkedIn profile contacting you and examine their post history. In one comical scenario the "recruiter" had a long 4 year gap where they were writing comments in English and all of the sudden they switched to Spanish. Mostly short, pointless comments as well.
2. Look at the company and make sure they have a legitimate website and are still actually in business. Even better, see if there's a public team page that lists this person.
3. Give the recruiter an email (I usually use something like SimpleLogin) and ask them to forward you the details. Of course, pay close attention to what address they send it from.
4. In addition, or alternatively, ask the recruiter for the public job listing (scammers almost always "paste" it into a DM or upload a clearly AI generated PDF doc).
Once you learn the game it's not too hard to start picking up on them. I've made it a game to play along sometimes just for fun. Ultimately, at the end of the day, make sure you report them on LinkedIn. I've had the account disappear within a hour of doing so.
Honestly unless I'm planning on quitting my current job, or if I were unemployed, I just ignore the linkedin.
Sure they spam you with "XX wants to connect", or "I'm awaiting your reply" emails. But real contacts and friends can call/email you, and everybody else can wait six months.
Despite only connecting with actual people I've worked with, not recruiters, I still get "suggested" posts which are slop, and "that happened". The site is a cesspool.
I got my last two jobs from recruiters contacting me via LinkedIn. I've also kept in touch with a good group of recruiters over DMs who regularly bring me new offers. My experience might be unique, but I've gotten a lot of value being on LinkedIn. I don't interact with the social part of it (posts or whatever they are called) at all.
I deleted my account after I got my first job offer and have never used it since.
If people dislike the site so much, I don't understand why they don't delete their account. Is there any value provided, or is it the fear of missing out on potential future value?
Every single job app I filled out in the last two years asked for my linkedin url. I don't know if not having one was disqualifying, but it does worry me.
It's not disqualifying, but not having a linkedin is a signal that could drop you towards the bottom of the resume pile. Companies have problems with fake applicants, and ATS systems do create "how likely this person is a human" scores. Having an online identity is one signal, and for better or worse, that is often a LinkedIn history.
Like a fico score, you can't escape the game if you want to play.
linkedin is a mess. there was a glorious ~5 years in the late 2000s to ~2015 where it felt like it could and would work -- I know people who got hired and through it and I got one legit interview
My first thought after reading the article: develoepers NEED to learn to use firewalls such as LuLu(https://objective-see.org/products/lulu.html) to get interactive dialogs asking whether any given binary can access any given internet address whether it is a domain address or IP address (which can seem even shadier).
I am an Emacs user but every time I have tried a new editor, including VS Code or VSCodium I blocked access to remote addressed which were prompted to me even though I did not neither authorize extension download nor extension download.
I think it would have been even funny for devs trying out for code challenges while using "interactive" firewalls such as LuLu, then catching the shadiness and blocking access right up.
This really is the simplest path to somewhat decent security, and alongside it you may catch some programs doing requests that are fine for security but you'd rather it not do because of privacy.
The line between privacy and security is very blurry. Consider this: if Microsoft exfiltrates your keystrokes, it's a privacy violation, but if a random person does the same thing then it's a security violation. You might say that the random person is more likely to use it against you, but then the car insurance companies mining your driving data absolutely do use it against some customers, but that's generally considered to be a privacy violation rather than a security violation.
No, we really need to stop using weasel words and call it like it is: Windows is malware. Microsoft has illegally hacked billions of computers, and gets away with it by being a big company and by the world having gotten complacent with big companies constantly hacking everyone they can.
> Consider this: if Microsoft exfiltrates your keystrokes, it's a privacy violation, but if a random person does the same thing then it's a security violation
No, it's a security violation no matter who does it.
There is a YC company that makes a coding interview tool. They want you to run their CLI on your machine and trust that it won't do anything malicious, when in fact it installs a bunch of things onto your machine without consent, scans processes, and intercepts requests from AI tools. It's crazy that people think this is acceptable.
> Just that fact that the company expects a candidate to even have their own machine is egregious.
In the company where I work (in recent history, the most valuable company on the planet), there are younger employees who do not own personal computers.
One of them was (with different company now) a Gen Z developer who did not personally own a computer (besides a phone).
Why? There were a lot of people who didn't own a personal computer before 2000 too. It just wasn't needed. And nowadays, it also isn't needed, albeit for different reasons. The time window where it was actually a reasonable assumption that someone has a computer at home was relatively short.
Exactly - personal computers are really just a very "millennial" thing. Only (very) late GenX and millennials grew up with, learned on and interacted with PCs on an hourly basis. By the time GenZs came knocking around, consoles and mobile phones took up the slack, while shitty Chromebooks at school and Google Drive mostly filled in for office-related software.
> > One of them was […] a Gen Z developer who did not personally own a computer (besides a phone).
> > I was floored. Still am.
> Why?
My personal computer is how I learned to be a software developer and how I continue to improve as one. So, it astonishes me that a software developer by trade doesn't own a personal computer.
To help separate my reaction from my personal bias (yeah, not possible), think about how you might feel upon discovering a professional cyclist who did not own a personal bicycle.
Cycling is something your body must physically practice in as close to race conditions as possible to get good results. Programming is not, it's all in your head so to speak. I've been programming from my phone as early as 2013. Yes, I also did program on my PC, but mostly because I already had a PC for unrelated reasons.
A better comparison is a professional influencer. You'd imagine someone posting high effort videos 5-10 times a week would at least have a video camera. Wrong. Most do it with their phones only, that's been the standard for around a decade. If you think about it, why would they buy a video cam? What benefit would be in it? The same thing is now happening with programming and laptops (let alone desktop PCs). It's only bizarre if you live in a world where there's no viable alternative.
It's just another form of authoritarianism, despotism, and oligarchy. Who decides what work is worth rewarding? What about the type of work?
It was always an antidemocratic idea sold to tech workers to stop the idea of questioning the system.
The idea that simply "talented" workers should rule just seems to speed run towards fascist aims. How do you consider which workers are worth more than others? If you do to the wrong school are you suddenly worth less? Do you think society will have certain preferences? What about in our neoliberal society where money is the only purpose to life?
Corporations are the last authoritarian forces we willfully allow to dictate how we live our lives, I think anything to dismantle their power is worth pursuing. If democracy is good enough for states, it should surely be more than good enough for the economy.
As someone who is a big fan of consensus and voice, I don't see how current corporate leadership could get worse if more workers inside the company had more opportunities to direct its future. It's their future too, they need a say and telling people to just leave goes back to the neoliberal decaying value of money above all us.
At the risk of being accused of reductio ad absurdum - do you want companies to be run like American HOAs? If so, do you expect the results to be the same or different than with HOAs?
There are, if not millions of HOAs, surely at least one hundred thousand, but you only hear about the ones being silly.
It's a bit of a lazy punchline, especially because HOAs are one of the purest forms of democracy, they really only exist (barring certain corporate controlled ones that I don't think count) because the people there want them to.
It's not a punchline at all. If HOAs are pure democracy, and businesses should be as democratic as possible, then naturally the ideal structure of a business is very close to HOA, if not identical to HOA.
As far as I know, the vast majority of HOAs fall into "exists only on paper" category, where they have virtually no rules and do virtually nothing except the basic necessities, sometimes they also maintain shared spaces and that's it. They don't even have regular meetings most of the time, only special ones. This is obviously not how a sustainable business can be run.
Of the remaining ones (which is a tiny minority of the grand total), the vast majority are exactly like the horror stories you hear - corruption, nepotism, stupid rules with selective enforcement, interpersonal politics getting in the way of actually getting things done. If a business was run like a HOA, since it cannot be the first kind, I predict it would usually devolve to this within a few years.
I honestly never heard of a single case where HOA 1) does a lot, 2) has comprehensive rules, 3) actually enforces the rules, and 4) isn't a horror story. So I really don't know how such a HOA would operate, what the governance structure would be, how enthusiastic people would be to participate and exercise their voting rights, or how it all would translate into a business. If you know of a case like this, or have a theory how it would play out, please share!
I think HOA discussion is rather getting away from the original point.
Presumably if you were running a corporation as a democracy you'd just go through the same basic stages as a city-state where you rapidly end up with representatives serving terms.
This sort of thing depends wildly on the size/number of people involved of course.
A 5-10 person company doesn't really need much in the way of a power structure, presumably everyone knows what needs to be done and you probably have different specialties anyways so you consult each other when required and then each person does their thing. Perhaps occasionally you need some kind of tie breaking vote.
A manufacturing company employing 50,000 people at every level from (ceo of 50,000 person company) to (effectively minimum wage bolt tightener) is going to need more authority explicitly defined and delegated.
Spending 5 minutes thinking about it, you'd pass the equivalent of a law saying "everyone in this class of (bolt tighteners) must work 20+ hours a week and gets paid $xx.00 an hour and so on and so forth and if they fail to adhere to this then x, y and z happens then get fired".
This law could be passed either by a direct vote or more likely created by a body of representatives.
I don't know offhand of any business that runs this explicitly as a democracy, there's various co-op businesses that do exist but I've never investigated how exactly they run these things.
I don't see anything stopping you from having a company that elects its ceo though.
Cooperation is easy when everybody cooperates and has the same goals. Even in a 100% privately owned company with strict hierarchy and egomaniacal CEO. The problems start when the goals stop aligning or people stop cooperating. And it doesn't sound like you paid any thought to what happens then in a democratic setting.
For example, those bolt tighteners. The joint vote by the tire balancers, CNC operators and facility maintainers has beat the opposition and a resolution was passed that excludes bolt tighteners from annual bonus. Or the bolt tighteners have joined with delivery drivers and passed a rule requiring a certain number of bolts in all new designs whether they make sense or not. Or a hundred other ways in which people can use their vote to put their own self-interest above the shared good.
What are the main forces that keep a democratic workplace like the one you described from collapsing due to bad votes and bad rules?
> What are the main forces that keep a democratic workplace like the one you described from collapsing due to bad votes and bad rules?
The same forces that keep autocratic ones from collapsing due to incompetent owners making bad decisions, which is to say, nothing at all.
I'm too lazy to look up actual stats, but its well known that "most" businesses fail, and if you extens the timeframe long enough they all fail, so this isn't really a problem I need to solve.
A more real problem, if you need one, is probably involving investment to create the company, but that's heavily dependent on the surrounding systems to begin with so where are we stopping this thought experiment?
You're looking at this at the wrong angle, a better lens would be: "can workplace democracy enable workers to live happier lives?" I think optimizing for collaboration, rather than dominion can only be seen as a good thing to allow humans to thrive.
Also why are you assuming that parliaments would be the dominating collaboration structure? Your imagination is vastly limited if you're only looking toward western examples.
At the opposite end, maybe a question to ask yourself if the current system is leading to good outcomes and for who because the vast majority of Americans are suffering as the result of our current neoliberal economic system that was forced upon us with no consent from the governed. Alternatives should be explored and giving voice to workers seems like the simplest thing we can do. People should be allowed to have a voice in the direction of their employment.
lol if you got HOAs out of that link IDK what to tell you. Workers should be able to vote for their leadership full stop, poor leaders can easily make their lives bad. Voice needs to have more place in the economoy, relying on just monetary incentives has created our current decaying society.
It won't fix everything but it will give people a chance to dictate more of their lives through means of mass consensus while experiencing less authority.
Maybe I'm missing something but I really don't see how HOA doesn't fit here.
How would workplace democracy solve the problem of office politics and the associated corruption and nepotism dominating the leadership elections? Or do you consider workplace democracy to be better than the current system even if that problem stays unsolved?
Sure, you're assuming that workers would want to form an HOA. I don't think this is true.
Like other commentators, some guess that they would form representative republics. I also don't think this is true.
What I do think is that by giving people the ability to shape their world, they may very likely shape it in ways that are beneficial to more than the few.
How they do that is their prerogative, but surely you can see how this would be more beneficial than the oligarchies or dictatorships (the version of HOA you're thinking of, where the tyranical minority selected few harass the many) that form the vast majority of working corporations.
We already know that centrally planned economies are extremely inefficient and some of the worst ways to foster collaboration, so why should we accept the same system in our working lives?
I'm not saying I know how things will be better, but surely letting workers decide their fates is better than the current reality.
You're acting as if workers don't know what's in their best interest to have sustainable careers. Give people a chance, they're way more imaginative than you think.
Comment should have ended there. Meritocracy isn't authoritarianism, because it isn't anything because it isn't real. Meritocracy isn't despotism, because it isn't anything because it doesn't exist.
However, authoritarians, despots and oligarchs often pretend they're meritocrats (or several other popular ideologies).
It absolutely is a real thing. You don't get to declare that an existing word with more than 2000 years of history doesn't exist.
It may not exist in the Bay Area or in whatever subset of parameters you invented, but it absolutely exists and is something to strive towards.
> The idea that simply "talented" workers should rule just seems to speed run towards fascist aims.
Complete non-sequitur with 0 evidence.
> How do you consider which workers are worth more than others? If you do to the wrong school are you suddenly worth less? Do you think society will have certain preferences?
You decide just like everything else. Based on context and some objective measurements. It's not a perfect system, because sometimes measurements can become the goal, rather than the underlying objective, but it's the best system we have.
One knows a guy who runs local meet up, and offers them a spot to talk about it. Present at the meet up is a tech funder who catches them afterwards, and wants to meet for lunch to talk about this cool idea...
The other doesn't. They live in a small rural town. They may have even have come up with the idea first. Without a local meet up they don't get the chance to present. So they post to HN, but Apple announced a new AI tool and their stuff quickly gets bumped by links to Apple, Ars Technica, and a few Apple blogs.
Same idea, different outcomes due to outside forces. Sorry to break it to you but your environment has far more influence to your success than your personal merits.
You may have heard the joke that polyamory is wrong, because it should be multiamory or polyphilia. Meritocracy is a similar case. Because the word mixes Latin and Greek roots, it's unlikely to be old.
The first recorded uses of "meritocracy" are apparently by Marxist sociologists in the 1950s. They used it to describe a dystopian society, where merit serves as a moral justification for social classes, and social class determines the opportunities available to gain and demonstrate merit.
Of course the idea that career success and influence should be based on demonstrated ability and effort is ancient. But once you start building a society based on that idea, you run into Goodhart's law.
> Of course the idea that career success and influence should be based on demonstrated ability and effort is ancient. But once you start building a society based on that idea, you run into Goodhart's law.
Do you have any evidence for that? Aside from the thought-terminating cliché "it was used by Marxists once" ?
(Upper) middle class culture, where parents try to give their children a favorable start in life, which often involves a lot of effort. Such as buying a home in a good school district or helping them gain admission to a good university.
The moral justification for meritocracy is that the society benefits when the most capable people are in charge. Which means the society should find the children with the most potential and give them the best education and other opportunities available. But parents subvert this by trying to improve the relative standing of their children. Which means the people who had the best education and other opportunities will be less capable on the average, and the society benefits less.
Man you need to read more, I'm happy other users commented in a more pleasant manner; but congrats on learning that you have a total misunderstanding of both the term and it's real world applications, I bet you can solve 2 LC hards in an hour huh?
I’ve personally run into this issue of not having a working laptop in an interview setting. It’s not always money . I just don’t like getting work done on a laptop. I use a desktop. I’ve been staff+ for more than 5 years .
> Are those the people you want to hire for software development jobs though?
Why do you think the job posting doesn't explicitly mention "owning a PC" as a requirement? If it's a relevant criterion why not make it clear there? If it's not, why have it at all, only to keep it hidden in your biases?
Accepting to run random code sent by someone you don't know should be a red flag for them. Getting asked to run random code sent by someone you don't know should be a red flag for you.
> Accepting to run random code sent by someone you don't know should be a red flag for them. Getting asked to run random code sent by someone you don't know should be a red flag for you.
This is a different problem. If a candidate said "I don't want to run the code you send me" it might be a good opportunity to talk through what it does. Maybe I'd set up a VM for them in the cloud, or we could find a mutually acceptable solution. If a candidate says "I don't own a general purpose computing device" then I would really be questioning that candidates interest in computers, and therefore ability to develop and test software for them.
> Why do you think the job posting doesn't explicitly mention "owning a PC" as a requirement?
The job description also doesn't say "owns clean clothes", but how the candidate presents themselves is certainly a consideration when hiring.
Obviously. I just figured I'd point you to the real red flags you missed instead of the "I find it weird so it's a problem" thing.
> The job description also doesn't say "owns clean clothes"
That's a false parallel. A commenter higher up already pointed out to you that the candidate could own a tablet. An iPad Pro M5 is faster than most laptops, perfectly good for coding, and not able to run any of the crap sent out by the interviewer which likely expects desktop OSes.
The advert also shouldn't mention such a thing. Some people work remotely, others could honestly tell you they'll get better clothes from the first salary. If you're interviewing someone, they're the best at the job but you stumble on this, it's definitely a red flag. For the candidate, to look elsewhere. Why would you want to work for an employer who focuses more on the sweat stains on your armpit than the actual work or your character?
And now let me paint a different picture to understand the magnitude of the unfairness in your logic. I assume you are the Leo Rampen from the website you advertise in your profile. How many red flags do you count from someone advertising a blog which at the time of writing this has a certificate expired more than a month ago, and the last content update is more than a decade old? How does this reflect on a multi-disciplinary HW/SW engineer who even works on things as critical as satellites? This is to say, don't focus of flagging trivialities. You'll probably look in all the wrong places.
it's a red flag, not hard requirement. Most of talent devs i met usually code in their free time when they were in school. You dont need PC to do that, but it's much more convenient to have your own PC.
and with PC is so accessible now (you can even find free PC in some cases), that tells me you are not really passionate about software dev.
I'm talking about hiring a software engineer for a software development job. I have not met a good software engineer who wasn't also some level of geek. I'm thinking of all the great colleagues I've had over the years, and I would be really, really surprised if any of them didn't have some sort of computer at home. These are not "I just use my phone for everything" people.
I'm sure there are outliers, but given the low cost of used ex-corporate laptops in the western world, and presumably the candidate's interest in computers and software development, it's a fairly low bar to expect a candidate to have some sort of PC (laptop, desktop, Linux, Windows, Mac - whatever). I wouldn't expect it to be modern or expensive (I do this for a job and barely spend any money on computers these days), but I'd be really surprised if a candidate had nothing available.
I don’t own a personal vehicle, and you would not believe the types of jobs that were simply inaccessible to me because of that.
They apparently couldn’t ask directly whether I owned a car, but the coded question is: “Do you have Reliable Transportation?” <wink wink> and that was a confusing question to me, at face value; I would reply with candor, “I take public transit!” which of course gave away my situation every time.
Every job I had post-school effectively required that I owned a car and knew how to operate it--whether to go into an office or for frictionless business travel. In one or two cases, I could maybe have gotten off with flying and then renting (or taking some other form of transportation where available).
What if your laptop is broken? You should be restricted from getting a job? What about if you just landed in the US and didn't want to have to present it to the authorities to scan and plan on buying a new one because they are cheaper there. What about if a family member was currently using it. There are plenty of valid reasons why you might not have a laptop in general or at the moment in your life.
In most work places you are provided a computer to work on. So you could very easily not have a personal computer during your career as you are always provided one to work on.
Probably not common, but certainly plausible. Not everyone wants to bring work home or have hobbies that are the same as their work.
Why? Some people like to spend their free time doing things that aren’t what they do all day at work.
I knew one software developer who basically spent all his free time outside hiking and camping and rarely did anything with a computer when not working. He was a good dev and very competent. Just after being cooped up inside on a computer all week he didn’t want to spend more time on one at home.
It’s not much of a stretch beyond that to simply not owning one.
Like I said, you could own one and it's broken. Your 5 year old knocks over a glass wine the night before a morning interview. What do you do? The fact you can't work around it also might reflect badly on you as a potential employer.
I’m a lead engineer and have been Staff plus for more than 5 years. I’ve actually personally run into this problem (not having a working laptop for an interview). I don’t really do laptops well because it’s not a good environment to get work done in. I can see a large screen(s) desktop setup better and prefer that.
I used laptop because that's what the parent said, but I really meant a computer of any kind at home. I assumed a remote interview. If its an interview in person at an office I'd definitely expect hardware to be provided.
> I can see a large screen(s) desktop setup better and prefer that.
I kinda assumed that most developers took a similar approach to me. Laptop because portable when you need it, hooked to large screens, nice keyboard, nice mouse/whatever. I don't know what having a desktop would really buy me. I do 99% of my work with the laptop docked but that remaining 1% it sure is handy to grab it and go.
Desktop gives you a ton more oomph when you need it. Not that it is affordable today, but my personal desktop has 192GB of RAM, 24TB HDD, beefy GPU, and is basically never going to thermal throttle.
If you are just making web apps, it does not matter, but I do data processing where having the headroom can make a big difference.
I do have the cheapest used laptop I could find for those moments when I might require portability.
That’s a fair point. The most I use my laptop for is some local LLM processing. I’d have more headroom on a desktop, for sure, but 96GB M2 max has plenty of oomph for my needs. Maybe I’m underestimating how many power users there are. For my day job I tend to offload most of my work onto a big server anyway so I could probably get by with a Neo at this point.
Yes, that's me too and why I mentioned it. Often it feels like I'm alone in that many of my peer developers have sweet gaming rigs with beaucoup RAM while I'm just chugging along with a laptop.
In one instance for a data-oriented job interview I spun up a VM in the cloud because they linked a kaggle dataset for the at home test that was just a bit too big for my laptop to handle.
But to have nothing, no desktop, no laptop at all, is _odd_ for a developer. How did you get through school? If not school, then how is it a hobby-turned-profession without something to develop on?
The whole "no one should be denied access to a job" angle is weird too. What is the limit to accommodations?
American jobs more or less assume you have a car, given the lack of public transport. You could borrow a car but also borrow a laptop? Dunno, it's not a bad thought to reconsider some assumptions.
If a candidate reached out claiming they didn’t have a machine to interview with, I’d gladly find another path forward. But I imagine that’s a small minority in this industry.
Any obstacle whatsoever, especially one you yourself admit is very rare, is much more likely to result in a dropped interview if one is even offered. Why bother?
You’ve got 10,000 candidates applying. Seriously, what would make “doesn’t have a laptop” stand out to you positively? Why not just go with the 9800 applicants who do have one? Surely there’s no reason to think “broken laptop = good dev”. It’s so much easier to simply go with a candidate who has no problems. Beyond that, what’s the deal with making candidates do stuff on their own machines anyways? You don’t know what’s on there. You don’t even know if it’s stable enough for a test, and none of that has any bearing at all on their skill.
I’ve never worked in the Bay Area, but if this is common practice, I think I dodged a bullet.
Same answer as what if my clothes or shoes are broken, what if my car is broken, what if my arm is broken, what if my glasses are broken, what if my toothbrush is broken, what if my device I use to receive the job interview appointment is broken.
I don't know about "should" but there are many things that must be working in order for you to get a job. If they are not then you won't get a job.
I first thought this was a tongue in cheek joke before I realized you were the original commenter and looked them up.
I've described some prior experiences with some interviews as failing my litmus test and have cancelled further interviews when people start demand much too much from me before I'm on a payroll.
When I was hiring at my old place we set up disposable cloud VMs with a shared screen we could both remote into for interviews. No need for the candidate to install anything, and more responsive and secure than sharing my corporate desktop. Obviously the best thing is in-person at a shared screen (and the human interaction goes better too). This seemed like the best and most respectful compromise. https://www.edparcell.com/remote-desktop.html
If you want me to run a particular piece of software, send me a fucking computer. If you want me to be on call on a company-managed cellphone, send me a phone that you can own and manage all you want.
Do not ask me to download, install, or run malware on MY computer or phone as part of the APPLICATION process. If you are the sort of company that thinks this is appropriate, then I do not want to work for you. I've actually turned down work because of this. "Oh, they just want you to install this Chrome extension to make sure you're not cheating during the video interview." No. Fuck you. Don't touch my fucking equipment.
You're allowed to be angry when people do dumb things. Expecting your interviewees to install malware on their computer just to do an interview is dumb. Not only is it asking for trouble, it's also completely unnecessary. We have platforms specifically built for coding interviews, you just don't need to do that.
I guess, sure, companies are technically allowed to request you install malware on your computer. It's probably a CFAA violation, but nobody gives a rat's ass about the CFAA unless you're hacking the FBI, so who cares.
Also, make no mistake: a piece of software that is designed to record your screen, keypresses, etc is malware. It is spyware. You have absolutely zero guarantee it isn't install hooks into your system that will exist long after the application is gone.
Just do the interview in a browser sandbox like a normal person, and share your screen. Boom, problem solved, we figured this out 10 years ago. Really that paranoid about cheating? Then pay up and do an in-person interview, paper code test and all. I've had it done to me multiple times.
I agree, but that doesn’t mean you can’t call things dumb. You can. Asking interviewees to install random software on their computer is dumb, and you should stop if you’re doing that. You’re certainly allowed to disagree, that’s just my opinion.
Personally I judge hiring practices based on cost efficiency and quality of candidates, but I suppose "making people mad" could be an alternative criteria.
Since no one mentioned it - this seems to be a major and real problem in the crypto job space. In their job market it's more believable that a 'stealth startup' is reaching out and doing a code challenge from an unfamiliar email or repo, and crypto devs are likely to have a wallet or passwords accessible on their system. They are willing to go above and beyond the regular spam or AI conversations to get access.
No you don't, you just have to believe there are people more gullible than you. The creators of those monkeys or the people who hacked whatever wallet aren't gullible.
I'll add the category of people with the arrogance to believe that, after 900 previous ventures had all their coin stolen, they'll be the ones to write a secure exchange that can't be hacked.
> Putting things into Docker and only executing the code inside isolates your host system and does not reveal any stored secret - as long as you do not mount host data into the container.
Doesn't mention why... Gives no similar warning about VM.
You usually have to mount at least some data in a container or VM for it to be useful. Of course, being an idiot and sensitive mounting secrets in untrusted environment is the problem, container or VM doesn't matter.
Maybe it means there's some 0day where mounting any volume allows container escape or something? But that's not what it says.
The internet world really does run on trust-chaining reputation.
A person who takes random things from a near stranger on the internet and runs it on their computer with no real safeguards is not a person I should hire.
Which also means that your hiring practice should not involve a person you met on zoom/Teams/whatever 10 minutes ago being required to run your random crap without safeguards.
Which means if you want them to download and run stuff, you should list the requirements so the applicant can decide if they are going to do that for you.
Yeah but the actual employers are asking them to run random things on your computer. Often actual malware like Slack, Zoom, Teams, Google Meet. What do you expect the candidate to do? (Possible answer: use a VM)
Being on the job hunt myself this is very helpful! I do however prepare public repos and showcases for such interviews/applications, I hope my luck streak doesnt run out
Slop article. Good for scam awareness I guess, but the main value of the analysis and advice is comedy.
> read process.env directly, which in this app means MONGO_URI, JWT_SECRET, SENDGRID_API_KEY, CLOUDINARY_API_SECRET, PAYTM_MERCHANT_KEY
yeah it can run arbitrary malicious code, but let’s also highlight that it can read the fake app’s own dummy environment variables
> When the victim connects out to […], the server sees the source address on the accepted socket, exactly as any web server sees a visitor’s IP. No discovery, no scanning, no registration of an address. This is precisely why outbound-only design is so convenient for the attacker: it works behind NAT, CGNAT, a corporate proxy, or a home router with zero configuration, and it doesn’t matter if the victim’s IP changes.
huge
> If there is no UI/Desktop environment the module for leaking browser data or screenshots is self-limiting.
yeah this is why a VM is important, it’s because it doesn’t have a UI so screenshots don’t work
> … and reinstall your OS - better safe than sorry.
yeah just for thoroughness’s sake after having a RAT installed (hopefully you didn’t do this step last)
You'll probably need to enable some "secure memory mode" in BIOS, e.g. a boot error that you ignore which says something like "KVM disabled by BIOS" needs to be made to go away.
Realistically you want virtualbox, which is closed source and proprietary. qemu will run Linux but I don't think it's accurate and performance enough to run windows, right?
You can run a Windows VM with QEMU, but virt-manager is probably a simpler choice. Qemu is very accurate and performant, but also very flexible and not exactly straightforward to configure. But if your goal is to experiment with virtualization and learn, either one is probably a better choice than VirtualBox.
A recruiter recently sent me an "I'd like you to explore..." email. Every "further info" link in it pointed to znsrc.com/[unique_id] rather than to the displayed address.
I received so many of these requests to install malware that I removed linkedin from my life completely (besides the scam and spam flood)
Do not install anything on your machine, ever. Tell them politely ~to fuck off~ that you are not interested and move on. I know the desperation to be jobless will obfuscate your mind but again, never ever install anything on your machine when job hunting. I've seen people lose their crypto savings in seconds to say the least.
.... Why would you do job interview when they expect you to run some code on your own system, on your own time?
Maybe I work in a different field but last year when I was still looking for jobs, only one company asked for coding assignment and every other company did coding interview which is always browser based editor.
I feel like the industry is mature enough that you can tell a company that sends you a zip file of code to f-off.
> It never asks for elevation. It doesn’t need root, UAC, or sudo, because nothing it wants is root-owned. SSH keys, AWS credentials, browser profiles, wallet data, .env files - all of it is user-owned by design, because you need to read it routinely.
Tangentially, what have people found that works well in term of hardening [0] desktop linux? For example, at least keeping "banking" separate from code-development?
I figure the only good way to keep separate user accounts and whenever I have to do something as root, I switch to the most-secure and least-used of the accounts.
If a company is not even willing to have a real person speak to you at the start of the recruitment process, what does that say about them? Or about the legitimacy of that job posting? Or about the people you would be working with if you did get hired?
Regardless if you get an offer or not, you will invest a significant amount of finite time in each interview cycle and if you do get an offer, you'll be investing even more time into that company.
So no matter who you are, protect your time and remember that interviewing is always a 2-way street.
Are you familiar with the concept of a recruitment funnel? It is not financially worth it to personally talk with every single person that applies to a company.
Well then it’s not financially worth it for capable people to work for that company. And of story
Well then it's not financially worth it to have a job, because every company does this because if they didn't they'd need to triple in size with recruiters.
Something must be wrong with this logic because it clearly is financially worth it to have a job.
> Well then it's not financially worth it to have a job, because every company does this because if they didn't they'd need to triple in size with recruiters.
Every company does not do this. I always refuse tasks like this unless I've talked to a human before hand, as unless the company has invested a little effort, then I won't invest any effort.
> it clearly is financially worth it to have a job
Yes, for the company.
Not all capable people are willing to reject a company because they upload their resume to an automated system than giving it to a human to talk with.
Americans are uniquely (c|f)ucked that way because, lol regulation would be worse
I think it's happening everywhere, even in places with strong worker protection laws. Applicants aren't workers, and regulation is anyway laggy.
It's every company. If you reject companies for this, you are living under a bridge right now.
> It's every company. If you reject companies for this, you are living under a bridge right now.
I just finished a successful job search, and only had 1 company (of maybe 50 applications) try this.
After you've filtered down the resumes, if it's not financially worth it to put a human on the phone for the initial screen, that means you don't value the people you hire.
And if the cost to do that initial screen is almost zero, it also means that you may not even have a job opening and are just testing the waters.
No matter how you slice it, it's a bad look.
That's what a resume is for.
thats what the ATS is for
out of the list under "Before you start with the test, you might be suspicious about the following:" there is only one that is important:
only interact with people using an official email address.
the rest can be used as yellow/red flags, but simply asking for confirmation via an official email address will thwart the vast majority of scams (including other ones, like someone claiming to be from Intuit calling about your QuickBooks or whatever).
I have seen official company recruiters operate exclusively through Gmail or whatever. Third party headhunters may not have anything tied to the sponsoring company.
It is a decent rule, but one which is immediately thwarted by companies going out of their way to constantly look illegitimate.
> immediately thwarted by companies going out of their way to constantly look illegitimate
Interesting reading: https://www.troyhunt.com/thanks-fedex-this-is-why-we-keep-ge...
how do you know they were really official company recruiters?
not OP, but because I've looked for a job previously and have experiences with recruiters like that which ended up at a legitimate offer at the companies they claimed to represent?
By not using their 'official' company email account, I'd assume the recruiter is working on the side behind their employers back.
> only interact with people using an official email address.
And then google whether the domain is associated with phishing attempts. i've been targeted several times recently by folks with "official" email addresses but whose domains are (per google) strongly associated with phishing.
> simply asking for confirmation via an official email address
There are some smart new scammers who now create a lookalike domain which either redirects to the original or shows a fake corporate portal. How could a random interviewee know whether john at strinlaicorp.com is real or john.s at strinlai.net is fake?
fter posting on the HN front page, I got way too many job scam contacts—all through Gmail, not official company emails.
> “A relevant opportunity” with part-time remote work and a great hourly compensation
That is so suspicious at the moment.
I get enough legit and illegitimate ones every week on LinkedIn that it's become really easy to tell the difference. Hard to pinpoint in a comment because it's mostly a gut feeling. But, in rough order:
1. Look at the person's LinkedIn profile contacting you and examine their post history. In one comical scenario the "recruiter" had a long 4 year gap where they were writing comments in English and all of the sudden they switched to Spanish. Mostly short, pointless comments as well.
2. Look at the company and make sure they have a legitimate website and are still actually in business. Even better, see if there's a public team page that lists this person.
3. Give the recruiter an email (I usually use something like SimpleLogin) and ask them to forward you the details. Of course, pay close attention to what address they send it from.
4. In addition, or alternatively, ask the recruiter for the public job listing (scammers almost always "paste" it into a DM or upload a clearly AI generated PDF doc).
Once you learn the game it's not too hard to start picking up on them. I've made it a game to play along sometimes just for fun. Ultimately, at the end of the day, make sure you report them on LinkedIn. I've had the account disappear within a hour of doing so.
Honestly unless I'm planning on quitting my current job, or if I were unemployed, I just ignore the linkedin.
Sure they spam you with "XX wants to connect", or "I'm awaiting your reply" emails. But real contacts and friends can call/email you, and everybody else can wait six months.
Despite only connecting with actual people I've worked with, not recruiters, I still get "suggested" posts which are slop, and "that happened". The site is a cesspool.
I got my last two jobs from recruiters contacting me via LinkedIn. I've also kept in touch with a good group of recruiters over DMs who regularly bring me new offers. My experience might be unique, but I've gotten a lot of value being on LinkedIn. I don't interact with the social part of it (posts or whatever they are called) at all.
I haven't had LinkedIn since... 2014 I think.
I deleted my account after I got my first job offer and have never used it since.
If people dislike the site so much, I don't understand why they don't delete their account. Is there any value provided, or is it the fear of missing out on potential future value?
Every single job app I filled out in the last two years asked for my linkedin url. I don't know if not having one was disqualifying, but it does worry me.
It's not disqualifying, but not having a linkedin is a signal that could drop you towards the bottom of the resume pile. Companies have problems with fake applicants, and ATS systems do create "how likely this person is a human" scores. Having an online identity is one signal, and for better or worse, that is often a LinkedIn history.
Like a fico score, you can't escape the game if you want to play.
Being dropped to the bottom of a resume pile in this job market is effectively disqualifying.
linkedin is a mess. there was a glorious ~5 years in the late 2000s to ~2015 where it felt like it could and would work -- I know people who got hired and through it and I got one legit interview
but since then it's slop slop slop
My first thought after reading the article: develoepers NEED to learn to use firewalls such as LuLu(https://objective-see.org/products/lulu.html) to get interactive dialogs asking whether any given binary can access any given internet address whether it is a domain address or IP address (which can seem even shadier).
I am an Emacs user but every time I have tried a new editor, including VS Code or VSCodium I blocked access to remote addressed which were prompted to me even though I did not neither authorize extension download nor extension download.
I think it would have been even funny for devs trying out for code challenges while using "interactive" firewalls such as LuLu, then catching the shadiness and blocking access right up.
This really is the simplest path to somewhat decent security, and alongside it you may catch some programs doing requests that are fine for security but you'd rather it not do because of privacy.
The line between privacy and security is very blurry. Consider this: if Microsoft exfiltrates your keystrokes, it's a privacy violation, but if a random person does the same thing then it's a security violation. You might say that the random person is more likely to use it against you, but then the car insurance companies mining your driving data absolutely do use it against some customers, but that's generally considered to be a privacy violation rather than a security violation.
No, we really need to stop using weasel words and call it like it is: Windows is malware. Microsoft has illegally hacked billions of computers, and gets away with it by being a big company and by the world having gotten complacent with big companies constantly hacking everyone they can.
> Consider this: if Microsoft exfiltrates your keystrokes, it's a privacy violation, but if a random person does the same thing then it's a security violation
No, it's a security violation no matter who does it.
That's adjacent to my point. I'm criticizing how I see these words used.
There is a YC company that makes a coding interview tool. They want you to run their CLI on your machine and trust that it won't do anything malicious, when in fact it installs a bunch of things onto your machine without consent, scans processes, and intercepts requests from AI tools. It's crazy that people think this is acceptable.
Just that fact that the company expects a candidate to even have their own machine is egregious.
> Just that fact that the company expects a candidate to even have their own machine is egregious.
In the company where I work (in recent history, the most valuable company on the planet), there are younger employees who do not own personal computers.
One of them was (with different company now) a Gen Z developer who did not personally own a computer (besides a phone).
I was floored. Still am.
Why? There were a lot of people who didn't own a personal computer before 2000 too. It just wasn't needed. And nowadays, it also isn't needed, albeit for different reasons. The time window where it was actually a reasonable assumption that someone has a computer at home was relatively short.
Exactly - personal computers are really just a very "millennial" thing. Only (very) late GenX and millennials grew up with, learned on and interacted with PCs on an hourly basis. By the time GenZs came knocking around, consoles and mobile phones took up the slack, while shitty Chromebooks at school and Google Drive mostly filled in for office-related software.
Of course you can, used my own computer for work purposes for the last 14 years I was employed.
Why? It's not like you have the option of using a personal computer for work.
Most things I use a laptop for could be replaced with an iPad.
The experience for me would be worse, so I don't, but I could see other people not minding it.
> > One of them was […] a Gen Z developer who did not personally own a computer (besides a phone).
> > I was floored. Still am.
> Why?
My personal computer is how I learned to be a software developer and how I continue to improve as one. So, it astonishes me that a software developer by trade doesn't own a personal computer.
To help separate my reaction from my personal bias (yeah, not possible), think about how you might feel upon discovering a professional cyclist who did not own a personal bicycle.
Cycling is something your body must physically practice in as close to race conditions as possible to get good results. Programming is not, it's all in your head so to speak. I've been programming from my phone as early as 2013. Yes, I also did program on my PC, but mostly because I already had a PC for unrelated reasons.
A better comparison is a professional influencer. You'd imagine someone posting high effort videos 5-10 times a week would at least have a video camera. Wrong. Most do it with their phones only, that's been the standard for around a decade. If you think about it, why would they buy a video cam? What benefit would be in it? The same thing is now happening with programming and laptops (let alone desktop PCs). It's only bizarre if you live in a world where there's no viable alternative.
For all its talk of 'meritoctacy', the bay area really runs on looking the part.
Because meritocracy isn't a real thing.
It's just another form of authoritarianism, despotism, and oligarchy. Who decides what work is worth rewarding? What about the type of work?
It was always an antidemocratic idea sold to tech workers to stop the idea of questioning the system.
The idea that simply "talented" workers should rule just seems to speed run towards fascist aims. How do you consider which workers are worth more than others? If you do to the wrong school are you suddenly worth less? Do you think society will have certain preferences? What about in our neoliberal society where money is the only purpose to life?
What would your preferred alternative look like?
For the modern American tech corporation? Full throated workplace democracy, with an emphasis on small d:
https://en.wikipedia.org/wiki/Workplace_democracy
Corporations are the last authoritarian forces we willfully allow to dictate how we live our lives, I think anything to dismantle their power is worth pursuing. If democracy is good enough for states, it should surely be more than good enough for the economy.
As someone who is a big fan of consensus and voice, I don't see how current corporate leadership could get worse if more workers inside the company had more opportunities to direct its future. It's their future too, they need a say and telling people to just leave goes back to the neoliberal decaying value of money above all us.
At the risk of being accused of reductio ad absurdum - do you want companies to be run like American HOAs? If so, do you expect the results to be the same or different than with HOAs?
There are, if not millions of HOAs, surely at least one hundred thousand, but you only hear about the ones being silly.
It's a bit of a lazy punchline, especially because HOAs are one of the purest forms of democracy, they really only exist (barring certain corporate controlled ones that I don't think count) because the people there want them to.
It's not a punchline at all. If HOAs are pure democracy, and businesses should be as democratic as possible, then naturally the ideal structure of a business is very close to HOA, if not identical to HOA.
As far as I know, the vast majority of HOAs fall into "exists only on paper" category, where they have virtually no rules and do virtually nothing except the basic necessities, sometimes they also maintain shared spaces and that's it. They don't even have regular meetings most of the time, only special ones. This is obviously not how a sustainable business can be run.
Of the remaining ones (which is a tiny minority of the grand total), the vast majority are exactly like the horror stories you hear - corruption, nepotism, stupid rules with selective enforcement, interpersonal politics getting in the way of actually getting things done. If a business was run like a HOA, since it cannot be the first kind, I predict it would usually devolve to this within a few years.
I honestly never heard of a single case where HOA 1) does a lot, 2) has comprehensive rules, 3) actually enforces the rules, and 4) isn't a horror story. So I really don't know how such a HOA would operate, what the governance structure would be, how enthusiastic people would be to participate and exercise their voting rights, or how it all would translate into a business. If you know of a case like this, or have a theory how it would play out, please share!
I think HOA discussion is rather getting away from the original point.
Presumably if you were running a corporation as a democracy you'd just go through the same basic stages as a city-state where you rapidly end up with representatives serving terms.
This sort of thing depends wildly on the size/number of people involved of course.
A 5-10 person company doesn't really need much in the way of a power structure, presumably everyone knows what needs to be done and you probably have different specialties anyways so you consult each other when required and then each person does their thing. Perhaps occasionally you need some kind of tie breaking vote.
A manufacturing company employing 50,000 people at every level from (ceo of 50,000 person company) to (effectively minimum wage bolt tightener) is going to need more authority explicitly defined and delegated.
Spending 5 minutes thinking about it, you'd pass the equivalent of a law saying "everyone in this class of (bolt tighteners) must work 20+ hours a week and gets paid $xx.00 an hour and so on and so forth and if they fail to adhere to this then x, y and z happens then get fired".
This law could be passed either by a direct vote or more likely created by a body of representatives.
I don't know offhand of any business that runs this explicitly as a democracy, there's various co-op businesses that do exist but I've never investigated how exactly they run these things.
I don't see anything stopping you from having a company that elects its ceo though.
Cooperation is easy when everybody cooperates and has the same goals. Even in a 100% privately owned company with strict hierarchy and egomaniacal CEO. The problems start when the goals stop aligning or people stop cooperating. And it doesn't sound like you paid any thought to what happens then in a democratic setting.
For example, those bolt tighteners. The joint vote by the tire balancers, CNC operators and facility maintainers has beat the opposition and a resolution was passed that excludes bolt tighteners from annual bonus. Or the bolt tighteners have joined with delivery drivers and passed a rule requiring a certain number of bolts in all new designs whether they make sense or not. Or a hundred other ways in which people can use their vote to put their own self-interest above the shared good.
What are the main forces that keep a democratic workplace like the one you described from collapsing due to bad votes and bad rules?
> What are the main forces that keep a democratic workplace like the one you described from collapsing due to bad votes and bad rules?
The same forces that keep autocratic ones from collapsing due to incompetent owners making bad decisions, which is to say, nothing at all.
I'm too lazy to look up actual stats, but its well known that "most" businesses fail, and if you extens the timeframe long enough they all fail, so this isn't really a problem I need to solve.
A more real problem, if you need one, is probably involving investment to create the company, but that's heavily dependent on the surrounding systems to begin with so where are we stopping this thought experiment?
You're looking at this at the wrong angle, a better lens would be: "can workplace democracy enable workers to live happier lives?" I think optimizing for collaboration, rather than dominion can only be seen as a good thing to allow humans to thrive.
Also why are you assuming that parliaments would be the dominating collaboration structure? Your imagination is vastly limited if you're only looking toward western examples.
At the opposite end, maybe a question to ask yourself if the current system is leading to good outcomes and for who because the vast majority of Americans are suffering as the result of our current neoliberal economic system that was forced upon us with no consent from the governed. Alternatives should be explored and giving voice to workers seems like the simplest thing we can do. People should be allowed to have a voice in the direction of their employment.
Exit is not sufficient.
Things can be better, only if we allow it to.
lol if you got HOAs out of that link IDK what to tell you. Workers should be able to vote for their leadership full stop, poor leaders can easily make their lives bad. Voice needs to have more place in the economoy, relying on just monetary incentives has created our current decaying society.
It won't fix everything but it will give people a chance to dictate more of their lives through means of mass consensus while experiencing less authority.
Able to vote for their leadership - check.
Voice has a place - check.
Incentives other than monetary - check.
Chance to dictate more of their lives - check.
Mass consensus - check.
Maybe I'm missing something but I really don't see how HOA doesn't fit here.
How would workplace democracy solve the problem of office politics and the associated corruption and nepotism dominating the leadership elections? Or do you consider workplace democracy to be better than the current system even if that problem stays unsolved?
Sure, you're assuming that workers would want to form an HOA. I don't think this is true.
Like other commentators, some guess that they would form representative republics. I also don't think this is true.
What I do think is that by giving people the ability to shape their world, they may very likely shape it in ways that are beneficial to more than the few.
How they do that is their prerogative, but surely you can see how this would be more beneficial than the oligarchies or dictatorships (the version of HOA you're thinking of, where the tyranical minority selected few harass the many) that form the vast majority of working corporations.
We already know that centrally planned economies are extremely inefficient and some of the worst ways to foster collaboration, so why should we accept the same system in our working lives?
I'm not saying I know how things will be better, but surely letting workers decide their fates is better than the current reality.
You're acting as if workers don't know what's in their best interest to have sustainable careers. Give people a chance, they're way more imaginative than you think.
Isn't most of the problem with HOAs that people never vote, making them oligarchies in practice?
And you expect democratically run companies to have higher voter participation why exactly?
Mandate voting, problem solved.
Congratulations, all 3400 of your fellow workers cast a vote, and 2800 of them voted to stop mandatory voting.
And if they cannot vote on that then what can they vote on?
Sounding very much like "we need a dictator to protect the population from themselves"
[dead]
> Because meritocracy isn't a real thing.
Comment should have ended there. Meritocracy isn't authoritarianism, because it isn't anything because it isn't real. Meritocracy isn't despotism, because it isn't anything because it doesn't exist.
However, authoritarians, despots and oligarchs often pretend they're meritocrats (or several other popular ideologies).
> Because meritocracy isn't a real thing.
It absolutely is a real thing. You don't get to declare that an existing word with more than 2000 years of history doesn't exist.
It may not exist in the Bay Area or in whatever subset of parameters you invented, but it absolutely exists and is something to strive towards.
> The idea that simply "talented" workers should rule just seems to speed run towards fascist aims.
Complete non-sequitur with 0 evidence.
> How do you consider which workers are worth more than others? If you do to the wrong school are you suddenly worth less? Do you think society will have certain preferences?
You decide just like everything else. Based on context and some objective measurements. It's not a perfect system, because sometimes measurements can become the goal, rather than the underlying objective, but it's the best system we have.
> It absolutely is a real thing
Unfortunately due to outside forces, it isn't.
Two people build something.
One knows a guy who runs local meet up, and offers them a spot to talk about it. Present at the meet up is a tech funder who catches them afterwards, and wants to meet for lunch to talk about this cool idea...
The other doesn't. They live in a small rural town. They may have even have come up with the idea first. Without a local meet up they don't get the chance to present. So they post to HN, but Apple announced a new AI tool and their stuff quickly gets bumped by links to Apple, Ars Technica, and a few Apple blogs.
Same idea, different outcomes due to outside forces. Sorry to break it to you but your environment has far more influence to your success than your personal merits.
You may have heard the joke that polyamory is wrong, because it should be multiamory or polyphilia. Meritocracy is a similar case. Because the word mixes Latin and Greek roots, it's unlikely to be old.
The first recorded uses of "meritocracy" are apparently by Marxist sociologists in the 1950s. They used it to describe a dystopian society, where merit serves as a moral justification for social classes, and social class determines the opportunities available to gain and demonstrate merit.
Of course the idea that career success and influence should be based on demonstrated ability and effort is ancient. But once you start building a society based on that idea, you run into Goodhart's law.
> Of course the idea that career success and influence should be based on demonstrated ability and effort is ancient. But once you start building a society based on that idea, you run into Goodhart's law.
Do you have any evidence for that? Aside from the thought-terminating cliché "it was used by Marxists once" ?
(Upper) middle class culture, where parents try to give their children a favorable start in life, which often involves a lot of effort. Such as buying a home in a good school district or helping them gain admission to a good university.
What's this supposed to be evidence of? Failure of meritocracy?
The moral justification for meritocracy is that the society benefits when the most capable people are in charge. Which means the society should find the children with the most potential and give them the best education and other opportunities available. But parents subvert this by trying to improve the relative standing of their children. Which means the people who had the best education and other opportunities will be less capable on the average, and the society benefits less.
https://en.wikipedia.org/wiki/Meritocracy
Man you need to read more, I'm happy other users commented in a more pleasant manner; but congrats on learning that you have a total misunderstanding of both the term and it's real world applications, I bet you can solve 2 LC hards in an hour huh?
You need to read less, since apparently you couldn't even get past the dictionary definition of meritocracy.
If you have some kind of point to make about the term, please list your qualifications on what makes you an arbiter of meaning.
What, you can't expect a candidate at least have a laptop?
Some people share laptops, others don’t have one at all and are fine with a tablet or smartphone.
Are those the people you want to hire for software development jobs though?
Honestly I would see that as a huge red flag. In western countries a used laptop costs almost nothing.
I’ve personally run into this issue of not having a working laptop in an interview setting. It’s not always money . I just don’t like getting work done on a laptop. I use a desktop. I’ve been staff+ for more than 5 years .
> Are those the people you want to hire for software development jobs though?
Why do you think the job posting doesn't explicitly mention "owning a PC" as a requirement? If it's a relevant criterion why not make it clear there? If it's not, why have it at all, only to keep it hidden in your biases?
Accepting to run random code sent by someone you don't know should be a red flag for them. Getting asked to run random code sent by someone you don't know should be a red flag for you.
> Accepting to run random code sent by someone you don't know should be a red flag for them. Getting asked to run random code sent by someone you don't know should be a red flag for you.
This is a different problem. If a candidate said "I don't want to run the code you send me" it might be a good opportunity to talk through what it does. Maybe I'd set up a VM for them in the cloud, or we could find a mutually acceptable solution. If a candidate says "I don't own a general purpose computing device" then I would really be questioning that candidates interest in computers, and therefore ability to develop and test software for them.
> Why do you think the job posting doesn't explicitly mention "owning a PC" as a requirement?
The job description also doesn't say "owns clean clothes", but how the candidate presents themselves is certainly a consideration when hiring.
> This is a different problem.
Obviously. I just figured I'd point you to the real red flags you missed instead of the "I find it weird so it's a problem" thing.
> The job description also doesn't say "owns clean clothes"
That's a false parallel. A commenter higher up already pointed out to you that the candidate could own a tablet. An iPad Pro M5 is faster than most laptops, perfectly good for coding, and not able to run any of the crap sent out by the interviewer which likely expects desktop OSes.
The advert also shouldn't mention such a thing. Some people work remotely, others could honestly tell you they'll get better clothes from the first salary. If you're interviewing someone, they're the best at the job but you stumble on this, it's definitely a red flag. For the candidate, to look elsewhere. Why would you want to work for an employer who focuses more on the sweat stains on your armpit than the actual work or your character?
And now let me paint a different picture to understand the magnitude of the unfairness in your logic. I assume you are the Leo Rampen from the website you advertise in your profile. How many red flags do you count from someone advertising a blog which at the time of writing this has a certificate expired more than a month ago, and the last content update is more than a decade old? How does this reflect on a multi-disciplinary HW/SW engineer who even works on things as critical as satellites? This is to say, don't focus of flagging trivialities. You'll probably look in all the wrong places.
it's a red flag, not hard requirement. Most of talent devs i met usually code in their free time when they were in school. You dont need PC to do that, but it's much more convenient to have your own PC.
and with PC is so accessible now (you can even find free PC in some cases), that tells me you are not really passionate about software dev.
So if you hire a plumber as a plumbing company you expect him to have plumbing-material available and to do plumbing in his free-time?
There are people that do like not to do work in their free time.
How dare those unemployed people don't manage to get an exclusive laptop for themselves!
I'm talking about hiring a software engineer for a software development job. I have not met a good software engineer who wasn't also some level of geek. I'm thinking of all the great colleagues I've had over the years, and I would be really, really surprised if any of them didn't have some sort of computer at home. These are not "I just use my phone for everything" people.
I'm sure there are outliers, but given the low cost of used ex-corporate laptops in the western world, and presumably the candidate's interest in computers and software development, it's a fairly low bar to expect a candidate to have some sort of PC (laptop, desktop, Linux, Windows, Mac - whatever). I wouldn't expect it to be modern or expensive (I do this for a job and barely spend any money on computers these days), but I'd be really surprised if a candidate had nothing available.
I don’t own a personal vehicle, and you would not believe the types of jobs that were simply inaccessible to me because of that.
They apparently couldn’t ask directly whether I owned a car, but the coded question is: “Do you have Reliable Transportation?” <wink wink> and that was a confusing question to me, at face value; I would reply with candor, “I take public transit!” which of course gave away my situation every time.
Every job I had post-school effectively required that I owned a car and knew how to operate it--whether to go into an office or for frictionless business travel. In one or two cases, I could maybe have gotten off with flying and then renting (or taking some other form of transportation where available).
What if your laptop is broken? You should be restricted from getting a job? What about if you just landed in the US and didn't want to have to present it to the authorities to scan and plan on buying a new one because they are cheaper there. What about if a family member was currently using it. There are plenty of valid reasons why you might not have a laptop in general or at the moment in your life.
Then you should find a way around it. If an applicant can't even manage to get a laptop for a few hours I rather hire someone else.
In extreme cases we can work it out but you should have something that makes up for the extra annoyance compared to 99% of applicants.
In most work places you are provided a computer to work on. So you could very easily not have a personal computer during your career as you are always provided one to work on.
Probably not common, but certainly plausible. Not everyone wants to bring work home or have hobbies that are the same as their work.
I wouldn't want to hire someone who literally never uses a computer outside work (to the point of not owning one).
Would totally hire someone if they proved competence in software development while also not owning a computer.
Tells you they are an extremely competent smart worker that could be surprisingly helpful in ways we don't understand.
I'd love to learn from such a person.
Why? Some people like to spend their free time doing things that aren’t what they do all day at work.
I knew one software developer who basically spent all his free time outside hiking and camping and rarely did anything with a computer when not working. He was a good dev and very competent. Just after being cooped up inside on a computer all week he didn’t want to spend more time on one at home.
It’s not much of a stretch beyond that to simply not owning one.
Like I said, you could own one and it's broken. Your 5 year old knocks over a glass wine the night before a morning interview. What do you do? The fact you can't work around it also might reflect badly on you as a potential employer.
I’m a lead engineer and have been Staff plus for more than 5 years. I’ve actually personally run into this problem (not having a working laptop for an interview). I don’t really do laptops well because it’s not a good environment to get work done in. I can see a large screen(s) desktop setup better and prefer that.
I used laptop because that's what the parent said, but I really meant a computer of any kind at home. I assumed a remote interview. If its an interview in person at an office I'd definitely expect hardware to be provided.
> I can see a large screen(s) desktop setup better and prefer that.
I kinda assumed that most developers took a similar approach to me. Laptop because portable when you need it, hooked to large screens, nice keyboard, nice mouse/whatever. I don't know what having a desktop would really buy me. I do 99% of my work with the laptop docked but that remaining 1% it sure is handy to grab it and go.
Desktop gives you a ton more oomph when you need it. Not that it is affordable today, but my personal desktop has 192GB of RAM, 24TB HDD, beefy GPU, and is basically never going to thermal throttle.
If you are just making web apps, it does not matter, but I do data processing where having the headroom can make a big difference.
I do have the cheapest used laptop I could find for those moments when I might require portability.
That’s a fair point. The most I use my laptop for is some local LLM processing. I’d have more headroom on a desktop, for sure, but 96GB M2 max has plenty of oomph for my needs. Maybe I’m underestimating how many power users there are. For my day job I tend to offload most of my work onto a big server anyway so I could probably get by with a Neo at this point.
I priced one out for my current job and honestly the savings just weren’t there. The ram, gpu, HD now take up a disproportionate share of the price.
I’m keeping applecare on my macbook paid up and planning to hunker down for a few years hoping prices relax a little.
Yes, that's me too and why I mentioned it. Often it feels like I'm alone in that many of my peer developers have sweet gaming rigs with beaucoup RAM while I'm just chugging along with a laptop.
In one instance for a data-oriented job interview I spun up a VM in the cloud because they linked a kaggle dataset for the at home test that was just a bit too big for my laptop to handle.
But to have nothing, no desktop, no laptop at all, is _odd_ for a developer. How did you get through school? If not school, then how is it a hobby-turned-profession without something to develop on?
The whole "no one should be denied access to a job" angle is weird too. What is the limit to accommodations?
American jobs more or less assume you have a car, given the lack of public transport. You could borrow a car but also borrow a laptop? Dunno, it's not a bad thought to reconsider some assumptions.
the mention of laptop was not adding a laptop requirement to the original question
Wow your suggestion is “let them eat cake?”
Do you actually believe what you’re saying, or have you not thought it through?
What reality are you living in?
there are people out there who don't want to hold your hand.
stop advocating that we discriminate against them because you feel you need your hand held.
If a candidate reached out claiming they didn’t have a machine to interview with, I’d gladly find another path forward. But I imagine that’s a small minority in this industry.
It wouldn’t stop them from being hired.
Any obstacle whatsoever, especially one you yourself admit is very rare, is much more likely to result in a dropped interview if one is even offered. Why bother?
You’ve got 10,000 candidates applying. Seriously, what would make “doesn’t have a laptop” stand out to you positively? Why not just go with the 9800 applicants who do have one? Surely there’s no reason to think “broken laptop = good dev”. It’s so much easier to simply go with a candidate who has no problems. Beyond that, what’s the deal with making candidates do stuff on their own machines anyways? You don’t know what’s on there. You don’t even know if it’s stable enough for a test, and none of that has any bearing at all on their skill.
I’ve never worked in the Bay Area, but if this is common practice, I think I dodged a bullet.
Same answer as what if my clothes or shoes are broken, what if my car is broken, what if my arm is broken, what if my glasses are broken, what if my toothbrush is broken, what if my device I use to receive the job interview appointment is broken.
I don't know about "should" but there are many things that must be working in order for you to get a job. If they are not then you won't get a job.
I got my last job and I didn't own a laptop as I was homeless. Had to borrow it from a mate.
It happens:)
I've done all of my recent interviews on an iPad.
Maybe it's a pen test such that if the CLI can phone home you fail, to weed out candidates with weak security fu.
if that was the purpose it should weed out candidates who agreed to install the app for a job interview.
Name the company
Litmus
I first thought this was a tongue in cheek joke before I realized you were the original commenter and looked them up.
I've described some prior experiences with some interviews as failing my litmus test and have cancelled further interviews when people start demand much too much from me before I'm on a payroll.
Even more reason to use VMs.
When I was hiring at my old place we set up disposable cloud VMs with a shared screen we could both remote into for interviews. No need for the candidate to install anything, and more responsive and secure than sharing my corporate desktop. Obviously the best thing is in-person at a shared screen (and the human interaction goes better too). This seemed like the best and most respectful compromise. https://www.edparcell.com/remote-desktop.html
They (not what OP is talking about but usually these software) detect if a VM exists and abort, to prevent “cheating”.
How about no.
If you want me to run a particular piece of software, send me a fucking computer. If you want me to be on call on a company-managed cellphone, send me a phone that you can own and manage all you want.
Do not ask me to download, install, or run malware on MY computer or phone as part of the APPLICATION process. If you are the sort of company that thinks this is appropriate, then I do not want to work for you. I've actually turned down work because of this. "Oh, they just want you to install this Chrome extension to make sure you're not cheating during the video interview." No. Fuck you. Don't touch my fucking equipment.
how about they do what they want, and you do what you want, and you don't collaborate with each other if you can't get along? no reason to be angry.
if one of my hiring practices would reliably generate that many f-bombs, i'd consider it a success and stick with it!
You're allowed to be angry when people do dumb things. Expecting your interviewees to install malware on their computer just to do an interview is dumb. Not only is it asking for trouble, it's also completely unnecessary. We have platforms specifically built for coding interviews, you just don't need to do that.
I guess, sure, companies are technically allowed to request you install malware on your computer. It's probably a CFAA violation, but nobody gives a rat's ass about the CFAA unless you're hacking the FBI, so who cares.
Also, make no mistake: a piece of software that is designed to record your screen, keypresses, etc is malware. It is spyware. You have absolutely zero guarantee it isn't install hooks into your system that will exist long after the application is gone.
Just do the interview in a browser sandbox like a normal person, and share your screen. Boom, problem solved, we figured this out 10 years ago. Really that paranoid about cheating? Then pay up and do an in-person interview, paper code test and all. I've had it done to me multiple times.
engage with the people you want to engage with, don't with the people you don't, you didn't offer any correction to that.
I agree, but that doesn’t mean you can’t call things dumb. You can. Asking interviewees to install random software on their computer is dumb, and you should stop if you’re doing that. You’re certainly allowed to disagree, that’s just my opinion.
Personally I judge hiring practices based on cost efficiency and quality of candidates, but I suppose "making people mad" could be an alternative criteria.
don't straw man, making a certain group of people mad, if it detects people who are problematic teammates, is an unmitigated plus.
Ah yes, "a certain group of people".
You wouldn't by any chance normally use a different term for this group? Perhaps a single word?
I have a desktop that I use as a remote server for the GPU, so I'd be happy to disconnect the ssd and boot off a usb stick.
Since no one mentioned it - this seems to be a major and real problem in the crypto job space. In their job market it's more believable that a 'stealth startup' is reaching out and doing a code challenge from an unfamiliar email or repo, and crypto devs are likely to have a wallet or passwords accessible on their system. They are willing to go above and beyond the regular spam or AI conversations to get access.
Yes, I got targeted too: https://blog.denv.it/posts/i-was-likely-targeted-by-dprk-in-...
(Don't work in crypto, but there's a crypto company with the same name as the one I work at)
Also, to be into cryptocurrency, you kind of have to be gullible to begin with.
No you don't, you just have to believe there are people more gullible than you. The creators of those monkeys or the people who hacked whatever wallet aren't gullible.
I'll add the category of people with the arrogance to believe that, after 900 previous ventures had all their coin stolen, they'll be the ones to write a secure exchange that can't be hacked.
Sure, you can get into the scam business expecting you'll be the scammer and not the scammed. Statistically, it's not gonna work out.
Same as folks buying into MLM and other pyramid-scheme-adjacent things. Lots of them think they'll be the ones coming out on top.
cheap laptops are cheap, simply don't use your "real" computer.
I remember reading a similar article here not long ago, and the attack relied on auto-loading in VSCode.
https://opensourcemalware.com/blog/latest-contagious-intervi...
> Putting things into Docker and only executing the code inside isolates your host system and does not reveal any stored secret - as long as you do not mount host data into the container.
Doesn't mention why... Gives no similar warning about VM.
You usually have to mount at least some data in a container or VM for it to be useful. Of course, being an idiot and sensitive mounting secrets in untrusted environment is the problem, container or VM doesn't matter.
Maybe it means there's some 0day where mounting any volume allows container escape or something? But that's not what it says.
The internet world really does run on trust-chaining reputation.
A person who takes random things from a near stranger on the internet and runs it on their computer with no real safeguards is not a person I should hire.
Which also means that your hiring practice should not involve a person you met on zoom/Teams/whatever 10 minutes ago being required to run your random crap without safeguards.
Which means if you want them to download and run stuff, you should list the requirements so the applicant can decide if they are going to do that for you.
But we don't live in such an ideal world....
Yeah but the actual employers are asking them to run random things on your computer. Often actual malware like Slack, Zoom, Teams, Google Meet. What do you expect the candidate to do? (Possible answer: use a VM)
Being on the job hunt myself this is very helpful! I do however prepare public repos and showcases for such interviews/applications, I hope my luck streak doesnt run out
Slop article. Good for scam awareness I guess, but the main value of the analysis and advice is comedy.
> read process.env directly, which in this app means MONGO_URI, JWT_SECRET, SENDGRID_API_KEY, CLOUDINARY_API_SECRET, PAYTM_MERCHANT_KEY
yeah it can run arbitrary malicious code, but let’s also highlight that it can read the fake app’s own dummy environment variables
> When the victim connects out to […], the server sees the source address on the accepted socket, exactly as any web server sees a visitor’s IP. No discovery, no scanning, no registration of an address. This is precisely why outbound-only design is so convenient for the attacker: it works behind NAT, CGNAT, a corporate proxy, or a home router with zero configuration, and it doesn’t matter if the victim’s IP changes.
huge
> If there is no UI/Desktop environment the module for leaking browser data or screenshots is self-limiting.
yeah this is why a VM is important, it’s because it doesn’t have a UI so screenshots don’t work
> … and reinstall your OS - better safe than sorry.
yeah just for thoroughness’s sake after having a RAT installed (hopefully you didn’t do this step last)
If you run across something like this:
* perhaps archive your findings
* report the abuse to their hosting
I'm dropping emails to jsonbin.io and to ZapHosting (who run 147.189.174.138) about this.
A lot of hosting providers don't really care, sadly :(
Their upstream transit providers do, surely.
These seem like a common pattern lately. I feel for it but again people are creative in making business out of others desperation.
I've been meaning to learn/run QEMU on my linux box. I assume I don't need to do anything apart from rebuild the image each time I need to do this?
Yes I most likely will tell them to get lost, but if I get an invite from Larry/Sergey I want to be ready.
You'll probably need to enable some "secure memory mode" in BIOS, e.g. a boot error that you ignore which says something like "KVM disabled by BIOS" needs to be made to go away.
Realistically you want virtualbox, which is closed source and proprietary. qemu will run Linux but I don't think it's accurate and performance enough to run windows, right?
You can run a Windows VM with QEMU, but virt-manager is probably a simpler choice. Qemu is very accurate and performant, but also very flexible and not exactly straightforward to configure. But if your goal is to experiment with virtualization and learn, either one is probably a better choice than VirtualBox.
If security/isolation of unknown not quarantined code, Windows would not be high in my list as a sandbox.
A recruiter recently sent me an "I'd like you to explore..." email. Every "further info" link in it pointed to znsrc.com/[unique_id] rather than to the displayed address.
That felt dishonest and I ignored the email.
That’s standard click tracking usually. No different than clicking on a sponsored Google result.
Sure, would have preferred an honest "we use standard click tracking service, it will totally redirect you to our website" or some such thing
I received so many of these requests to install malware that I removed linkedin from my life completely (besides the scam and spam flood)
Do not install anything on your machine, ever. Tell them politely ~to fuck off~ that you are not interested and move on. I know the desperation to be jobless will obfuscate your mind but again, never ever install anything on your machine when job hunting. I've seen people lose their crypto savings in seconds to say the least.
You've been warned.
Instructions clear. Every time a company asked for a zoom call I told them to fuck off, I won't install that. Now I'm homeless. Now what should I do?
.... Why would you do job interview when they expect you to run some code on your own system, on your own time?
Maybe I work in a different field but last year when I was still looking for jobs, only one company asked for coding assignment and every other company did coding interview which is always browser based editor.
I feel like the industry is mature enough that you can tell a company that sends you a zip file of code to f-off.
> .... Why would you do job interview when they expect you to run some code on your own system, on your own time?
Because both the company and you know it’s the most effective job interview “filter” in SWE roles.
> on your own time
It may not be unpaid if you’re applying to a decent company.
The issue here is their poor implementation (zip file), not the concept itself, IMO.
wonder if codex can catch issues ?
> A note on the AI part: Claude Code was not able to detect any strange things when just prompted to scan the code base for unusual patterns.
> It never asks for elevation. It doesn’t need root, UAC, or sudo, because nothing it wants is root-owned. SSH keys, AWS credentials, browser profiles, wallet data, .env files - all of it is user-owned by design, because you need to read it routinely.
Tangentially, what have people found that works well in term of hardening [0] desktop linux? For example, at least keeping "banking" separate from code-development?
I figure the only good way to keep separate user accounts and whenever I have to do something as root, I switch to the most-secure and least-used of the accounts.
[0] https://xkcd.com/1200/
Do not ever run anything, download anything.
It reads like a true crime story.
Bad actor had prepared the set up so precisely that Claude Code could not detect it.
Malware Bytes? Acronis? There must be some template…
> The code is available on Bitbucket, which IMHO is uncommon
What? There is no world outside github?
The rest of the article is legit, but they had to insert some monopoly worship...
[dead]
[flagged]