Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I almost got hacked by a 'job interview'

blog.daviddodda.com

Post reply on HN
Print view View original

41–50 of 534 posts

Re: I almost got hacked by a 'job interview'

#41

Post by gruez »

Juliate wrote: post #21
ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

That's why from my perspective, almost everything is f'd up in tech at this point. Any update I may do to any project dependencies I have on my workstation? Either I bet, pray and hope that there's no malicious code in these. Either I have an isolated VM for every single separate project. Either I just unplug the thing, throw it in the bin, and go make something truly lucrative and sustainable in the near future (plu…

>Either I have an isolated VM for every single separate project.

That's not too hard to do with devcontainers. Most IDEs also support remote execution of some kind so you can edit locally but all the execution happens in a VM/container.

Re: I almost got hacked by a 'job interview'

#42

Post by input_sh »

ohman876 wrote: post #30
koakuma-chan wrote: post #24

Earlier quoted context omitted.

You can click on the verification badge and see if the person has job verification. If not, that's a red flag. I never paid attention to this myself but I will in the future.

Interesting, I didn't know there is such thing on Li! Is this done by past employers?

You just verify that you have access to an email address that belongs to a company (@example.com) by entering a six digit code they send to your work email. This in theory verifies that you work there, but obviously nothing else like your actual position at the company.

From an attacker standpoint, if an attacker gains access to any email address with @example.com, they could pretend to be the CEO of example.com even if they compromised the lowest level employee.

Re: I almost got hacked by a 'job interview'

#43

Post by zahlman »

devy wrote: post #16

The pseudonym "Mykola Yanchii" on LinkedIn [1] doesn't look real at all. Click "More" button -> "About this profile", RED FLAGS ALL OVER. -> Joined May 2025 -> Contact information Updated less than 6 months ago -> Profile photo Updated less than 6 months ago Funny things, this profile has the LinkedIn Verified Checkmark and was verified by Persona ?!?! -> This might be a red flag for Persona service itself as it migh…

How am I supposed to become a real, trustable person on LinkedIn if I'm not already there?

Re: I almost got hacked by a 'job interview'

#44

Post by jacquesm »

atropoles wrote: post #27

I had someone who was targeting junior developers posting on Who Wants to Be Hired threads here on Hacker news. They reached out saying they liked my projects and had something I might be interested in, then set up an interview where they tried to get me to install malware.

HN has harbored fugitive hackers knowingly, this does not surprise me at all.

Re: I almost got hacked by a 'job interview'

#45

Post by UI_at_80x24 »

atropoles wrote: post #27

I had someone who was targeting junior developers posting on Who Wants to Be Hired threads here on Hacker news. They reached out saying they liked my projects and had something I might be interested in, then set up an interview where they tried to get me to install malware.

Name and shame.

Re: I almost got hacked by a 'job interview'

#46

Post by zahlman »

abtinf wrote: post #4

I’ve grown to depend on little snitch for this sort of thing. Always run in either Alert or Deny mode. It is a little wild how many things expect to communicate with the internet, even if you tell them not to. Example: the Cline plugin for vscode has an option to turn off telemetry, but even then it tries to talk to a server on every prompt, even when using local ollama.

... And people think I'm crazy for complaining about automated build systems that expect Internet access....

Re: I almost got hacked by a 'job interview'

#47

Post by theptip »

ryandrake wrote: post #6

> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing. Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your…

Is there a market for a distributed audit infra with attestations? If I can have ChatGPT audit a file (content hash) with a known-good prompt, and then share the link as proof of the full conversation, would this be useful evidence to de-risk?

If each developer can audit some portion of their dep tree and reuse prior cached audits, maybe it’s tractable to actually get “eyeballs” on every bit of code?

Not as good as human audit of course, but could improve the Pareto-frontier for cost/effectiveness (ie make the average web dev no-friction usecase safer).

Re: I almost got hacked by a 'job interview'

#49

Post by jacquesm »

a022311 wrote: post #35
abtinf wrote: post #4

I’ve grown to depend on little snitch for this sort of thing. Always run in either Alert or Deny mode. It is a little wild how many things expect to communicate with the internet, even if you tell them not to. Example: the Cline plugin for vscode has an option to turn off telemetry, but even then it tries to talk to a server on every prompt, even when using local ollama.

I agree, it's very valuable in these situations, although it can only minimize damage. For Littlesnitch/OpenSnitch users: avoid allow rules that apply to all apps. Malware can and has used even trusted websites like Github Gists to expose secrets extracted. In any case, even if your firewall protects you, you'll still have to treat the machine as compromised.

OpenSnitch like functionality should come installed and activated by default.
Post reply on HN